Privacy Policy

Wah Swaad is a technology-enabled food platform that manufactures and sells its own branded authentic Indian snacks and festive hampers, and operates an e-commerce marketplace connecting customers with cloud kitchens, home chefs, and independent food vendors for doorstep delivery.
The Company holds a valid FSSAI Central Licence (No. 13625999000114), issued by FSSAI Chennai, with kind of business listed as Manufacturer, General Manufacturing and Trade/Retail, e-Commerce, Closed Network Model.
Registered Office and Authorised Premises: 8-3-168/M/S-22, Serwell Coop Housing Society, Rajeev Nagar, Yousufguda Circle No.19, Hyderabad, Telangana – 500045, India.
For queries, requests, or complaints relating to this Policy or the processing of your personal data, contact:

This Policy applies to all personal data collected by Wah Swaad, whether directly from you, from your device, from vendors and delivery partners, or from authorised third-party sources where such third parties have a legal basis to share your data with Wah Swaad. It applies to data collected in digital form and, where relevant, to data digitised from non-digital records.
This Policy does not apply to information you provide to, or that is collected by, any independent third-party platform, restaurant, or vendor to which you may be redirected from the Platform. Wah Swaad encourages you to consult the privacy policies of such third parties directly.

We collect and process the following broad categories of data:

• Identity and contact data: name, gender, date of birth (where provided), mobile number, email address, delivery and billing addresses, geo-location (with consent), and profile picture.
• Transactional data: order details, order history, cart activity, product preferences, coupons and loyalty information, invoices, GSTIN (for business customers), and taxable event data required under the CGST Act, 2017.
• Payment data: transaction identifiers, masked card digits (last four), UPI handles, wallet references, bank settlement confirmations, and refund references. We do not store full card numbers, CVV, or UPI PINs.
• Device and technical data: IP address, device identifier, browser type and version, operating system, mobile network information, app version, crash logs, session duration, referral URLs, timestamps, and cookies or similar tracking technologies.
• Vendor and partner data: PAN, GSTIN, FSSAI licence number, business address proof, bank account details, cancelled cheque, kitchen photographs, product photographs, menu details, ingredient and allergen information, and KYC records.
• User generated content: reviews, ratings, feedback, photographs, chat messages with support, and dispute-related communications.
• Communications and preferences: marketing preferences, notification settings, and records of your consents and consent withdrawals.
• Dietary and food preference data: dietary restrictions, cuisine preferences, preferred price points, and occasion-type preferences, collected to personalise the Platform experience, where you choose to provide this information.

Where required for specific services, we may collect sensitive personal data or information within the meaning of Rule 3 of the SPDI Rules, such as financial information and, in limited cases, government-issued identifiers. Such data is handled with heightened security safeguards.

We process personal data only for lawful, specified, and clearly identified purposes:

• Creating and managing your account and authenticating access.
• Processing, fulfilling, and delivering your orders, including coordination with kitchens, vendors, and Delivery Partners.
• Processing, fulfilling, and delivering your orders, including coordination with kitchens, vendors, and Delivery Partners.
• Providing customer support, handling complaints, and resolving disputes.
• Verifying Vendor and Delivery Partner credentials, conducting background checks, and ensuring food safety compliance.
• Operating, securing, and improving the Platform, including fraud prevention and protection against misuse.
• Sending service-related communications such as order updates and transactional notifications.
• Sending promotional or marketing communications, where you have provided separate consent or such communication is permitted under applicable law.
• Carrying out analytics, research, and quality improvement on an aggregated or pseudonymised basis.
• Complying with legal, regulatory, or judicial obligations, and enforcing our Terms.
• Providing personalised recommendations and features based on your order history and preferences, where you have provided consent or such personalisation is a legitimate use under applicable law.

The lawful bases include your consent under Section 6 of the DPDP Act, 2023, legitimate uses recognised under Section 7 of the DPDP Act (including voluntary provision of personal data for a specified purpose, compliance with a judgment or order, response to a medical emergency, and employment-related purposes), and processing in performance of a contract supported under the Indian Contract Act, 1872.

Where processing is based on your consent, such consent is sought through a clear affirmative action. You have the right to withdraw your consent at any time by writing to dpo@wahswaad.com or by using the in-app preference controls. Withdrawal of consent will be as easy as giving it.
If you withdraw consent for processing essential to deliver a service, we may no longer be able to provide that service. Consequences of withdrawal will be explained to you before the withdrawal is effected. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and does not release you from obligations already incurred.
Where required under the DPDP Rules, we may rely on a Consent Manager registered with the Data Protection Board of India, once operational, to facilitate and manage consent on your behalf.

The Platform uses cookies, software development kits (SDKs), web beacons, pixels, and similar technologies for authentication, session management, security, analytics, and personalisation. Please read our Cookie Policy for a detailed description of the types of cookies we use, their purposes, and how you can manage them.
You can manage cookie preferences through your browser settings or the cookie preference banner on the Platform. Disabling certain cookies may affect Platform functionality.

