Privacy Policy
This policy explains what personal data Wholara collects, why we collect it, how we handle it, and what you can ask us to do with it. It covers both this website and the Wholara platform.
Last updated: 18 May 2026 · Applies to: wholara.net and the Wholara platform
In one paragraph. We collect the minimum we need to respond to enquiries and operate the platform. We do not sell personal data. We do not use customer operational data for advertising. Website visitors can browse anonymously, and we only set non-essential cookies with consent.
1. Who we are
Wholara ("we", "us", "our") provides an operations platform for wholesale distributors, accessible at wholara.net and through the Wholara application.
For personal data collected through this website — such as contact and demo requests — Wholara is the data controller. For operational data that our customers load into the platform, the customer is the controller and Wholara acts as a data processor under a separate data processing agreement.
If you have a question about this policy, contact privacy@wholara.net.
2. What we collect
2.1 Information you give us
When you complete a form on this website — a demo request, a contact message or an email subscription — we receive:
- Your name and work email address
- Your company name, role and, if you choose to provide it, a phone number
- Information about your operation that you choose to share, such as distribution category, number of locations, approximate SKU count and current systems
- The content of your message, including any questions or requirements you describe
- Your consent preference for us contacting you
Providing these details is optional. If you do not provide the fields we mark as required, we cannot respond to your request. Please do not send us personal data about other people, and do not send customer or pricing data before a data processing agreement is in place.
2.2 Information collected automatically
When you visit this website, our hosting infrastructure records standard technical information in server logs:
- IP address, and approximate location derived from it
- Browser type and version, operating system and device type
- Pages requested, the date and time, and the referring page
- Error and performance information needed to keep the site available
We use this to operate and secure the website and to understand aggregate usage. We do not attempt to identify individual visitors from this information.
2.3 Information from third parties
We may receive limited professional information from partners who refer an enquiry to us, and business contact details from publicly available sources where we believe a distributor may be interested in the platform. Where we rely on legitimate interests for this, you can object at any time using the contact details below.
3. Why we use your information
| Purpose | What it involves |
|---|---|
| Responding to your enquiry | Replying to demo requests and messages, preparing for a call, and following up on what was discussed |
| Providing the platform | Creating accounts, configuring your environment, providing support and delivering agreed services |
| Improving the product | Understanding which workflows are used, and in aggregate which features cause difficulty |
| Communicating with you | Sending service notices, and product notes if you have asked to receive them |
| Keeping things secure | Detecting abuse, preventing unauthorised access and investigating incidents |
| Meeting our obligations | Accounting, tax, contractual record-keeping and responding to lawful requests |
What we do not do
- We do not sell or rent personal data to anyone.
- We do not use customer operational data to train models that are shared with, or made available to, other customers.
- We do not use your enquiry details for advertising on third-party platforms without your consent.
- We do not send marketing email to people who have asked us not to.
4. Our legal basis for processing
Where the GDPR or comparable law applies, we rely on the following bases:
- Consent — for sending you product notes or other marketing email, and for any non-essential cookies. You can withdraw consent at any time.
- Contract — to provide the platform and support to a customer organisation, and to take steps at your request before entering a contract.
- Legitimate interests — to respond to a business enquiry, to secure our systems, and to improve our product in ways that do not override your rights.
- Legal obligation — to keep records where accounting, tax or other law requires it.
5. Data inside the Wholara platform
When a distributor uses Wholara, the platform holds operational records: items, suppliers, customers, orders, stock movements, prices and fulfilment activity. This data belongs to the customer.
Wholara acts as a processor for that data and handles it only on the customer's documented instructions. Our obligations — including security measures, sub-processor approval, breach notification, assistance with data subject requests, and deletion on termination — are set out in the data processing agreement signed with each customer.
Platform data may include personal data about the customer's own contacts, such as delivery contact names and phone numbers. Responsibility for the lawfulness of that data rests with the customer as controller; we provide the technical and organisational measures to protect it.
