Privacy Policy

Exel Wholesale (“Exel”, “we”, “our”, or “us”) operates the website exelwholesale.com and the services available through it (collectively, the “Platform”). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable Indian laws.

By creating an account or using the Platform, you agree to the practices described in this policy. If you do not agree, please do not use the Platform.

We collect the following categories of personal data:

We do not collect or store full card numbers or CVV details. Payment card data is handled entirely by Razorpay on their PCI-DSS compliant infrastructure.

We use your personal data only for the purposes listed below:

• Account management — creating and maintaining your buyer or seller account.
• Order processing — fulfilling purchases, communicating order status, and resolving disputes.
• Payment processing — initiating and verifying transactions via Razorpay.
• Platform communications — sending order confirmations, shipping updates, and important service notices.
• Seller payouts — transferring settlement amounts to verified seller bank or UPI accounts.
• Fraud prevention and security — detecting and blocking suspicious or unauthorised activity.
• Product improvement — understanding how the Platform is used to improve features and fix issues.
• Legal compliance — meeting obligations under the DPDP Act, GST law, and other applicable regulations.

We do not sell your personal data to third parties. We do not use your data for targeted advertising.

We share your data only where necessary to operate the Platform:

• Razorpay Financial Solutions Pvt. Ltd. — payment processing. When you make a purchase, your order amount and a Razorpay Order ID are shared with Razorpay to initiate the transaction. Razorpay’s privacy policy is available at razorpay.com/privacy.
• Supabase Inc. — database and authentication infrastructure. Your account and order data is stored on Supabase servers. Supabase’s privacy policy is available at supabase.com/privacy.
• Logistics and shipping partners — your name and delivery address are shared with the relevant courier or logistics provider to fulfil your order.
• Legal authorities — we may disclose data when required to do so by law, court order, or a lawful request from a government authority.

• Account data is retained for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law.
• Order and payment records are retained for 7 years to comply with GST and financial record-keeping requirements under Indian law.
• Usage data (logs, analytics) is retained for up to 12 months.
• Support communications are retained for up to 2 years.

Under the DPDP Act, 2023, you have the following rights regarding your personal data:

• Right to access — request a summary of the personal data we hold about you.
• Right to correction — ask us to correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data, subject to legal retention requirements.
• Right to grievance redressal — raise a complaint with our Data Protection Officer (see Section 9).
• Right to nominate — nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email us at privacy@exelwholesale.com. We will respond within 30 days.

We use the following types of cookies and local storage:

• Strictly necessary — session tokens, authentication state, and shopping cart data. These cannot be disabled as they are required for the Platform to function.
• Analytics — anonymised usage data to understand how visitors use the Platform. No personally identifiable information is included.

We do not use third-party advertising cookies. You can clear cookies at any time via your browser settings, though this will sign you out of your account.

We implement reasonable technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all data transmitted to and from the Platform.
• Passwords stored as salted hashes — we never store plaintext passwords.
• Payment card data never touches our servers — handled entirely by Razorpay.
• Access to production databases restricted to authorised personnel only.
• Webhook signatures verified cryptographically before processing any payment events.

No system is completely secure. If you believe your account has been compromised, contact us immediately at help@exelwholesale.com.

Questions about this policy or your data? Write to us at help@exelwholesale.com and we will get back to you within 30 days.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is constituted under the DPDP Act, 2023.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a notice on the Platform. The “Effective date” at the top of this page always reflects the date of the latest revision. Continued use of the Platform after changes are posted constitutes acceptance of the updated policy.