Short Privacy Notice

1Your Privacy, in Short

Burger Farm India Private Limited (“Burger Farm”, “Company”, “we”, “us” or “our”) uses your mobile number to manage your account and orders, your location (only while the application is open, where applicable) to identify nearby outlets, and your order history to administer Farm Grains, loyalty tiers and rewards. Payments are processed through Razorpay, Cashfree or other authorized payment providers, as applicable. We do not sell your personal data or display third-party advertisements.

Please read our Privacy Policy and Terms of Use for complete details regarding our practices and your rights.

I confirm that I am 18 years of age or older.

I have read and agree to the Terms of Use and acknowledge that I have read the Privacy Policy.

2Scope and Purpose

These provisions apply to the use of the Burger Farm website and application, account registration, online ordering, dine-in, takeaway, mobile drive-thru, loyalty programmes, Farm Wallet and associated digital services, as applicable.

The Company processes personal data for lawful and specified purposes, including:

1. acreating, authenticating and maintaining user accounts;
2. baccepting, processing and fulfilling orders;
3. cfacilitating payments, refunds and transaction reconciliation;
4. didentifying nearby outlets and enabling location-based ordering features;
5. eadministering Farm Grains, loyalty tiers, rewards and promotional benefits;
6. fresponding to customer queries, complaints and support requests;
7. gpreventing fraud, misuse, unauthorized access and security incidents;
8. hcomplying with applicable legal, regulatory, tax and accounting requirements; and
9. imaintaining, securing and improving the website, application and related services.

Personal data shall be processed only to the extent necessary for the disclosed purposes or otherwise permitted under applicable law.

3Personal Data and Third-Party Service Providers

Depending on the services used, the Company may process mobile numbers, account details, optional profile information, location information, order history, loyalty programme records, transaction references, customer support communications and technical information necessary for the operation and security of the services.

Payments may be facilitated through Razorpay, Cashfree or other authorized payment providers. Payment information shall be handled in accordance with the actual payment integration and applicable provider terms. The Company shall not claim that it never receives or accesses card details unless this is factually accurate for its payment systems.

The Company may share relevant personal data with authorized technology providers, hosting providers, payment processors, customer support providers and other service providers where necessary for the disclosed purposes and permitted by law. Such sharing shall be subject to appropriate contractual, organizational or other safeguards, as applicable.

The Company does not sell personal data or display third-party advertisements through its website or application. This statement does not prevent lawful sharing with authorized service providers or disclosures required by law.

4Consent and Acceptance

By selecting the relevant checkboxes and proceeding, the user:

1. aconfirms that they meet the applicable age and eligibility requirements;
2. bagrees to be bound by the Terms of Use; and
3. cacknowledges having been provided access to and having read the Privacy Policy.

Where applicable law requires consent for the processing of personal data, the Company shall obtain such consent through an appropriate affirmative action. Acceptance of the Terms of Use or acknowledgement of the Privacy Policy shall not, by itself, constitute blanket consent to unrelated or optional processing activities.

The Company shall maintain an appropriate record of the user's account identifier, date and time of acceptance, and the versions of the documents presented, subject to applicable law and its record-retention practices.

5Accuracy, Correction and Erasure

Users may request correction, completion, updating or erasure of their personal data and exercise other rights available under applicable law through the contact details or mechanism specified in the Privacy Policy.

The Company shall review and respond to such requests in accordance with applicable law. Requests for erasure shall remain subject to lawful retention obligations, including requirements relating to tax, accounting, transactions, legal proceedings and dispute resolution.

6Withdrawal of Consent

Where personal data is processed on the basis of consent, users may withdraw such consent through the mechanism specified in the Privacy Policy or by contacting the Company's designated grievance contact.

Withdrawal of consent shall not affect the lawfulness of processing undertaken before withdrawal. Upon withdrawal, the Company shall cease the relevant processing and take appropriate steps concerning its data processors, unless continued processing is required or permitted by applicable law.

Withdrawal may affect the availability of features or services that depend on the relevant personal data. The Company shall not impose unnecessary barriers to withdrawal or require users to follow a process more difficult than the process used to provide consent, where applicable law requires equivalent ease.

7Data Retention and Account Deletion

The Company shall retain personal data only for as long as necessary to fulfil the disclosed purposes or for any longer period required or permitted by applicable law.

When the relevant purpose has been fulfilled and retention is no longer necessary or lawful, personal data shall be erased or otherwise handled in accordance with applicable legal requirements.

