Data Retention Policy

BuyWell Marketplace, operated by Qbiqal Technology Solutions, retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. This policy sets out our retention periods and disposal practices.

1. Retention Schedule

Account Data

• Active accounts: Retained for the duration of your account's existence.
• Account deletion request: A 60-day soft-delete period applies. Your account is deactivated and inaccessible, but data is preserved for restoration if you change your mind. During this period, you can log in to cancel the deletion.
• After 60 days: Personal identifiers (name, email, phone) are anonymised (replaced with pseudonymous tokens). Your order history is retained in anonymised form for legal compliance.
• Full erasure: On your written request after the 60-day period, all personally identifiable data is permanently deleted, except records required by law.

Order and Transaction Records

• GST/Tax records: 7 years from the date of the transaction (required by the Income Tax Act 1961 and GST laws).
• Payment proof uploads: 2 years, then securely deleted.
• Razorpay transaction logs: As retained by Razorpay under their data policy; we retain references for 7 years.

Address Data

• Active addresses are retained as long as the account is active.
• Deleted addresses are removed immediately upon customer deletion.
• Address snapshots in orders are retained with order records for 7 years.

Reviews and Comments

• Reviews and blog comments are retained as long as the content is live.
• Upon account deletion, reviews are anonymised (author name replaced with "Verified Buyer").

Communication Logs

• Email logs: 90 days.
• WhatsApp delivery logs: 90 days.
• Support queries: 2 years for quality and dispute resolution purposes.

Security and Audit Logs

• Login logs and IP records: 90 days.
• Admin action logs: 1 year.
• Data breach records: 5 years.

Analytics Data

• Aggregated, anonymised traffic analytics: retained indefinitely for business insights (not personal data).
• No personal data is retained in analytics records.

Vendor Data

• Vendor account data: retained while the vendor account is active + 3 years after closure (for financial and legal records).
• Commission and payout records: 7 years.

2. Account Deletion and the 60-Day Restoration Window

In compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), customers who request account deletion enter a 60-day restoration period:

• Your account is immediately deactivated — you will not appear in the platform and your data will not be used.
• Within 60 days, you can log in to restore your account with all data intact.
• After 60 days, data anonymisation begins automatically.
• If you want complete erasure before the 60 days, email us at privacy@buywell.in with the subject "Immediate Deletion Request".

Pending orders at the time of deletion will continue to be fulfilled, and order records retained for legal compliance.

3. Data Disposal

• Digital data is overwritten or cryptographically erased using industry-standard methods.
• Database records are anonymised (pseudonymisation) rather than hard-deleted where retention is legally required.
• We do not retain hard copies of personal data. Any printed documents are shredded.

4. Your Right to Erasure

Under the DPDP Act 2023 and GDPR, you have the right to request erasure of your personal data. We will comply within 30 days, subject to:

• Legal retention obligations (GST, Income Tax).
• Pending disputes, returns, or investigations.
• Data required for the exercise or defence of legal claims.

5. Cross-Border Retention

Data stored on EU-based servers (Hetzner, Germany) is subject to both Indian law (DPDP Act) and EU GDPR. Our retention schedules comply with the more stringent of the two where they differ.