WhaShield — a service of WHASOLS (SMC-PRIVATE) Limited
Effective: 14th Aug, 2026 | Last updated: 14th Aug, 2026WHASOLS (SMC-PRIVATE) Limited ("WHASOLS," "we," "us," "our") takes the protection of your personally identifiable information ("Personal Data") seriously. This Privacy Policy ("Notice") covers Personal Data we process in three distinct contexts:
Unless stated otherwise, this Notice applies to all three categories described above.
We collect order-related data and process it through WhaShield to assess the likelihood of e-commerce fraud. Our customers use this risk analysis to make better decisions about which orders and users to trust — for example, an online store using WhaShield to screen international orders and reduce chargebacks.
We work to ensure that the Personal Data we collect is appropriate and proportionate to the Service we provide. You can request that we delete, or refrain from selling, any Personal Data we hold about you at any time, using the process described below.
Across all three categories of Personal Data described above, WHASOLS determines the purposes and means of processing. As a result, we act as a "data controller" or "business" under applicable privacy laws, including the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA") (together with other applicable laws, the "Applicable Laws").
Data used in the Service. The Personal Data we collect for the Service is summarized in the table below. We collect only the order information needed to assess e-commerce transaction risk. Most of this data is supplied by our customers based on information gathered during checkout on their site; customers may also embed our JavaScript to observe visitor activity on their own site.
Data collected via the Website or from customers. When you visit our Website, contact us, or become a current, prospective, or former customer, we may collect:
This Notice does not cover Personal Data of our employees, job applicants, contractors, directors, officers, or other staff.
We rely on one or more of the following lawful grounds to process your Personal Data:
Where we receive Personal Data under a contract with you, that data is necessary to perform the contract — without it, we cannot provide the Service.
Data used in the Service: We process certain categories of Personal Data within WhaShield to calculate e-commerce order risk. Our customers decide how to use this output — typically for fraud screening and export-control compliance, including deciding whether to accept or decline an order, or to detect proxy-server use. See the table below for more detail on data sources and third parties.
Data collected via the Website or from customers: we also process Personal Data to:
We do not collect additional categories of Personal Data without informing you first.
| Personal Data | How We Obtain It | Business/Commercial Purpose | Third Parties Who Receive It |
|---|---|---|---|
| Identifiers — name, username, email, company name, phone, IP address, device fingerprint | Order form on our Website, or supplied through the Service by our customers | Fraud-risk analysis for our customers; our and their legitimate interests as described above | Our customers; infrastructure and software-management vendors (service desk, bug tracking, etc.) |
| Special categories — payment card information | Same as above | Same as above | Same as above |
| Commercial information — order amount, currency, quantity | Same as above | Same as above | Same as above |
| Internet/network activity — site interaction, proxy use, ISP, connection speed, carrier data | Same as above | Same as above | Same as above |
| Geolocation — billing and shipping address | Same as above | Same as above | Same as above |
We may also disclose your Personal Data:
We reserve the right to use, transfer, sell, or share aggregated, anonymized data that does not identify any individual, for any lawful business purpose, including trend analysis and identifying compatible advertisers, sponsors, or customers.
We are committed to keeping your Personal Data safe. WHASOLS has implemented, and will maintain, technical, administrative, and physical safeguards reasonably designed to protect Personal Data against unauthorized access, exfiltration, theft, disclosure, alteration, or destruction.
Personal Data processed as part of the Service is retained indefinitely unless you request its deletion, subject to the limitations described in this Notice.
WhaShield and our other services are not directed at, or intended for use by, individuals under the age of 18. We have no actual knowledge that we sell the Personal Data of minors under the age of 16.
You have specific rights over the Personal Data we process about you. These rights apply only where WHASOLS acts as a "data controller" under the GDPR or a "business" under the CCPA — that is, where we (not our customers) decide why and how your Personal Data is processed. To exercise rights over data we process on behalf of one of our customers, please contact that customer directly and refer to their privacy policy.
You have the right to know how we collect and use your Personal Data, how long we retain it, and with whom we share it. This Notice is how we keep you informed, and we will continue to do so as our practices evolve.
You may ask us to confirm whether we process your Personal Data and, if so, request a copy of it along with related details. For Service data, you can view what we collect at any time via our demo feature (see "Exercising Your Rights" below). Upon a verified request regarding Website or customer data, we will disclose: the categories of data collected; the sources; our purposes for processing; the retention period (or the criteria used to determine it); the categories of third parties we share it with; meaningful information about any automated decision-making or profiling under Article 22 GDPR; the specific data points we hold (a "portability" request); and, if applicable, details of any sale or business-purpose disclosure of your data, and the legitimate interests we rely on.
