Flipkart Privacy Policy 2026: What the Merger Clause Says About Selling Data

Flipkart's privacy policy runs to roughly forty paragraphs and almost all of it is the ordinary machinery of an e-commerce platform — orders, payments, cookies, fraud checks. One sentence is not ordinary, and it is the one worth reading twice:

"We and our affiliates will share / sell some or all of your personal data with another business entity should we (or our assets) plan to merge with, or be acquired by that business entity, or reorganization, amalgamation, restructuring of business." The slash and the grammar are the page's own.

Two things stand out. The verb is "will", not "may" — most comparable Indian retail privacy policies phrase the corporate-transaction clause permissively. And the word "sell" is used explicitly, where the common drafting is "transfer" or "disclose". The clause is limited to a merger, acquisition, reorganisation, amalgamation or restructuring; it is not a general licence to sell customer data, and nothing on the page says data is sold in the ordinary course of business.

The policy attaches a protection in the next sentence: "Should such a transaction occur that another business entity (or the new combined entity) will be required to follow this Privacy Policy with respect to your personal data." That is the mitigation, and it is worth crediting — the obligation is stated to travel with the data. Transferring customer data as part of a corporate transaction is ordinary, lawful and near-universal, and no wrongdoing is alleged; what is unusual here is only the choice of words.

The policy carries a section that exists on very few retail privacy pages, under its own heading: "Sharing of Personal Data for Plus Membership Benefits and Partner Services".

It reads: "To provide our Plus members with bundled third-party benefits (such as streaming subscriptions, including Netflix), we may share your personal information (including name, email address, and mobile number) with our service partners. This data is shared to (a) facilitate seamless account activation on the partner platform, and (b) enable customer outreach and support via SMS, Email, and WhatsApp to help you activate and manage your benefits".

This is the clause most Plus members will not have read, and it has a practical consequence. Accepting a bundled streaming benefit is also a consent to your mobile number reaching a third-party service partner, and to that partner contacting you on SMS, email and WhatsApp. Naming the partner — Netflix — and naming the three channels is more disclosure than most bundling arrangements get, and that transparency is to the policy's credit. The point is simply that the benefit and the data transfer are the same decision.

Elsewhere the policy covers the loyalty layer separately: enrolling in "such SuperCoin, VIP or similar programs" means Flipkart collects name, contact number, email, communication address, date of birth, gender, zip code, "lifestyle information, demographic and work details", plus your transactions both on Flipkart and on third-party partner platforms where points are earned or redeemed. If you want the mechanics of those tiers rather than the data behind them, we have broken down SuperCoins, Plus and Black earn rates separately.

The longest single paragraph in the policy is about analysis rather than collection, and it is drafted more widely than the clauses around it. Flipkart collects and analyses personal data "relating to your buying behavior, browsing patterns, preferences", including "the URL that you just came from (whether this URL is on our Platform or not), which URL you next go to (whether this URL is on our Platform or not), your computer browser information, and your IP address."

Then the sharing sentence: "The insights derived from this analysis may be shared with our group companies, affiliates, related companies, business partners, and third-parties who offer services to us or to whom we provide our products or services. These group companies, affiliates, related companies, business partners and third-parties may use such insights for promotions, advertisements and marketing, product development, and other commercial purposes."

"Other commercial purposes" is open-ended, and the recipients are described by category rather than named. The policy adds that those recipients may use the insights to "personalise your browsing experience and customise various aspects of the user journey such as the checkout flow, payment options, delivery recommendations either on our Platform or their own platforms" — so the effect can show up on a site that is not Flipkart. It also says plainly that "any processing of your personal data by third-parties will be governed by their own privacy policies" and that Flipkart "does not control, endorse, or assume responsibility for the privacy practices of third parties".

Deriving insights from shopping behaviour and sharing them commercially is what every large marketplace does, it is disclosed here rather than hidden, and no wrongdoing is alleged. The observation is about drafting width: the insights clause has fewer limits attached to it than the clause governing the underlying personal data.

One paragraph lists what Flipkart may ask for beyond the usual name and address, and it is longer than most readers would expect. "With your consent, we may have access to your SMS, instant messages, contacts in your directory, location, camera, photo gallery and device information and we may also request you to provide your PAN, credit information report (from credit agencies), GST Number, Government issued ID cards/number and Know-Your-Customer (KYC) details".

The stated purposes are specific and they are the ones you would expect: checking "eligibility for certain products and services like insurance, credit and payment products", issuing a GST invoice for business purchases, and providing access to products offered by Flipkart, sellers, affiliates and lending partners. Each item is gated on consent, which is the material point — this is a list of what can be asked for, not a list of what is taken automatically.

The trade-off is stated rather than hidden: "You understand that your access to these products/services may be affected in the event consent is not provided to us." In plain terms, declining a permission can mean declining a product. The credit layer is named too — data may be shared with group companies "including Credit Bureaus" and with lending partners for "credit underwriting", covering Flipkart PayLater and personal loans, and those parties "may market to you as a result of such sharing". The payment side of that, including the cash limit on cash-on-delivery, sits in our breakdown of Flipkart's COD and EMI rules.

A separate clause covers medicines and is easy to miss. Where a prescription uploaded for a prescription-only product is "invalid, illegible, or expired" or missing, Flipkart may "through third-party vendors connect You with medical practitioners, teleconsultants or third-party professionals" to rectify or issue one, in "limited cases". Requiring a valid prescription is a legal obligation and routing a user to a qualified professional is the compliant way to handle a bad one; the privacy point is only that a health interaction, and the data in it, can follow from a shopping order.

A page that only lists the uncomfortable clauses would be an inaccurate description of this document, because several parts of it are better than the category average.

The Grievance Officer is named with a street address — 8th floor, Block 'B', Devarabeesanahalli Village, Outer Ring Road — and a dedicated address, privacy.grievance@flipkart.com, is published for privacy complaints specifically rather than routing them through general support. That is the Information Technology Act requirement met with a real contact rather than a form.

The marketing opt-out is a working link, not an instruction to write in. The policy publishes the notification-preference URL directly. Consent withdrawal has its own route with a named subject line, "for withdrawal of consent", and the policy is honest about the consequence: withdrawal "will not be retroactive" and "may hamper your access to the Platform". The Google Analytics opt-out link is printed on the page itself, which is unusual — most policies mention Analytics without telling you how to leave.

On cookies the statement is unambiguous: "Cookies do not contain any of your personal data" and most are session cookies deleted at the end of a session, with the caveat that declining them may break features. Retention is tied to purpose and to law, with anonymised data kept for research. Access, correction and deletion of non-mandatory fields are offered through the Profile and Settings sections. For contrast on the same questions at a different retailer, see our reading of Amazon's cookie rules and of Croma's privacy policy and the wider Tata group.

Five practical points, none of them legal advice. One: treat a bundled Plus benefit as a data decision as well as a freebie — activating it shares your name, email and mobile number with the partner and opens SMS, email and WhatsApp contact. Two: the marketing opt-out link is in the policy and it works — use the notification-preference page rather than unsubscribing message by message. Three: decline device permissions you do not need; contacts, photo gallery, camera and SMS access are consent-gated, and the only stated consequence is losing access to the specific products that rely on them. Four: if you have a privacy complaint, write to privacy.grievance@flipkart.com rather than general support, and to the named Grievance Officer if that fails. Five: if you withdraw consent, do it knowing it is not retroactive — the policy says so in terms. Everything above is Flipkart's published text as it stood on 9 October 2026, and the policy states it may be updated at any time. This page describes a published privacy policy and expresses no view on whether any clause in it is valid or enforceable; nothing here is legal advice.