We may share your personal data with the following categories of recipients on a need-to-know basis:

• Vendors, cloud kitchens, and home chefs to enable order preparation and fulfilment.
• Delivery and logistics partners to complete last-mile delivery.
• Payment aggregators, payment gateways, and banks regulated by the RBI to process payments and refunds.
• Identity verification, anti-fraud, and KYC service providers.
• Cloud hosting, analytics, customer engagement, and communication service providers acting as data processors under written contracts.
• Professional advisers, auditors, and insurers.
• Government, regulatory, tax, or law enforcement authorities where required under law, court order, or to protect rights, property, or safety.
• Any successor entity in the event of a merger, acquisition, reorganisation, or sale of assets, subject to this Policy continuing to apply.

We do not sell, rent, or commercially exploit your personal data to any third party for their independent marketing or commercial purposes.
All third parties who process personal data on our behalf are bound by written agreements imposing confidentiality, purpose limitation, security, and breach reporting obligations consistent with the DPDP Act, 2023 and the SPDI Rules.

Your personal data is primarily stored on servers located in India.Your personal data is primarily stored on servers located in India. Where data is transferred outside India, such transfer is carried out only to jurisdictions that are not restricted by the Central Government under Section 16 of the DPDP Act, 2023, and subject to appropriate contractual and security safeguards.

We retain personal data only for as long as necessary for the purposes set out in this Policy, or for longer periods required under applicable law:

• Books of account and related records: at least 8 financial years, as required under Section 128(5) of the Companies Act, 2013.
• GST records, invoices, and tax-related documents: 72 months from the due date for the relevant annual return, as required under Section 36 of the CGST Act, 2017.
• KYC and payment records: as required under RBI directions and anti-money laundering rules.
• FSSAI-related vendor records: as required under the Food Safety and Standards Act, 2006.
• Dispute, grievance, and fraud-related records: for the duration of the dispute and up to the applicable limitation period under the Limitation Act, 1963.
• Account data for inactive accounts: Wah Swaad will notify you before deleting data from a substantially inactive account, in accordance with the DPDP Act, 2023.

Once the retention period expires and no legal ground requires further retention, we will erase or irreversibly anonymise the data.

We implement reasonable security practices and procedures as prescribed under Rule 8 of the SPDI Rules and Section 8(5) of the DPDP Act, 2023. These include access controls, role-based permissions, encryption of data in transit using TLS, hashed storage of passwords, multi-factor authentication for privileged access, periodic vulnerability assessments, secure backups, audit logging, and vendor security due diligence.
No method of electronic storage or transmission is entirely secure. You are responsible for safeguarding your account credentials and promptly informing us of any suspected unauthorised access.

In the event of a personal data breach, we will take prompt remedial action and, where required under Section 8(6) of the DPDP Act, 2023, the SPDI Rules, and the CERT-In directions of 28 April 2022 (requiring reporting of specified cyber incidents to CERT-In within 6 hours of becoming aware of the incident), notify the Data Protection Board of India, CERT-In, and affected data principals in the prescribed manner.

Subject to applicable law, you have the following rights with respect to your personal data:

• Right to information about the personal data being processed and the processing activities being carried out.
• Right to access a summary of your personal data and the identities of data fiduciaries and processors with whom it has been shared.
• Right to correction, completion, updating, and erasure of personal data.
• Right to withdraw consent previously given.
• Right to nominate another individual to exercise your rights in the event of your death or incapacity.
• Right of grievance redressal through our Grievance Officer and, if unresolved, through the Data Protection Board of India.
• Right to data portability: To the extent provided under applicable law or the DPDP Rules (once notified), you may request a copy of personal data provided by you in a structured, commonly used format.

Requests may be submitted todpo@wahswaad.com. We will respond within the timelines prescribed under applicable law. We may request verification information to confirm your identity before acting on your request.

The Platform is not intended for individuals below 18 years of age. In accordance with Section 9 of the DPDP Act, 2023, we do not knowingly process the personal data of a child (a person below 18 years) without the verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring, targeted advertising, or any data processing directed at children that may have a detrimental effect on their well-being. If we become aware of such data having been collected, we will delete it promptly.

Marketing communications are sent only to users who have opted in or to whom such communications are permitted under applicable law. You may unsubscribe at any time using the unsubscribe link in any marketing message, or by writing tosupport@wahswaad.com, or through in-app preference settings. Telephone commercial communications are sent in accordance with the Telecom Commercial Communications Customer Preference Regulations, 2018 of the Telecom Regulatory Authority of India.

In accordance with Rule 5(9) of the SPDI Rules, Section 8(10) read with Section 13 of the DPDP Act, 2023, Rule 3(2) of the IT Intermediary Rules, 2021, and Rule 4(4) and Rule 4(5) of the E-Commerce Rules, 2020, grievances may be addressed to our Grievance Officer at grievance@wahswaad.com. We will acknowledge grievances within 24 hours and endeavour to resolve them within 15 days, and in any event within one month from the date of receipt. In the event that you are dissatisfied with the resolution provided by our Grievance Officer, you may prefer an appeal to the Grievance Appellate Committee (GAC) at https://gac.gov.in within 30 days of receiving our response. Unresolved matters may also be referred to the Data Protection Board of India once it becomes operational.

We may update this Policy from time to time to reflect changes in law, our services, or our data processing practices. The updated Policy will be published on the Platform with a revised Last Updated date. Material changes will be notified through email or in-app notice. Continued use of the Platform after such update constitutes acceptance of the revised Policy.