Account deletion may result in the loss of access to order history, Farm Grains, loyalty benefits, Farm Wallet features and other account-linked services, subject to the applicable programme terms and mandatory legal obligations. Deletion of an account shall not automatically extinguish any lawful financial, contractual or statutory obligation.

8Data Security and Personal Data Breaches

The Company shall implement reasonable security safeguards appropriate to the nature of the personal data processed and the risks involved, with the objective of protecting personal data against unauthorized access, disclosure, alteration, loss or misuse.

Where a personal data breach occurs, the Company shall take appropriate steps to investigate, contain and mitigate the incident and provide notifications to affected individuals and relevant authorities as required by applicable law.

Although reasonable safeguards shall be maintained, no electronic transmission or storage system can be guaranteed to be completely secure.

9Marketing Communications

Marketing communications, promotional notifications and optional marketing preferences shall be governed by a separate, voluntary opt-in mechanism wherever required by applicable law.

Users may manage or withdraw their marketing preferences through the available settings or unsubscribe mechanism. Refusal or withdrawal of marketing consent shall not ordinarily affect essential transactional communications relating to orders, payments, account security or customer support.

Marketing consent shall not be a condition for accepting the Terms of Use or using ordinary ordering services, unless a specific feature lawfully requires a separate and clearly disclosed arrangement.

10Age and Eligibility

The website and application are intended for individuals aged 18 years or older, subject to the applicable eligibility requirements. Users must provide truthful information and must not misrepresent their age.

The Company shall handle personal data relating to children or other protected individuals in accordance with applicable law. If the Company becomes aware that personal data has been collected in circumstances requiring additional safeguards, it shall take appropriate corrective action as required by law.

11Third-Party Websites and Services

The website or application may provide links to third-party websites, payment interfaces or other external services. Such services may process personal data under their own privacy policies and terms.

Users are encouraged to review the applicable third-party terms before using those services. Nothing in this clause shall exclude any responsibility that the Company may have under applicable law for processing carried out by it or on its behalf.

12Changes to the Privacy Policy

The Company may revise its Privacy Policy and related terms from time to time to reflect changes in its services, data-processing practices or legal requirements.

The revised document shall display its updated effective date or last-updated date. Where a material change is made, the Company shall provide an appropriate notice and, where required by applicable law, obtain fresh consent before undertaking processing that requires such consent.

For material Privacy Policy changes, the website or application may display an updated notice once upon the user's next sign-in. The notice shall clearly indicate that the Privacy Policy has been updated and provide access to the revised document.

Continued use of the website or application shall not, by itself, be treated as a substitute for affirmative consent where such consent is legally required.

13Grievance Redressal

Users may submit privacy-related questions, complaints, requests or grievances using the contact details published in the Privacy Policy.

Designated Grievance Contact: Ashish Yadav, Grievance OfficerEmail: ashish.yadav@burgerfarm.inPostal Address: Burger Farm India Private Limited, Plot No. 01, Queens House, Queens Road, Moti Nagar, Vaishali Nagar, Jaipur, Rajasthan – 302021.

The Company shall acknowledge and address grievances within the timelines prescribed by applicable law. The Company shall keep the designated contact details current and reasonably accessible.

14Governing Law and Jurisdiction

These provisions shall be governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the rules and notifications applicable to the relevant processing, the Information Technology Act, 2000, and other applicable laws, as amended or brought into force from time to time.

This Policy shall be governed by the laws of India. Subject to applicable law and the jurisdiction of any competent statutory or regulatory authority, the courts at Jaipur, Rajasthan, shall have jurisdiction over disputes arising out of or in connection with this Policy.

15Relationship with Other Policies

These provisions shall be read together with the Company's Privacy Policy, Terms of Use, Ordering and Refund Policy, Farm Wallet Terms and Loyalty Programme Terms, as applicable.

In the event of an inconsistency concerning personal data processing, the Privacy Policy and applicable data protection law shall govern the privacy-related issue. Mandatory statutory rights and obligations shall prevail over any inconsistent contractual provision.

16Legal Compliance

The Company shall process personal data in accordance with applicable Indian data protection and information technology laws, including applicable requirements relating to lawful processing, notice, consent, security safeguards, retention, data principal rights and grievance redressal.

Nothing in these provisions shall be interpreted as limiting any right or obligation imposed by applicable law. Where a provision becomes inconsistent with a mandatory legal requirement, the mandatory legal requirement shall prevail to the extent of such inconsistency.