Privacy Policy

1. Introduction and Data Fiduciary Information

• This Privacy Policy ("Policy") is published by Carnatic Foods Private Limited ("Company", "we", "us", or "our"), a private limited company incorporated under the Companies Act, 2013, in its capacity as a Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
• CIN: U56100TN2025PTC180902
• Registered Office: Plot No. 87, Sun Garden, Morattandi, Auroville, Vanur, Villupuram, Tamil Nadu 605101, India
• This Policy describes how the Company collects, uses, stores, processes, shares, retains, and protects the Personal Data of individuals ("Data Principals" or "You") who access or use the raagas website, progressive web application, mobile applications, and related services (collectively, the "Platform").
• This Policy is published in compliance with: (a) the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025; (b) the Information Technology Act, 2000; (c) the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; (d) the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; and (e) the Consumer Protection (E-Commerce) Rules, 2020.
• By accessing or using the Platform, You acknowledge that You have read, understood, and agree to the processing of Your Personal Data as described in this Policy. Where consent is the legal basis for processing, the Company shall obtain Your explicit, informed, specific, and unconditional consent before such processing, through a clear affirmative action.

2. Definitions

• In this Policy, unless the context otherwise requires:
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under Section 2(t) of the DPDP Act. This includes data in digital form and data that is digitised from non-digital form.
• "Data Principal" means the individual to whom the Personal Data relates — in this context, You, the User of the Platform — as defined under Section 2(j) of the DPDP Act. Where the Data Principal is a child (under 18 years), the parent or lawful guardian is deemed the Data Principal for purposes of consent.
• "Data Fiduciary" means the entity that, alone or in conjunction with other persons, determines the purpose and means of processing of Personal Data — in this context, Carnatic Foods Private Limited — as defined under Section 2(i) of the DPDP Act.
• "Data Processor" means any person who processes Personal Data on behalf of the Data Fiduciary, including third-party service providers and technology partners engaged by the Company.
• "Processing" means performing any operation or set of operations on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, use, alignment, combination, indexing, sharing, disclosure by transmission, dissemination, restriction, erasure, or destruction.
• "Consent" means a free, specific, informed, unconditional, and unambiguous indication of the Data Principal's wishes, by which the Data Principal, by a clear affirmative action, signifies agreement to the processing of Personal Data for a specified purpose, as defined under Section 7 read with Section 6 of the DPDP Act.
• "Consent Manager" means a person registered with the Data Protection Board of India under Section 2(g) of the DPDP Act, who acts as a single point of contact to enable Data Principals to give, manage, review, and withdraw their consent through an accessible, transparent, and interoperable platform.
• "Significant Data Fiduciary" means a Data Fiduciary or class of Data Fiduciaries notified by the Central Government under Section 10 of the DPDP Act, based on the volume and sensitivity of Personal Data processed, risk to the rights of the Data Principal, potential impact on the sovereignty and integrity of India, and such other factors as may be prescribed.

3. Personal Data We Collect

4. Purpose of Data Collection and Processing

• The Company collects and processes Your Personal Data for the following specific, lawful purposes. Personal Data shall not be processed for any purpose beyond what is specified at the time of collection without obtaining Your fresh consent:
• Account creation and authentication: To create, verify, maintain, and secure Your Account using OTP-based passwordless authentication via AWS Cognito; to manage Your profile information and preferences.
• Order processing and fulfilment: To receive, validate, process, prepare, pack, dispatch, and deliver Your food Orders; to communicate Order status updates, preparation progress, and delivery notifications.
• Payment processing: To facilitate payment collection, transaction verification, refund processing, and settlement through Cashfree Payments; to detect, prevent, and investigate payment fraud and unauthorised transactions.
• Delivery services: To determine delivery feasibility and serviceability; to calculate optimal delivery routes, estimated delivery times, and delivery charges; to assign delivery personnel; to provide real-time Order tracking; and to share necessary delivery information with our delivery fleet and Delivery Partners.
• Customer support: To respond to Your queries, complaints, and requests; to investigate and resolve disputes, refund claims, and service issues; to maintain records of interactions for quality assurance and training.
• Platform improvement: To analyse usage patterns and trends; to identify, diagnose, and fix technical issues and bugs; to measure and improve Platform performance, stability, and user experience; to conduct A/B testing and feature experiments.
• Personalisation: To display relevant menu recommendations based on Your order history and preferences; to remember Your saved items, addresses, and preferred outlet; to customise the Platform experience.
• Marketing communications: To send promotional offers, discounts, new menu announcements, seasonal campaigns, and marketing materials — only with Your separate, explicit consent, which You may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.
• Safety and security: To detect, prevent, and investigate fraud, unauthorised access, account abuse, policy violations, and other threats to the security and integrity of the Platform and its Users; to enforce our Terms and Conditions.
• Legal compliance: To comply with Applicable Laws, regulations, and government directives; to respond to lawful requests from courts, tribunals, law enforcement agencies, and regulatory authorities; to protect the rights, property, and safety of the Company and its Users; to enforce our Terms and Conditions.
• Tax and accounting: To generate GST-compliant tax invoices in accordance with the Central Goods and Services Tax Act, 2017; to maintain financial and accounting records; to fulfil tax reporting and audit obligations under the Income Tax Act, 1961; to comply with record retention requirements under applicable fiscal legislation.

