Data Protection & Privacy Practices

BuyDesi should collect only the information reasonably required for the relevant purpose, such as account creation, order fulfilment, payment, delivery, customer support, security and legal compliance.

Access to customer and seller information should be role-based. Seller users should see only the information necessary to fulfil authorised orders. Internal staff access should follow least-privilege principles.

Only the shipment information needed by the selected/assigned courier should be transmitted for pickup, transportation, delivery, tracking, returns or support.

Sellers must not copy, sell, export, scrape, independently market to or otherwise misuse customer data received through BuyDesi.

BuyDesi should use reasonable safeguards including secure authentication, access control, encryption where appropriate, logging, backups, vulnerability management and incident-response procedures appropriate to the system and risk.

BuyDesi should define retention periods for accounts, orders, invoices, payment records, support records, seller documents and security logs based on legal, tax, operational and contractual requirements.

BuyDesi should provide mechanisms for applicable requests relating to correction, access, consent withdrawal or other rights recognised by applicable law.

BuyDesi should maintain an internal process for identifying, containing, investigating and responding to suspected personal-data or security incidents, including applicable notifications required by law.

Contracts with payment providers, courier partners, cloud providers, analytics providers, communication providers and other processors should define security, confidentiality, permitted processing and data-handling responsibilities as appropriate.

The final privacy programme should be aligned with the laws and rules applicable to BuyDesi at the time of launch and should be reviewed when the business introduces new categories, new data uses, new partners or new technology.