Privacy Policy

Elitesecom (OMS Vision Solutions LLP) provides a multichannel Order Management System (OMS) and Warehouse Management System (WMS) platform designed for e-commerce sellers. We are committed to safeguarding personal data in accordance with applicable global data privacy regulations, including the European Union General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”).

This Privacy Policy explains how we collect, process, safeguard, and manage personal data across our operations, website, mobile application, and SaaS platform integrations.

When e-commerce sellers connect marketplaces (such as Amazon, Flipkart, Shopify, Meesho, Myntra, Nykaa, Ajio, and Snapdeal) or courier partners to our platform, we process transaction data, order records, customer fulfillment details, and shipping information strictly as a Data Processor on behalf of and under the documented instructions of our clients (the Data Controllers).

For data processed as a Data Controller, we rely on the following GDPR legal bases:

• Performance of a Contract (Art. 6(1)(b)): Providing OMS and WMS software services, authenticating authorized users, managing subscriptions, and providing technical support.
• Legitimate Interests (Art. 6(1)(f)): Ensuring platform availability, monitoring network security, preventing fraud, generating aggregated operational performance analytics, and improving platform functionality.
• Legal Obligation (Art. 6(1)(c)): Complying with statutory accounting, taxation, company law, and law enforcement requests.
• Consent (Art. 6(1)(a)): Operating non-essential website cookies or sending marketing newsletters (where opted in).

For data processed as a Data Processor, we process personal data strictly pursuant to Article 28(3)(a) upon the documented instructions of our merchant clients and applicable Data Processing Addenda (DPAs).

In compliance with strict third-party marketplace terms and privacy standards:

• Purpose Limitation: Marketplace and customer data are accessed exclusively to provide multi-channel order processing, real-time inventory synchronization, automated shipping label generation, and payment/return reconciliation. We never use marketplace data for independent commercial, profiling, or advertising purposes.
• Data Minimization: Platform ingestion APIs are configured to extract only the minimum data attributes necessary for order fulfillment and logistics routing.
• Amazon Buyer PII: Buyer names, shipping addresses, and contact details received through the Amazon Selling Partner API are used solely for order fulfillment, shipping label and invoice generation, and order-related customer support. Amazon buyer PII is encrypted in transit and at rest, retained only for the contracted service term or as instructed by the seller, and deleted or anonymized on contract termination or verified request.
• No Selling of Personal Data: We do not sell, rent, or lease any personal data.

For detailed information about Amazon SP-API security and data handling, please see our Amazon SP-API Security page.

We engage vetted third-party service providers (sub-processors) to deliver platform infrastructure under binding contracts requiring strict confidentiality and technical security safeguards (Art. 28(4)):

• Cloud Hosting & Infrastructure: Dedicated cloud hosting provided across Amazon Web Services (AWS) data centers.
• Logistics & Courier Gateways: Integrated logistics providers and courier aggregators strictly for transmitting destination details to print shipping labels and retrieve real-time tracking numbers.
• Professional & Legal Advisors: Legal, auditing, and compliance advisors under professional duties of confidentiality.

We ensure that all sub-processors are subject to data protection obligations no less protective than those set out in this Policy and our Data Processing Agreements.

Elitesecom operates from India and hosts infrastructure on dedicated AWS cloud servers. When personal data originating in the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred outside these territories to jurisdictions without an adequacy decision:

• Transfers are governed by the European Commission’s approved Standard Contractual Clauses (SCCs) (Module 2: Controller-to-Processor; Module 3: Processor-to-Processor).
• Transfers are supplemented by technical safeguards, including data encryption in transit (TLS 1.2+) and at rest (AES-256), restricted role-based administrative access, and vulnerability management.

Clients subject to GDPR can execute our standard Data Processing Addendum incorporating EU SCCs upon request.

We have implemented technical and organizational measures (TOMs) aligned with ISO/IEC 27001:2022 and SOC 2 Type II principles:

• Encryption: Strong encryption of data in transit using modern TLS protocols and data at rest utilizing industry-standard cryptographic algorithms (AES-256).
• Access Control: Multi-tenant logical isolation, strict role-based access control (RBAC), multi-factor authentication (MFA), and least-privilege administrative access policies.
• Security Testing: Continuous monitoring, routine patch management, periodic external Vulnerability Assessment and Penetration Testing (VAPT), and immutable audit logging.
• Breach Notification: Documented Security Incident Response Procedures mandating that in the event of a verified personal data breach impacting client data, Elitesecom will notify affected Data Controllers without undue delay (Art. 33(2)) to support their statutory obligations.

For detailed information about our security practices, please see our Security & Compliance page.

We retain personal data strictly in accordance with business requirements, contractual commitments, and statutory obligations:

• Account Records: Retained for the duration of the active subscription and for a statutory period post-termination to satisfy legal, tax, and audit obligations.
• Order & Transaction Data: Retained throughout the contracted service term for active order processing and reconciliation, or as contractually instructed by the client.
• Contract Termination & Purging: Upon contract termination or explicit controller request, personal data processed on behalf of the client is either securely returned or irreversibly deleted/anonymized from production systems in accordance with Art. 28(3)(g) and our sanitization schedules.

B. For End-Consumers / Marketplace Shoppers (Processor Data)

Our SaaS solutions are intended exclusively for commercial business operations and are not directed to individuals under the age of 18. We do not knowingly collect personal data from children.

We review and update this Privacy Policy periodically to reflect technological changes, product enhancements, or updated regulatory requirements. When material changes occur, we will notify registered account holders via our platform dashboard or registered email prior to the changes taking effect.

For questions regarding this policy, exercising data protection rights, or executing a Data Processing Addendum (DPA), please contact our privacy office: