Privacy Policy & Statutory Notice
Published under Section 5 of the Digital Personal Data Protection Act, 2023 · Effective October 2026
1. Introduction & Scope
Welcome to Raku's Kitchen ("we", "our", or "us"). This Privacy Policy and Statutory Notice is published in accordance with the provisions of The Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") of India.
Raku's Kitchen acts as a Data Fiduciary in respect of the digital personal data collected from our customers ("Data Principals") when you visit our website, sign in, order food, or interact with our customer support.
2. Itemized Notice of Personal Data Collected (Section 5)
In compliance with Section 5 of the DPDP Act, we provide itemized notice of the specific personal data we collect:
- Identity & Contact Details: Your name and 10-digit mobile number, verified via secure One-Time Password (OTP).
- Delivery Location & Spatial Data: Delivery address, apartment/door number, landmark, pincode, and geographic coordinates (latitude and longitude) obtained via Ola Maps to route food delivery riders.
- Transaction & Order Details: Meal slots (Lunch/Dinner), meal dates, items ordered, special cooking notes, billing amounts, packaging fees, and fulfillment type (courier delivery or self-pickup).
- Payment Metadata: Transaction reference IDs, Razorpay Order IDs, and payment status.* Note: We do NOT store or process your credit/debit card numbers, CVVs, net-banking credentials, or UPI PINs. All monetary transactions are processed securely through RBI-authorized payment aggregator Razorpay.
- Technical Logs: Order creation timestamps and temporary rate-limiting hashes utilized strictly for abuse prevention and fraud defense.
3. Specified Purposes for Processing (Section 4 & 6)
We process your personal data strictly for specified, lawful purposes:
🍲 Order Preparation
To prepare your selected authentic Nati-style dishes for the requested meal slot.
🛵 Delivery & Logistics
To route third-party delivery riders (Borzo, Porter) or prepare your bag for self-pickup.
🔔 Status Notifications
To send live order confirmations, preparation alerts, and tracking links via WhatsApp or SMS.
📑 Legal & Accounting
To generate GST-compliant invoices and preserve audit records mandated under Indian fiscal regulations.
4. Third-Party Data Processors (Section 8(2))
To deliver our services, we engage reputable third-party service providers ("Data Processors") under strict confidentiality and security requirements:
Razorpay Software Private Limited
Payment processing, transaction settlements, and refund management (RBI Regulated).
Google Cloud & Firebase
Cloud hosting, encrypted Firestore database, and Phone OTP authentication.
Ola Maps (ANI Technologies)
Address autocomplete, places lookup, and delivery coordinate geocoding.
Logistics Carriers (Borzo, Porter)
Courier dispatch, driver assignment, and live delivery transit.
WhatsApp (Meta Platforms)
Customer order status updates initiated through direct conversational links.
5. Your Rights as a Data Principal (Sections 11–14)
Under Chapter III of the DPDP Act, 2023, you have the following enforceable statutory rights:
1. Right to Access Information (Section 11)
You have the right to request a summary of the personal data we hold about you and the identities of all Data Processors with whom it has been shared. You can view your complete order history at any time on the Track Orders page.
2. Right to Correction and Erasure (Section 12)
You have the right to request correction of inaccurate or misleading data, and erasure of personal data that is no longer necessary for the specified purpose, unless retention is legally mandatory under Indian tax or commercial laws.
3. Right of Grievance Redressal (Section 13)
You have the right to have your data protection grievances addressed expeditiously by our designated Grievance Officer within statutory timelines (15 days).
4. Right to Nominate (Section 14)
You have the right to nominate another individual who shall exercise your privacy rights in the event of death or incapacity.
5. Right to Withdraw Consent (Section 6(4))
Where processing is based on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing completed prior to withdrawal.
6. Processing of Children's Data (Section 9)
Raku's Kitchen does not target or knowingly collect personal data from individuals under 18 years of age. Our food ordering platform is intended exclusively for adults. If you are under 18, you may use our platform only under the supervision and with the verifiable consent of a parent or legal guardian. We do not engage in behavioral monitoring, tracking, or targeted advertising directed at children.
7. Reasonable Security Safeguards & Data Retention (Section 8(5) & 8(7))
We implement comprehensive organizational and technical security measures to protect your digital personal data:
- Zero Client Writes: All order materialization is performed exclusively server-side after cryptographic payment signature verification.
- Encrypted in Transit & Rest: Industry-standard TLS 1.3 encryption across all network transfers.
- Automated Log Expiration: Platform audit and operational logs automatically expire and are purged after 30 days via Firestore TTL policies.
- Statutory Retention: Financial transaction and invoice records are preserved for the statutory period required by the Goods and Services Tax (GST) Act and Income Tax regulations, after which they are permanently deleted or anonymized.
8. Grievance Officer & Statutory Complaint Mechanism
If you have any questions, wish to exercise your rights under Sections 11–14 of the DPDP Act, or have a grievance concerning how your personal data is handled, please contact our designated Grievance Officer:
Rakesh K.
Data Protection & Grievance Officer · Raku's Kitchen
Email: grievance@rakuskitchen.in (cc: rakuskitchenblr@gmail.com)
Phone: +91 96068 88096
Address: Jambusavari Dinne, JP Nagar 8th Phase, Bengaluru, Karnataka 560078
Response SLA: Within 15 business days
Escalation to the Data Protection Board of India (DPBI):
In accordance with Section 13(3) of the DPDP Act, 2023, if your grievance is not resolved to your satisfaction by our Grievance Officer within the statutory period, you have the statutory right to file a complaint directly with the Data Protection Board of India (DPBI).