Under GDPR, we may decline an access request where you already have the information, where compliance would involve disproportionate effort or impair the purpose of processing, or where the data is subject to a statutory duty of confidentiality. Under CCPA, we will never disclose Social Security numbers, government ID numbers, financial account numbers, health/medical ID numbers, or account passwords/security answers in response to an access request.
You may ask us to correct inaccurate Personal Data or complete incomplete data. If your account settings don't allow a direct edit, contact us using the process below.
You may ask us to delete your Personal Data. We will do so where we can — but the law permits us to decline in certain cases, including where the data is needed to: complete a transaction; fulfill a warranty or legally mandated product recall; provide a good or service you requested or perform a contract with you; detect security incidents or fraud and pursue those responsible; debug and repair functionality; exercise free-speech rights or another legal right; conduct public-interest research under proper consent and ethical safeguards; support internal uses consistent with your relationship with us; comply with a legal obligation; or make other lawful, compatible internal uses of the data.
You may ask us to limit how we use or store your Personal Data — for example, while we verify its accuracy or the lawfulness of processing it.
You may object to our processing of your Personal Data where we rely on a legitimate interest (ours or a third party's), and you always have the right to object to processing for direct-marketing purposes. We will stop processing unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise, or defend a legal claim.
You may request a copy of the Personal Data you provided to us, or that we generated through your use of the Service, in a structured, commonly used, machine-readable format, so you can move, copy, retain, or transfer it elsewhere.
We may use automated tools to analyze your Personal Data, including to understand how you use our Services. Where a decision that significantly affects you is made this way, you have the right not to be subject to it without explanation — we will always tell you when this occurs, why, and what effect it has.
We will not deny you goods or services, charge you different rates, or provide a different quality of service because you exercised a privacy right, except as permitted by law.
If the GDPR applies to your Personal Data, you may lodge a complaint with the supervisory authority in the EU member state of your residence, workplace, or where the alleged violation occurred.
You may ask us not to sell your Personal Data at any time. We do not sell the Personal Data we collect from our Website or from our customers. Once you opt out, we will wait at least twelve months before asking you to reauthorize any sale; you may opt back in at any time.
If you previously opted out, you may opt back in at any time. We do not knowingly sell the Personal Data of individuals under 18. Anyone who opts in may opt out again at any time.
You may exercise any of the rights described above, including the right to opt out of a sale, by emailing us at [email protected], or by writing to us at:
WHASOLS (SMC-PRIVATE) LimitedFor requests related to data processed within the Service, since we need to verify your email address, the fastest route is via our request form (see Section 19). We will confirm your identity using a verification code sent to that address.
You may appoint an authorized agent to submit a rights request on your behalf, via written authorization or a power of attorney valid under the applicable rules of your jurisdiction (e.g., California Probate Code §§4000–4465 for California residents). We will ask your agent for that written authorization and will still require you to independently verify your identity.
For requests concerning data processed in the Service, your authorized agent must also provide a certification or attestation of authority.
To act on a privacy-rights request, we need to confirm it genuinely comes from you. We may ask for specific information, potentially including Personal Data, solely to verify your identity or your agent's authority. You may submit a request to know or a portability request up to twice within any 12-month period.
For Service data specifically, we verify your identity by matching the email address you provide against the one on file in the Service. If they don't match, we will require additional verification, likely a certification or attestation, and may ask for your name or email solely to follow up on the request — this information is deleted once the request is resolved.
We will confirm receipt of your request within 10 days, including an explanation of our verification process (if needed) and an expected response date, unless we've already acted on the request.
We aim to respond within 30 days of receipt. If we need more time (up to 90 days total), we will notify you of the reason and extended timeline in writing. Responses are delivered to your account if you have one, or by mail or electronically, at your preference, if you don't. Disclosures cover only the 12-month period preceding the request.
Opt-out-of-sale requests are actioned within 15 days; we will notify any third parties to whom we previously sold your data and instruct them to stop, informing you of this within 90 days of your request.
If we can't fulfill a request, we will explain why. For portability requests, we provide data in a format that is readily usable and easily transferable. We do not charge a fee to process rights requests, except where a request is manifestly excessive or repetitive — in which case we'll explain our reasoning and provide a cost estimate first.
If we make a material change to this Notice, we will post the revised version on this page and update the "Effective" date above accordingly.
Questions about this Notice or how we process your Personal Data can be sent to [email protected], or by post to:
WHASOLS (SMC-PRIVATE) LimitedPlease allow up to 30 days for a response.
Questions? Contact us at [email protected].