5. Legal Basis for Processing

• The Company processes Your Personal Data on the following legal bases under the DPDP Act, 2023 and other Applicable Laws:
• Consent (Section 6, DPDP Act): For processing that is not strictly necessary for the performance of a contract or compliance with law — including marketing communications, non-essential cookies (analytics and advertising), precise location tracking, device fingerprinting for fraud detection, and any processing for which specific consent is sought. Consent is obtained through a clear affirmative action (e.g., actively checking an unchecked checkbox, clicking "Allow", tapping "I Agree") and is specific to each purpose. Pre-ticked checkboxes, implied consent, and bundled consents are not relied upon.
• Performance of Contract (Section 7(a), DPDP Act — Specified Purpose): For processing that is necessary to fulfil our contractual obligations to You — including Account creation and authentication, Order processing, payment processing, delivery services, customer support, transactional communications, and core Platform functionality.
• Compliance with Law (Section 7(b), DPDP Act — Legitimate Uses): For processing that is necessary to comply with Applicable Laws, court orders, or orders of governmental or regulatory authorities — including tax and accounting obligations (GST Act, Income Tax Act), food safety record-keeping (FSSA), payment data retention (RBI guidelines), and law enforcement cooperation.
• The Company shall not process Personal Data for any purpose beyond what is specified in the Consent Notice or this Policy at the time of collection without obtaining fresh, specific consent from the Data Principal.

6. Consent Mechanism

7. Information Sharing and Disclosure

8. Cross-Border Data Transfers

• Your Personal Data is primarily stored and processed in India using cloud infrastructure hosted in the Amazon Web Services (AWS) Asia Pacific (Mumbai) region (ap-south-1).
• Certain third-party Data Processors engaged by the Company — including Google LLC (Google Analytics, Google Maps, Firebase), Meta Platforms, Inc. (Meta Pixel), and Functional Software, Inc. (Sentry) — may process or store data on servers located outside India, including in the United States of America and the European Economic Area.
• The Company shall only transfer Personal Data to jurisdictions that have not been restricted by the Central Government of India under Section 16(1) of the DPDP Act. As of the date of this Policy, the Central Government has not published a list of restricted jurisdictions under Section 16(1). The Company monitors and shall comply with any such restrictions as and when notified.
• Payment transaction data is stored exclusively in India, in compliance with the Reserve Bank of India's Circular on Storage of Payment System Data dated 6 April 2018 (RBI/2017-18/153), which mandates that the entire payment data, including full end-to-end transaction details, shall be stored in systems located only in India.
• The Company shall ensure that all cross-border data transfers comply with the DPDP Act, the DPDP Rules, and any guidelines or directions issued by the Data Protection Board of India from time to time.

9. Data Retention

• The Company retains Your Personal Data only for as long as reasonably necessary to fulfil the specific purpose for which it was collected, to comply with its legal and regulatory obligations, to resolve disputes, and to enforce its agreements. The specific retention periods are as follows:
• Account information (name, phone number, email, preferences): Retained for the duration of Your active Account and for three (3) years after Your last interaction with the Platform (last login, last Order, or last support communication), after which the data shall be securely erased or irreversibly anonymised.
• Order history and transaction records: Retained for eight (8) years from the end of the financial year in which the transaction occurred, in compliance with Section 35/36 of the Central Goods and Services Tax Act, 2017 and the Income Tax Act, 1961 (which require maintenance of books of account for a minimum of six to eight years).
• Payment transaction logs: Retained for ten (10) years from the date of the transaction, in compliance with the Reserve Bank of India's Master Direction on Payment Aggregators dated 17 March 2020 and the Payment and Settlement Systems Act, 2007.
• Consent records: Retained for seven (7) years from the date of consent or withdrawal of consent, in compliance with the Digital Personal Data Protection Rules, 2025.
• Security and access logs: Retained for a minimum of one (1) year from the date of generation, in compliance with the Digital Personal Data Protection Rules, 2025 and industry security best practices.
• Customer support communications: Retained for three (3) years from the date of resolution of the query, complaint, or dispute.
• Marketing preferences and opt-out records: Retained for the duration of Your active Account and for one (1) year after Account closure or deactivation.
• Upon expiry of the applicable retention period, Personal Data shall be securely erased or irreversibly anonymised using industry-standard methods such that it can no longer be attributed to or used to identify any individual. The Company shall notify You at least forty-eight (48) hours before the scheduled erasure of Your Personal Data, where required by the DPDP Rules, 2025.

