Privacy Policy

1. Who Is Responsible for Your Data

Bhagi's Kitchen is the data fiduciary for personal data collected through this website and our direct order and support channels. Our contact for privacy questions and rights requests is bhagiskitchen.helpdesk@gmail.com.

2. Personal Data We Collect

• Identity and contact data: name, mobile number, email address, and account details where account features are used.
• Order and delivery data: products, quantities, customizations, delivery slot, postal address, landmark, pincode, pickup choice, and precise map coordinates for local delivery.
• Payment records: amount, payment status, Razorpay order and payment identifiers, refund information, and fraud or chargeback records. Razorpay collects payment credentials directly; we do not receive or store complete card, bank, CVV, OTP, or UPI PIN details.
• Fulfilment records: order information, courier waybill, tracking events, proof of delivery, rider handover details, and order-status history.
• Communications and complaints: WhatsApp or email messages, support requests, call details you provide, photographs, videos, and other evidence submitted for a claim.
• Reviews and stories: name, area or location, rating, review text, product reference, moderation status, and any content voluntarily submitted for publication.
• Technical and security data: IP address, browser or device information, request logs, session identifiers, timestamps, and signals used to secure the service and investigate abuse.

Please do not include unnecessary medical, financial, identity, or other sensitive information in special instructions, reviews, or support messages.

3. How We Collect Data

• Directly from forms, checkout, reviews, and communications.
• Automatically when the service stores a cart or slot in browser session storage and records essential security or request logs.
• From payment, courier, delivery, hosting, and communication providers involved in an order or support request.

4. Why We Process Personal Data

• To create, verify, prepare, deliver, and support orders.
• To process and reconcile payments, refunds, and order records.
• To calculate delivery, confirm serviceability, provide tracking, and coordinate pickup or rapid delivery.
• To answer questions, investigate complaints, moderate reviews, and publish approved reviews or testimonials.
• To prevent fraud, duplicate claims, payment abuse, unauthorized access, false reviews, and other misuse; and to establish, exercise, or defend legal claims.
• To comply with tax, accounting, food-safety, consumer-protection, payment, and other legal obligations.
• To send marketing only where you have requested or consented to it, with an option to stop future messages.

Processing is based on your consent, data voluntarily provided for a requested service, applicable law, or another use permitted under the Digital Personal Data Protection Act, 2023.

5. Who Receives Data

• Razorpay and banking networks for payment, verification, refunds, fraud checks, and dispute handling.
• Delhivery, Rapido, Uber, and other delivery providers for serviceability, shipment creation, tracking, and handover.
• Cloudflare and technical service providers for hosting, databases, media storage, security, and application operation.
• WhatsApp, email, and authorized internal messaging tools when you contact us or when order details are sent to authorized team members for fulfilment.
• Professional advisers, regulators, law-enforcement bodies, courts, or payment providers where reasonably necessary or legally required.

We do not sell personal data. Providers receive only the information reasonably required for their role and process it under their own terms and applicable law. Some providers may process data outside India where legally permitted.

6. Reviews and Public Content

Reviews are moderated before publication. If approved, the submitted name, general location, rating, and review text may be publicly visible and associated with the relevant store or product. Do not submit another person's personal data, private information, or content you do not have permission to publish. You may request removal, subject to legal record-retention needs.

7. Browser Storage and Cookies

We use essential browser storage for functions such as cart contents, selected store mode, delivery slots, and session continuity. Payment, hosting, map, or linked third-party services may set their own essential cookies or collect technical data under their policies. We do not sell data for cross-site advertising.

8. Retention and Deletion

We keep personal data only for the period reasonably necessary for fulfilment, support, food-safety traceability, accounting, tax, payment reconciliation, fraud prevention, dispute handling, and legal compliance. Retention periods differ by record type. Browser cart and slot data may expire when the session ends, while order, payment, complaint, and audit records may be retained longer where required.

Data will be erased or anonymized when its purpose and mandatory retention period end. A deletion request does not require us to erase records still needed to complete an order, comply with law, protect food safety, prevent fraud, or resolve a dispute.

9. Security and Breach Response

We use reasonable administrative, technical, and access-control safeguards. No system is completely secure, so customers must also protect their device, payment credentials, and communications. Where required by law, affected individuals and the competent authority will be notified of a personal-data breach.

10. Your Rights and Responsibilities

Subject to applicable law, you may request:

• A summary of your personal data and how it is processed.
• Correction, completion, or updating of inaccurate data.
• Erasure where retention is no longer necessary or required.
• Withdrawal of consent for consent-based future processing.
• Grievance redressal and nomination where legally applicable.

We may verify identity before acting on a request. Requests must use authentic information and must not impersonate another person, conceal material facts, or be false or frivolous. Withdrawing consent does not invalidate earlier lawful processing and may prevent us from providing a requested service, but it will not stop fulfilment or legally required processing for an existing paid order.

11. Children

Our ordering service is intended for adults. We do not knowingly process a child's personal data for ordering without verifiable consent from a parent or lawful guardian where required. Contact us if you believe a child has submitted personal data without authorization.

12. Third-Party Services

Links or integrations with maps, couriers, payment services, WhatsApp, and other third parties are governed by their privacy practices. We are responsible for our own processing and for selecting processors as required by law, but we do not control independent third-party services you choose to use outside our service.

13. Privacy Requests and Grievances

Email bhagiskitchen.helpdesk@gmail.com with the subject “Privacy Request” and include the phone number or email used for the relevant order. Do not send passwords, OTPs, or payment credentials. We will acknowledge and handle the request in accordance with applicable law. You may pursue remedies before the competent authority after using our grievance process where required.

14. Changes and Governing Law

We may update this policy to reflect legal, operational, or service changes. Material changes will be identified by a revised date and, where required, an additional notice or fresh consent. This policy is governed by Indian law, without limiting any mandatory right or forum available to a data principal or consumer.