 along with company name.png)
Privacy Policy
On this page
This Privacy Policy explains how GcomFlow ("GcomFlow") collects, uses, shares and protects personal data when you use our Platform. We act as the data fiduciary (controller) for account and Platform data. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act) and IT Rules, and, where they apply, the EU and UK GDPR and US state privacy laws such as the CCPA/CPRA.
1. Data we collect#
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, phone, company name, job title | You |
| Verification (KYC/KYB) | Government ID, business registration, tax ID, trade and customs IDs (see Seller verification documents below) | You, verification partners |
| Financial | Bank account for payouts, billing address, transaction history | You, payment processors |
| Shipping and customs | Pickup and delivery addresses, recipient details, invoices, HS codes, shipment contents and values | You, buyers, sellers, carriers |
| Ads data | Campaigns, budgets, ad creatives, impressions, clicks, conversions | You, Platform activity |
| Usage and device | IP address, browser, device ID, pages viewed, search terms, cookies | Automatically |
| Communications | Support tickets, chat messages, call notes | You |
We do not store full card numbers; payment processors handle them.
Seller verification documents#
To be authorised to sell or use trade services on GcomFlow, every seller provides the following, wherever they are based:
- Proof of identity of the owner or authorised signatory (passport or national ID card)
- Proof of business registration (certificate of incorporation, trade licence or sole-trader registration)
- Tax identification number issued in the seller's country
- Proof of business address dated within the last 3 months (utility bill, bank statement or lease)
- Proof of a bank account in the business's name (bank letter, statement or cancelled cheque)
- Declaration of ultimate beneficial owners holding 25% or more of the business
- Product compliance documents or brand authorisation letters, where the product category requires them
Documents not in English must come with a certified translation. Sellers based in the regions below also provide:
| Region | Business registration | Tax ID | Customs / trade ID | Owner or signatory identity | Other |
|---|---|---|---|---|---|
| UAE (Dubai) | Trade licence from the Department of Economy and Tourism or a free zone authority; Memorandum of Association | VAT Tax Registration Number (TRN), if VAT-registered | Dubai Customs client code | Emirates ID and passport (with UAE residence visa for expatriates) | Establishment card, where issued |
| United States | Articles of Incorporation or Organization; Certificate of Good Standing | EIN, or SSN/ITIN for sole proprietors; Form W-9 | CBP importer number; customs bond for formal imports | Passport or state-issued driver's licence | State sales tax permit where required; FDA registration for food, drugs, cosmetics and medical devices |
| Australia | ASIC registration with ACN (companies) | ABN | ABN or Customs Client Identifier (CCID) | Passport or Australian driver's licence | Product safety certifications where required |
| China | Business licence with Unified Social Credit Code (USCC) | USCC | Customs registration with the General Administration of Customs (GACC) | Legal representative's Resident Identity Card or passport | CCC certification for listed products |
| European Union | Extract from the national commercial register | VAT number validated in VIES | EORI number | Passport or national ID card of directors and beneficial owners | EU Responsible Person and CE declarations of conformity for regulated products |
| India | Certificate of Incorporation, partnership deed or Udyam registration | PAN | Importer-Exporter Code (IEC); AD code registered at the port | Aadhaar or passport, plus PAN of the signatory | RCMC from an export promotion council, where applicable |
| Russia | Extract from EGRUL (companies) or EGRIP (sole proprietors) with OGRN | INN (and KPP for companies) | INN as used in customs declarations | Passport of the general director | Company charter; EAEU (EAC) conformity certificates or declarations; enhanced sanctions screening, and some services may be unavailable |
We may ask for further documents to meet the law of the seller's or buyer's country, or if anything needs clarifying.
2. Why we use your data#
- Create and manage your account and verify your identity and business
- Process orders, payments, payouts, refunds and invoices
- Store, pick, pack, ship and clear goods through customs, including sharing data with carriers and authorities
- Run GcomFlow Ads, including targeting, measurement and billing
- Produce Demand Intelligence insights from aggregated, de-identified data
- Prevent fraud, money laundering and sanctions breaches, and keep the Platform secure
- Provide support and send service messages
- Send marketing, where you have consented or the law allows (you can opt out anytime)
- Meet legal, tax, customs and regulatory obligations
3. Legal grounds#
Under the DPDP Act we process personal data with your consent or for legitimate uses the Act permits, such as meeting legal obligations. Where GDPR applies, we rely on contract performance, legal obligation, legitimate interests (fraud prevention, security, service improvement) and consent (marketing, non-essential cookies).
4. Who we share data with#
- Buyers and sellers, to the extent needed to complete a transaction
- Carriers, freight forwarders, warehouses and customs brokers
- Customs, tax and other government authorities, as legally required
- Payment processors, banks and verification providers
- Cloud hosting, analytics, communication and support tools
- Professional advisers, and buyers of our business in a merger or acquisition
- Law enforcement, when required by law or to protect rights and safety
We do not sell personal data. Demand Intelligence reports use aggregated or de-identified data and do not identify individual buyers.
5. International transfers#
Because we operate worldwide, your data may be processed in India and in the countries where our partners, warehouses and carriers operate. We transfer data only as permitted by the DPDP Act and, for EU/UK data, using safeguards such as Standard Contractual Clauses.
6. Retention#
We keep personal data only as long as needed for the purposes above or as the law requires. Transaction, tax and customs records are typically kept for [8] years to meet Indian tax and foreign trade record-keeping rules. Closed accounts are deleted or anonymised within [X days] unless a legal hold applies.
7. Your rights#
Depending on where you live, you may have the right to:
- Access a summary of your personal data and how it is processed
- Correct, complete or update it
- Erase it, where we no longer need it
- Withdraw consent at any time (this does not affect past processing)
- Object to or restrict certain processing, and ask for data portability (GDPR)
- Opt out of targeted advertising, and not be discriminated against for exercising rights (US laws)
- Nominate someone to exercise your rights on your behalf (DPDP Act)
- Complain to a regulator, such as the Data Protection Board of India or your local EU/UK authority
To exercise these rights, email [privacy@gcomflow.com]. We respond within [30] days.
8. Cookies#
We use essential cookies to run the Platform and, with your consent, analytics and advertising cookies. You can change your choices in our cookie banner or browser settings at any time.
9. Security#
We use encryption in transit, access controls, logging and vendor security reviews. No system is fully secure. We will notify you and the relevant authorities of a personal data breach as the law requires.
10. Children#
The Platform is not intended for anyone under 18. We do not knowingly collect children's data, and will delete it if we learn we have.
11. Changes#
We will post updates here with a new date and notify you of material changes.
12. Contact#
Data protection contact: [privacy@gcomflow.com], [Registered Address]. EU/UK representative (if appointed): [Details].