6. Cookies and analytics
This website uses as few cookies as possible:
- Essential — strictly necessary for the site to function, such as remembering a session or a form state. These do not require consent.
- Preference — remembering choices such as a dismissed notice. Set only if you interact with the relevant element.
- Analytics — aggregate measurement of which pages are used. Set only with your consent, and configured so that IP addresses are not stored in full.
Our font and stylesheet assets are served from third-party content delivery networks. Those providers may see your IP address as part of delivering the file, as any web server would. We do not permit them to use it for advertising.
You can block or delete cookies in your browser settings. Blocking essential cookies may prevent parts of the site from working.
7. Who we share data with
We share personal data only where necessary, and only with organisations bound by confidentiality and data protection terms:
- Hosting and infrastructure providers who operate the servers and storage on which the platform and website run.
- Business software providers used to run our own company — email, customer relationship management and support tooling.
- Professional advisers such as accountants and lawyers, where required.
- Authorities where we are legally required to disclose information, or where disclosure is necessary to establish, exercise or defend legal claims.
A current list of sub-processors relevant to platform data is maintained and provided to customers under the data processing agreement, with notice of changes as required by that agreement.
8. International transfers
Our infrastructure may store and process data in countries other than the one in which you are located. Where personal data is transferred internationally, we put appropriate safeguards in place — typically standard contractual clauses or an equivalent approved mechanism — and we assess the practical protections available in the destination.
Customers with specific requirements, including regional data residency, can discuss hosting options as part of an enterprise agreement.
9. How long we keep data
| Data | Retention |
|---|---|
| Enquiry and demo request details | Kept while the conversation is active, and for up to 24 months afterwards in case you return to the discussion. Deleted earlier on request. |
| Email subscription details | Until you unsubscribe, plus a short suppression record so we do not contact you again in error. |
| Server logs | Retained for a short operational period, typically no more than 90 days. |
| Customer platform data | For the term of the agreement, then exported or deleted according to the terms agreed with that customer. |
| Contract and financial records | For the period required by applicable accounting and tax law. |
10. Security
We apply technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction. These include:
- Encryption of data in transit and at rest
- Logical separation of customer environments
- Role-based access control limiting what each user and each integration credential can reach
- Optional multi-factor authentication, and single sign-on on enterprise terms
- Logging of administrative and configuration changes
- Regular backups with tested restoration procedures
- Access to production systems restricted to staff who require it, under confidentiality obligations
No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify affected customers and, where required, supervisory authorities without undue delay.
Security questions and vulnerability reports: security@wholara.net.
11. Your rights
Depending on where you live, you may have some or all of the following rights:
- Access — a copy of the personal data we hold about you.
- Correction — correction of data that is inaccurate or incomplete.
- Deletion — deletion of data where we no longer have a lawful reason to keep it.
- Restriction — limiting how we use your data while a question is resolved.
- Portability — receiving data you provided in a structured, commonly used format.
- Objection — objecting to processing based on legitimate interests, including direct marketing.
- Withdrawing consent — at any time, where consent is the basis for processing.
To exercise any of these, email privacy@wholara.net. We will respond within the timeframe required by applicable law, normally within 30 days. We may need to verify your identity before acting, and we will tell you if we cannot fulfil a request and why.
If you are in the UK or EU and are unhappy with our response, you have the right to complain to your national data protection authority. We would appreciate the chance to resolve it first.
12. Children
Wholara is a business platform. It is not intended for use by children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the product and our practices develop. The date at the top shows when it was last revised. Where a change materially affects how we handle personal data, we will make that clear on this page and, where appropriate, notify customers directly.
14. How to contact us
Note. This policy is written to describe how a platform business of this kind handles personal data. It is published as part of a demonstration website build and should be reviewed by qualified legal counsel, and adapted to your jurisdiction, contracting entity and actual practices, before it is relied upon commercially.
Questions about how we handle your data?
Ask us directly. Security and privacy enquiries are answered by the team that runs the platform.
wholara.net