Privacy Policy

1. Who we are

ENS Enterprises Limited ("ENS", "we", "us", "our") is an authorised Network Participant on the Open Network for Digital Commerce (ONDC), and operates XpressBaazaar-InvLess, the seller application that lets registered merchants list products, manage orders, and receive demand from across the ONDC network without maintaining detailed inventory.

ENS is registered in India with its office at 2nd Floor, B-16, Sector 63, Noida, Uttar Pradesh 201301.

2. Who this policy covers

This policy covers two kinds of people:

• Sellers — the businesses and individuals who register on XpressBaazaar-InvLess to list products and fulfill orders. If you're using the app, this is you.
• Buyers — the end customers who place orders through buyer apps on the ONDC network. We don't have a direct relationship with buyers, but their order details pass through XpressBaazaar-InvLess so you can fulfill their purchase. Section 6 explains the rules around that data specifically.

3. Information we collect

• Registered mobile number (used to sign in via WhatsApp OTP)
• Business / seller name, email address, and GST or business registration details
• Store details and the product catalog, pricing, and availability you list

• App usage data — screens visited, actions taken (e.g. accepting a bid, pushing a listing)
• Device information and general diagnostic/crash data
• Order, bidding, and transaction history generated through your use of the app

• Buyer name, phone number, delivery address, email, and billing details — sent to you by the buyer's app solely so an order can be fulfilled

4. How we use it

• To create and maintain your seller account and authenticate you at login
• To display your dashboard — revenue, order counts, pending bids, and similar metrics
• To route your product catalog to buyer apps on the ONDC network and route incoming orders and bids back to you
• To operate order management — approvals, rejections, status updates, and the underlying ONDC Issue & Grievance Management (IGM) process for disputes
• To meet our legal, tax, and accounting obligations
• To keep the platform secure and investigate misuse, fraud, or policy violations

5. Who we share it with

• ONDC network participants — your catalog and order responses are shared with buyer apps and logistics providers on the network as needed to complete a transaction.
• Payment and settlement partners — to process and reconcile payouts for completed orders.
• Service providers — infrastructure and support vendors who process data on our behalf, under confidentiality obligations.
• Regulators and courts — where legally compelled, in which case we act only to the extent required.

We do not sell Seller or Buyer personal data to third parties.

6. Rules on buyer data

Buyer personal information reaches you through the app for one reason only: to fulfill that specific order. As a condition of using XpressBaazaar-InvLess, you agree not to:

• Use buyer contact details for independent marketing or promotions
• Reuse buyer data for off-network sales outside the ONDC ecosystem
• Build customer profiles from buyer data or share it with third parties for profiling

7. How long we keep it

• Account and profile data — kept for as long as your seller account is active, and for a reasonable period after closure in case you reactivate.
• Order and invoice records — retained for as long as applicable tax, accounting, and consumer-protection law requires.
• Buyer PII — retained only as long as needed to complete and service an order, per the DPDP purge obligation in Section 6.
• Records tied to an open dispute or fraud investigation — kept until that matter is resolved.

8. Your rights and choices

You can ask us to access, correct, or delete the personal data linked to your seller account at any time. Full instructions and an email template are on our Data Deletion page.

Order-level disputes involving buyers are handled through the ONDC Issue & Grievance Management (IGM) framework rather than this policy, so that they're resolved consistently across the whole network.

9. Security

We apply reasonable technical and organizational safeguards — including access restrictions and confidentiality obligations on our staff and service providers — to protect the data described in this policy. No system is completely secure, and we can't guarantee absolute protection, but we work to identify and respond to risks promptly.

10. Children's privacy

XpressBaazaar-InvLess is a business tool for registered sellers and is not directed at, or intended for use by, children. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy as the app or applicable law changes. Material changes will be reflected by updating the "last updated" date at the top of this page; where required by law, we'll notify you directly.

12. Grievance officer & contact

For privacy questions, requests, or complaints, reach us at [email protected].

In accordance with Indian law, grievances may also be addressed to our designated Grievance Officer: