DPDP Act & Data Protection

1. Overview of the DPDP Act

The Digital Personal Data Protection Act, 2023 is India's dedicated law governing the processing of digital personal data. It was enacted in August 2023, and the Digital Personal Data Protection Rules, 2025, which set out its detailed operational requirements, were notified by the Ministry of Electronics and Information Technology in November 2025.

The Act and Rules are coming into force in phases rather than all at once: administrative provisions (including the establishment of the Data Protection Board of India) took effect first, registration of Consent Managers follows roughly a year later, and the remaining substantive provisions — covering notice, consent, and most Data Principal rights mechanisms — are scheduled to take full effect within eighteen months of notification. Yumzip is aligning its practices with the Act and Rules as these provisions come into force, and this page will be updated as our processes evolve alongside the statutory timeline.

2. Scope of This Page

The DPDP Act applies to the processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to individuals in India. This page addresses how that framework applies to the Yumzip platform: our restaurant/merchant partners who operate storefronts on Yumzip, and the end customers who place orders through those storefronts.

3. Key Terms Used Under the DPDP Act

• Data Principal: the individual to whom the personal data relates — for example, a customer placing an order, or an individual working at a restaurant partner.
• Data Fiduciary: the person or entity that determines the purpose and means of processing personal data.
• Data Processor: an entity that processes personal data on behalf of a Data Fiduciary.
• Personal Data: any data about an individual who is identifiable by or in relation to that data.

4. Yumzip's Role in Different Processing Situations

Our Privacy Policy already describes the underlying arrangement: the independent restaurant owns its customer relationship, and Yumzip provides the technology that runs it. In DPDP terms:

• For a restaurant partner's end-customer data (order details, delivery information, contact details collected through that restaurant's storefront), the restaurant partner acts as the Data Fiduciary — it determines why and how that data is collected and used to fulfil its own customers' orders — and Yumzip acts as a Data Processor, processing that data on the restaurant's instructions to operate the platform (order routing, storage, notifications, and similar technical functions).
• For the account and business data restaurant partners provide to us directly to operate their own Yumzip account (login credentials, business profile, billing and payout details), Yumzip acts as the Data Fiduciary, since we determine the purpose and means of processing that account-level data.

This mirrors, rather than changes, the Data Controller / Data Processor description already set out in our Privacy Policy, using the terminology of the DPDP Act.

5. Personal Data We Process

The categories of personal data we process are described in full in our Privacy Policy. In summary, this includes profile and login information for restaurant owners/operators, restaurant business details, order and delivery information for end customers, and limited technical data such as device and log information collected automatically. We do not collect more personal data than is reasonably required to operate the platform and fulfil orders.

6. Purposes of Processing

Personal data is processed for the specific, stated purposes described in our Privacy Policy: creating and running merchant accounts, processing and delivering customer orders, generating billing and payout records, providing customer support, and maintaining platform security. We do not use personal data for purposes unrelated to operating the platform without an appropriate legal basis.

7. Notice and Consent

Where the DPDP Act requires it, Data Principals are given notice describing what personal data is collected and for what purpose, in clear language, at or before the time of collection — for example, when a restaurant owner registers for a Yumzip account, or when a customer places an order through a restaurant's storefront. Processing is carried out on the basis of consent or another legally recognized ground under the Act, such as processing that is necessary to fulfil a request the Data Principal has made (like completing an order they placed).

8. Withdrawing Consent

Where processing is based on consent, a Data Principal may withdraw that consent going forward. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and may mean that some services — for example, order fulfilment — can no longer be provided if the underlying data is no longer available. Requests to withdraw consent or exercise the rights below can be sent to the contact address in Section 15.

9. Data Principal Rights

Subject to the Act, its Rules, and their phased commencement, Data Principals may have rights to obtain a summary of their personal data being processed, request correction or completion of inaccurate or incomplete data, request erasure of personal data that is no longer necessary for the purpose it was collected, and nominate another individual to exercise their rights in the event of death or incapacity. Where a restaurant partner is the Data Fiduciary for a customer's order data, a request may need to be directed to that restaurant in the first instance, and we will support restaurant partners in responding to such requests where we act as their Processor.

10. Grievance Redressal

If you have a grievance about how your personal data has been processed on Yumzip, you can raise it with us using the contact details in Section 15. We aim to acknowledge and address grievances within a reasonable time. If you remain unsatisfied, the DPDP Act provides for escalation to the Data Protection Board of India as the statutory grievance-redressal authority.

11. Data Security

Consistent with our Privacy Policy and Security Policy, we apply administrative, technical, and organizational safeguards — including encryption in transit, access controls limiting who can view personal data, and regular backups — to protect personal data against unauthorized access, alteration, disclosure, or loss. For platform-level security architecture, see our Security Policy.

12. Data Retention

We retain personal data only for as long as necessary for the purposes described in this page and our Privacy Policy, or as required by applicable law (for example, tax or accounting records). As stated in our Privacy Policy, when a restaurant account is closed we initiate removal of personal operational records within 30 business days, retaining only anonymized data or records legally required to be kept for longer.

13. Sharing of Personal Data

We share personal data only with the categories of recipients described in our Privacy Policy, and only as necessary to operate the platform:

We do not sell personal data. Any disclosure to a government authority or law-enforcement agency is made only where required or permitted by applicable law.

14. Children's Data

Yumzip's platform is intended for adult restaurant business owners/operators and individuals capable of authorizing payments. We do not knowingly collect or process the personal data of children in a manner that would require verifiable parental consent under the DPDP Act. If we learn that we have inadvertently collected a child's personal data, we will take steps to delete it.

15. Personal Data Breach Handling

In the event of a personal data breach, we take prompt steps to investigate, contain, and remediate the incident, and we will notify affected Data Principals and, where required under the DPDP Act and Rules, the Data Protection Board of India, in accordance with applicable legal timelines.

16. Cross-Border Processing

As explained in our Privacy Policy, we use cloud infrastructure providers to maintain platform performance and reliability, which may involve routing data through servers outside your home state or country. The DPDP Act generally permits the transfer of personal data outside India, other than to countries or territories that the Government of India may restrict by notification. We keep this section under review as any such government restrictions are issued.

17. Updates to This Page

We may update this page as the DPDP Act's remaining provisions come into force, as implementing guidance is issued, or as our own practices evolve. We will revise the "Last Updated" date above when we do. Material changes will also be reflected, where relevant, in our Privacy Policy.

18. Contact for Privacy & DPDP Queries

For questions about this page, to exercise a Data Principal right, or to raise a grievance about personal data processing, please contact:

19. Related Documents