Privacy Policy

1Introduction and Scope

1.1This Privacy Policy (“Policy”) is issued by Burger Farm India Private Limited (hereinafter referred to as “Burger Farm”, the “Company”, “we”, “us” or “our”) and governs the collection, use, processing, storage, disclosure, retention and protection of personal data relating to individuals who access or use our website, mobile application, online ordering platform and associated services.

1.2This Policy applies to customers, website visitors, registered users and other individuals whose personal data is processed by the Company in connection with its business operations, including dine-in, takeaway, delivery, drive-thru, customer accounts, loyalty programmes, promotional activities and customer support (collectively, the “Services”).

1.3This Policy is intended to be read in conjunction with the applicable terms and conditions, loyalty program terms and other relevant policies governing the Services.

1.4The Company shall process personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the rules and notifications applicable and in force thereunder, the Information Technology Act, 2000, and other applicable laws of India, to the extent applicable to the relevant processing activity.

1.5For the purposes of this Policy, “personal data” means any data about an individual who is identifiable by or in relation to such data, as defined under applicable law.

2Categories of Personal Data Collected

Depending upon the nature and extent of your use of the Services, the Company may collect and process the following categories of personal data:

2.1Account and Contact Information: Your name, mobile number, email address and date of birth, where provided. Your mobile number may be used for account registration, identity verification through a one-time password (“OTP”), account access and communications relating to your orders and the Services.

2.2Location Information: Your device location, where you grant the requisite permission, for identifying nearby outlets, determining service availability, facilitating order placement and applying location-specific restrictions.

2.3Order and Transaction Information: Details of food items ordered, product preferences, customisations, selected outlet, order history, invoices, applicable taxes, discounts, transaction references, payment status and refund-related information.

2.4Loyalty Programme Information: Information relating to Farm Wallet, Farm Grains, Harvest levels, customer tiers, rewards, store credits, promotional benefits and other loyalty programme transactions or activities.

2.5Drive-Thru Information: Vehicle registration number, vehicle type and other relevant information, where required for vehicle identification, order coordination and handover.

2.6Device and Technical Information: Device identifiers, Internet Protocol (IP) address, application version, operating system, notification tokens, crash reports, diagnostic information and security logs, to the extent reasonably necessary for the operation, maintenance, troubleshooting and security of the Services.

2.7Customer Support Information: Information voluntarily provided through feedback forms, complaints, enquiries, refund requests, customer support interactions and other communications with the Company.

2.8Migrated Customer Information: Account details, order history and loyalty programme information transferred from any previous Burger Farm application, customer database or digital platform, where applicable and lawfully undertaken.

2.9The Company shall endeavour to limit the collection and processing of personal data to information reasonably necessary for the specified purposes of the Services, subject to applicable legal requirements.

3Purposes and Legal Basis of Processing

3.1The Company may process personal data for the following specified purposes:

1. acreating, registering, maintaining and authenticating customer accounts;
2. breceiving, confirming, preparing, processing and fulfilling food orders;
3. cfacilitating dine-in, takeaway, delivery and drive-thru services;
4. dprocessing payments, refunds, invoices and related accounting transactions;
5. eadministering loyalty programmes, rewards, customer tiers and promotional benefits;
6. fidentifying nearby outlets and determining the availability of products and services;
7. gproviding relevant product recommendations and improving customer experience;
8. hresponding to customer enquiries, complaints, feedback and refund requests;
9. idetecting, preventing and investigating fraud, unauthorised access, misuse of accounts and abuse of promotional offers;
10. jmaintaining information technology systems, conducting diagnostics, improving application performance and safeguarding the integrity and security of the Services;
11. kmaintaining business, operational, accounting and transaction records; and
12. lcomplying with applicable laws, regulatory requirements, lawful orders and directions issued by competent authorities.

3.2Personal data shall be processed on the basis of consent, where consent is required, or on such other lawful basis as may be available under applicable law, including any applicable statutory grounds for processing.

3.3Where processing is based on consent, the Company shall provide the information and obtain consent in the manner required under applicable law. Subject to applicable legal requirements, you may withdraw such consent by using the available mechanisms or by contacting the Company.

3.4Withdrawal of consent shall not affect the lawfulness of processing undertaken before such withdrawal. The withdrawal of consent may affect the Company's ability to provide particular Services where the relevant personal data is necessary for providing those Services and no other lawful basis for processing is available.

4Disclosure and Sharing of Personal Data

4.1The Company does not sell personal data to third parties. However, the Company may disclose or make available relevant personal data to the following categories of recipients, strictly to the extent reasonably necessary for the applicable purposes and subject to applicable law:

1. aTechnology, Hosting and Infrastructure Providers: Google Cloud, Firebase and other service providers engaged in hosting, authentication, application infrastructure, notifications, data storage and technical operations.
2. bOTP and Communication Service Providers: MSG91 and other service providers engaged in mobile verification, OTP delivery and customer communications.
3. cPayment Service Providers: Razorpay, Cashfree and other payment service providers facilitating payment processing, transaction verification, settlement and refunds.
4. dRestaurant Outlets and Operational Systems: Relevant outlet personnel, kitchen systems, point-of-sale (“POS”) systems and authorised operational personnel for order preparation, customer coordination, billing and order handover.
5. eDelivery and Logistics Partners: Delivery partners and logistics service providers, where applicable, for fulfilling delivery orders and coordinating customer handover.
6. fMarketing and Communication Service Providers: Service providers engaged in promotional communications, customer engagement, campaign administration and related activities, where such processing is permitted by applicable law and any required consent has been obtained.
7. gProfessional Advisers and Auditors: Legal advisers, accountants, auditors and other professional service providers, where disclosure is reasonably necessary for legitimate business, advisory, audit or compliance purposes.
8. hGovernment and Regulatory Authorities: Courts, law enforcement agencies, governmental bodies, regulatory authorities and other competent authorities, where disclosure is required or authorised under applicable law or pursuant to a lawful order or direction.

