Privacy Policy

This Privacy Policy describes how Nuwall Wallpapers Pvt. Ltd. ("Piwall," "we," "our," or "us") collects, uses, shares, retains, and protects the personal data of users of the Piwall mobile application ("App") and website piwall.in (together, the "Services"). We are committed to handling your personal data in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules thereunder, and other applicable Indian laws.

1. Who we are

Piwall is a B2B wallpaper marketplace operated by Nuwall Wallpapers Pvt. Ltd., a company incorporated under the Companies Act, 2013, with its registered office at 07/207 K, N.n Palayam, Pattanam Villege, cbe 16, Palladam, Pallapalayam, Coimbatore, Tamil Nadu, 641016, India. For the purposes of the DPDP Act, Piwall is the "Data Fiduciary" and you are the "Data Principal."

2. Personal data we collect

We collect the following categories of personal data:

a. Information you provide directly

• Full name, business name, designation
• Phone number (used for OTP-based authentication)
• Email address
• GSTIN, PAN, and other tax registration numbers (for B2B invoicing)
• Billing and shipping addresses, including pincode, city, and state
• Profile photograph (if you choose to upload one)
• Bank account or UPI details (only where required for refunds — we never store full card numbers)

b. Information collected automatically

• Device information (model, OS version, unique device identifier, push notification token)
• App usage data (screens visited, features used, session duration, crash reports)
• IP address and approximate (coarse) location derived from it
• Precise location (latitude/longitude), only when you explicitly grant "While Using App" permission, to help you pick delivery addresses
• Order history, cart contents, and product interaction data
• Payment transaction identifiers (we do not store full payment instrument details)

c. Information from third parties

• GST verification data from public government APIs
• Payment confirmation data from Razorpay and ICICI Bank
• Delivery status from our logistics partners

Note: The Piwall App does not track your background location. Background GPS tracking is only used in our separate "PW Partners" app (for delivery staff) and is governed by that app's own privacy policy.

3. How we use your personal data

We process your personal data for the following purposes, each with a lawful basis under the DPDP Act:

• Service delivery: To create and manage your account, authenticate you via OTP, process orders, arrange deliveries, issue GST invoices, and handle returns
• Payments: To initiate and reconcile payments via Razorpay, ICICI EasyPay UPI, and cash-on-delivery
• Communication: To send transactional notifications (order updates, delivery alerts, payment receipts) via push, SMS, email, and WhatsApp
• Support: To respond to your queries, complaints, and grievances
• Improvement: To analyse app usage and diagnose technical issues so we can improve the Services
• Fraud prevention and security: To detect, prevent, and investigate fraud, abuse, or violations of our Terms
• Legal compliance: To comply with tax laws, the DPDP Act, court orders, and regulatory requirements

4. Third parties we share data with

We share limited personal data with the following categories of third parties, only to the extent necessary for the purposes listed above:

Each third party is contractually required to process your data only for the purpose disclosed and to implement reasonable security safeguards. We do not sell your personal data to advertisers or data brokers.

5. Cross-border transfers

Some of our service providers (notably Google Firebase and Amazon Web Services) may process your data on servers located outside India, including in the United States and the European Union. We rely on contractual safeguards and industry certifications (ISO 27001, SOC 2) to ensure these transfers provide a level of protection consistent with the DPDP Act. Our OTP SMS partner MSG91 hosts data on servers located within India. The Central Government may notify specific countries to which transfer is restricted; we will comply with any such notification.

6. Data retention

• Account data: Retained for as long as your account is active, and for up to 3 years after account deletion to comply with tax, GST, and statutory audit requirements
• Order and invoice records: Retained for a minimum of 8 years as required under GST and income-tax laws
• Delivery proof photographs: Retained for 7 days, then automatically deleted by our cloud storage lifecycle policy
• OTP logs: Retained for 90 days for fraud investigation, then deleted
• Crash and diagnostic data: Retained for 180 days

7. Your rights under the DPDP Act

As a Data Principal, you have the following rights:

• Right to access: To obtain a summary of the personal data we hold about you and the processing activities undertaken
• Right to correction and erasure: To have inaccurate or incomplete personal data corrected, completed, updated, or erased
• Right to grievance redressal: To lodge a grievance with our Grievance Officer (see section 12 below)
• Right to nominate: To nominate another individual to exercise your rights in the event of your death or incapacity
• Right to withdraw consent: To withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, email support@piwall.in or use the Delete Account option inside the App (Account → Settings → Delete Account).

8. Account deletion

You can delete your Piwall account at any time directly from within the App: go to Account → Settings → Delete Account. You will be asked to verify the request with an OTP sent to your registered phone number. Upon verification, your account will be deactivated immediately and your personal data will be erased within 30 days, except for records we are legally required to retain (for example, tax invoices).

If you have uninstalled the App or cannot access it: email support@piwall.in from your registered email address, with the subject line Delete my Piwall account. We will verify your identity with an OTP sent to your registered phone number and erase your data within 30 days, subject to the retention exceptions in Section 6 above.

For any issue with the deletion process, contact our Grievance Officer via the Grievance Redressal page.

9. Children's privacy

The Services are intended for use only by businesses and individuals aged 18 years or older. We do not knowingly collect personal data from children. If we learn that we have inadvertently collected personal data from a child, we will delete it promptly.

10. Security

We implement reasonable security practices and procedures as prescribed under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and in line with the requirements of the DPDP Act. These include encryption in transit (TLS), encryption at rest for sensitive fields, access controls, audit logging, and periodic security reviews. No method of transmission over the internet is 100% secure, so we cannot guarantee absolute security.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you via the App or by email before the change takes effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

13. Contact us

For any questions about this Privacy Policy, email support@piwall.in or write to us at the registered address above.