Privacy Policy

WMart Ltd (“we”, “us”, or “our”) is committed to protecting the privacy and personal data of the people who use our wholesale platform at wmart.co.uk (the “Platform”). This Privacy Policy explains what personal data we collect, how we use it, and the rights you have.

This policy is issued in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

The data controller responsible for your personal data is WMart Ltd. You can contact us at privacy@wmart.co.uk.

If you are concerned about how we process your personal data you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We collect the personal data described below directly from you when you register and use the Platform:

• Business contact details: contact name, contact telephone number, and business email address.
• Business information: business legal name, business type, trading address, and VAT number where applicable.
• Account credentials: email address and password (passwords are stored as one-way hashes; we do not retain readable copies).
• Order information: the products you order, quantities, delivery addresses, and order history.
• Payment information: billing address and the card-payment metadata returned by our payment processor; we do not store full card numbers.
• Communications: any correspondence you send us through the contact form or by email.

When you use the Platform we also collect limited technical information automatically:

• Technical data: IP address, browser type and version, operating system, and device type.
• Session and security data: authentication cookies and short-lived tokens used to keep you signed in.
• Error-monitoring data: anonymised crash and error reports collected via Sentry to help us diagnose issues.

We process your personal data for the following purposes and on the following UK GDPR legal bases.

• Performance of a contract (Article 6(1)(b)): creating and managing your account, processing and fulfilling your orders, communicating about orders and invoices, and providing customer support.
• Legitimate interests (Article 6(1)(f)): keeping the Platform secure, preventing fraud, enforcing our Terms, and improving the Platform.
• Legal obligation (Article 6(1)(c)): complying with tax, accounting, food-safety, and other regulatory obligations, and responding to lawful requests from authorities.
• Consent (Article 6(1)(a)): only where the law specifically requires consent, for example placing any non-essential cookies in future.

We share personal data only where it is necessary to operate the Platform and only with the categories of recipient described below.

• Payment processor: Stripe, to take and reconcile card payments.
• Cloud and infrastructure providers that host the Platform and our databases.
• Error-monitoring provider: Sentry, to help us diagnose technical issues.
• Email-delivery provider used to send transactional and contact-routing email.
• Professional advisers (for example, accountants and legal counsel) where necessary.
• Regulatory authorities, including HMRC, the Food Standards Agency, and the ICO, where required by law.

Some of our service providers may process your data outside the United Kingdom. Where personal data is transferred outside the UK we rely on the safeguards permitted by UK GDPR, including UK International Data Transfer Agreements, standard contractual clauses, or transfers to countries that benefit from a UK adequacy decision.

We keep personal data only for as long as we have a lawful purpose for holding it. Account and transaction records that we need for tax and accounting purposes are retained for the periods required by UK law (typically up to seven years). Account data we no longer need is deleted or anonymised.

Under the UK GDPR you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your data in certain circumstances.
• Right to restriction: ask us to restrict our processing in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on our legitimate interests.
• Rights related to automated decision-making and profiling.

To exercise any of these rights, email privacy@wmart.co.uk. We will respond within one calendar month of receiving your request.

We implement technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit, access controls, and logged administrative actions.

No method of transmission over the internet or electronic storage is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

The Platform is intended for use by businesses and their authorised representatives who are aged 18 or over. We do not knowingly collect personal data from individuals under the age of 18.

We may update this Privacy Policy from time to time. We will publish any updated version on the Platform and, where appropriate, notify signed-in users. Continued use of the Platform after we publish an update constitutes acceptance of the updated policy.

For any questions or concerns about this Privacy Policy or our data practices, contact privacy@wmart.co.uk.