4.2The Company shall endeavour to ensure that third-party service providers receiving personal data are subject to appropriate contractual, confidentiality, security and data-protection obligations, as applicable.

4.3Where a third party independently determines the purposes and means of processing personal data, such processing may also be governed by that third party's applicable privacy policy and legal obligations. The Company shall not represent that it controls processing activities independently undertaken by such third parties.

4.4The Company shall not disclose personal data for purposes incompatible with the purposes specified in this Policy unless such disclosure is otherwise permitted or required under applicable law.

5Service Communications and Promotional Messages

5.1The Company may send service-related communications necessary for the operation of the Services, including OTPs, account verification messages, order confirmations, order preparation updates, payment confirmations, collection and delivery notifications, refund updates, customer support communications and security alerts.

5.2Promotional communications, marketing messages, offers, discounts and loyalty programme notifications shall be sent in accordance with applicable law and any consent or other legal requirements applicable to such communications.

5.3You may opt out of promotional communications through the available account settings, unsubscribe facilities or other opt-out mechanisms provided by the Company or the relevant communication service provider.

5.4Opting out of promotional communications shall not prevent the Company from sending essential service-related communications where reasonably necessary for account security, order fulfilment, transaction processing, legal compliance or the provision of the Services.

6Cookies and Similar Technologies

6.1The Company's website may use cookies, pixels, software development kits and similar technologies to facilitate website functionality, remember user preferences, analyse website performance, diagnose technical issues and improve the user experience.

6.2Such technologies may collect technical information relating to browsing activity, device characteristics, session information and interactions with the website, subject to applicable law.

6.3Where required by applicable law, the Company shall provide appropriate disclosures and mechanisms for obtaining consent, managing preferences or disabling non-essential cookies and similar technologies.

6.4Disabling certain cookies or similar technologies may affect the availability or functionality of particular features of the website.

6.5Any advertising, analytics or tracking technologies used by the Company or its service providers shall be subject to applicable legal requirements and relevant disclosures.

7Retention of Personal Data

7.1The Company shall retain personal data only for the period reasonably necessary to fulfil the purposes for which it was collected or processed, provide the Services, comply with applicable legal obligations, maintain business records, resolve disputes, enforce contractual rights and prevent fraud or misuse.

7.2Order records, invoices, payment information, tax records and other business documents may be retained for the periods prescribed under applicable tax, accounting, corporate and other laws.

7.3Technical logs, OTP-related information, diagnostic records and other operational information may be retained for shorter periods, having regard to their purpose, security requirements and applicable retention obligations.

7.4Upon expiry of the applicable retention period, the Company shall take reasonable steps to erase or anonymise personal data, unless its retention is required or otherwise permitted under applicable law.

7.5Where applicable law prescribes specific erasure, retention or data-fiduciary obligations, the Company shall comply with such requirements to the extent applicable to the relevant processing activity.

8Account Deletion and Erasure Requests

8.1Users may request deletion of their accounts through the account deletion facility available in the mobile application, where provided, or by submitting a request to the Grievance Officer using the contact details specified in this Policy.

8.2Upon receipt of a valid request, the Company shall process the request in accordance with applicable law and shall erase personal data where required, subject to applicable retention obligations and lawful exceptions.

8.3The Company may retain limited personal data where necessary to comply with legal or regulatory requirements, maintain tax and accounting records, establish or defend legal claims, resolve pending disputes, prevent fraud or comply with other lawful retention obligations.

8.4Where personal data is retained following an account deletion request, such retention shall be limited to the extent and duration permitted or required by applicable law.

8.5Deletion of an account may result in the loss of access to account history, rewards, Farm Wallet balances, Farm Grains, store credits or other account-linked benefits, subject to the applicable programme terms and applicable law. The consequences of deletion shall not override any non-waivable statutory rights of the user.

9Rights and Obligations of Users

9.1Subject to the DPDP Act, the rules and notifications applicable and in force thereunder, and other applicable laws, users may be entitled to exercise the following rights, as applicable:

1. athe right to obtain information regarding personal data processing;
2. bthe right to request correction, completion or updating of personal data;
3. cthe right to request erasure of personal data, subject to lawful retention requirements;
4. dthe right to withdraw consent where processing is based on consent;
5. ethe right to seek grievance redressal in relation to the processing of personal data; and
6. fthe right to nominate another individual to exercise applicable rights in the event of death or incapacity, in accordance with applicable law.

9.2Users may exercise their applicable rights by contacting the Grievance Officer specified in Clause 14 of this Policy.

9.3The Company may request reasonable information or verification to establish the identity and authority of the person making a request, protect personal data against unauthorised disclosure and prevent fraudulent or unauthorised requests.

9.4The Company shall address valid requests and grievances within the time limits prescribed under applicable law.

9.5Users shall provide accurate and updated information where required for the provision of the Services and shall promptly notify the Company of any material inaccuracies in their account information.

10Children's Personal Data

10.1The Services are intended for general customers and shall be accessed and used subject to applicable age restrictions and laws.

10.2The Company shall process children's personal data in accordance with the DPDP Act and the rules applicable and in force thereunder, including any applicable requirements concerning verifiable parental or lawful guardian consent.

10.3The Company shall comply with applicable statutory restrictions concerning the tracking, behavioural monitoring or targeted advertising directed at children, to the extent such restrictions apply.

10.4Where the Company becomes aware that children's personal data has