10. Data Security

• The Company implements reasonable technical, administrative, and organisational security safeguards — commensurate with the nature, scope, and sensitivity of the Personal Data processed — to protect Your data against unauthorised or unlawful access, use, alteration, disclosure, destruction, loss, or damage. These measures include, but are not limited to:
• Encryption in transit: All data transmitted between Your device and the Platform is encrypted using Transport Layer Security (TLS) version 1.2 or higher (HTTPS). All API communications are encrypted end-to-end.
• Encryption at rest: Sensitive Personal Data stored in databases and file systems is encrypted using Advanced Encryption Standard (AES) with 256-bit keys (AES-256). Database encryption keys are managed through AWS Key Management Service (KMS).
• Access controls: Access to Personal Data is restricted to authorised personnel on a strict need-to-know and least-privilege basis. Role-Based Access Control (RBAC), multi-factor authentication (MFA) for all administrative access, and comprehensive audit logging are implemented across all internal systems.
• Payment security: All payment processing is handled by Cashfree Payments, a PCI-DSS Level 1 certified Payment Aggregator. Card data is tokenised in compliance with RBI's tokenisation mandate. The Company does not store, process, or transmit full card numbers, CVV, card PIN, or track data at any point.
• Application security: The Platform undergoes regular security assessments, automated vulnerability scanning, and periodic penetration testing by qualified security professionals. Security headers, Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and other defensive measures are implemented. The Company operates a Bug Bounty Program (raagas.co.in/legal/bug-bounty) for responsible vulnerability disclosure.
• Infrastructure security: The Company uses Amazon Web Services (AWS) cloud infrastructure with enterprise-grade security controls, including Virtual Private Cloud (VPC) network segmentation, Web Application Firewall (WAF), DDoS protection, intrusion detection and prevention systems, automated security monitoring, and regular security patching.
• Employee training: All employees and contractors with access to Personal Data undergo mandatory training on data protection, information security, privacy best practices, and incident response procedures, at the time of onboarding and periodically thereafter.
• The Company maintains an information security management programme consistent with IS/ISO/IEC 27001:2022 standards, as referenced under Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• Notwithstanding the above, no method of transmission over the Internet, no method of electronic storage, and no security system is completely impenetrable. While the Company strives to protect Your Personal Data using commercially reasonable and industry-standard measures, absolute security cannot be guaranteed. The Company shall not be liable for breaches that occur despite the implementation of reasonable security measures.

11. Rights of Data Principals

12. Children's Data

• Under the DPDP Act, 2023, a "child" means any individual who has not completed eighteen (18) years of age. The Platform and Services are primarily designed for and directed at adults. The Company does not knowingly or intentionally collect Personal Data from children without verifiable parental or guardian consent.
• If a child (under 18 years) wishes to use the Platform, verifiable consent must first be obtained from the child's parent or lawful guardian before any Personal Data is collected, processed, or stored. The Company may implement reasonable age verification mechanisms as prescribed under the DPDP Rules, 2025 to ensure compliance.
• In compliance with Section 9 of the DPDP Act, the Company shall not: (a) undertake tracking or behavioural monitoring of children; (b) engage in targeted or behavioural advertising directed at children; or (c) process the Personal Data of children in any manner that is likely to cause detrimental effect to the well-being of the child.
• If the Company becomes aware that it has inadvertently collected Personal Data from a child without verifiable parental or guardian consent, the Company shall take immediate steps to securely delete such data and, where the parent or guardian is identifiable, notify them of the collection and deletion.

13. Cookies and Tracking Technologies

The Platform uses cookies, local storage, session storage, service workers, pixel tags, and similar tracking technologies to enhance Your experience, enable core Platform functionality, analyse usage patterns, and deliver relevant content. For comprehensive information about the types and categories of cookies we use, the specific purposes for which we use them, how to manage Your cookie preferences, the detailed cookie inventory, and the specific third-party cookies placed on the Platform, please refer to our Cookie Policy at raagas.co.in/legal/cookies.

14. Automated Decision-Making and Profiling

• The Company uses automated systems and algorithms in certain aspects of the Platform and Services. Transparency regarding such processing is provided below:
• Fraud detection: The Company employs automated fraud detection algorithms that analyse transaction patterns, device fingerprints, account behaviour, order history, and payment signals to identify and flag potentially fraudulent transactions, refund claims, and account activity. Orders or accounts flagged by automated systems may be subject to additional manual verification or may be declined, suspended, or terminated.
• Dynamic pricing and delivery charges: Delivery charges and surge pricing may be calculated using automated algorithms that consider factors including distance, time of day, demand levels, weather conditions, available delivery fleet capacity, and order volume. These calculations are algorithmic and do not involve profiling based on individual personal characteristics.
• Personalised recommendations: The Platform may display personalised menu recommendations and content based on Your order history, browsing behaviour, saved preferences, and geographical location. These recommendations are generated algorithmically to enhance Your experience and are not used for discriminatory purposes.
• If an automated decision significantly affects You (e.g., Account suspension, Order rejection, or refund denial based solely on automated processing), You have the right to request human review of such decision by writing to care@raagas.co.in. The Company shall ensure that a qualified human decision-maker reviews the automated output and provides a reasoned response within fourteen (14) Business Days.

15. Data Protection Impact Assessment

• The Company conducts Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in a high risk to the rights and freedoms of Data Principals, in alignment with the DPDP Rules, 2025 and international best practices.
• High-risk processing activities for which the Company has conducted or shall conduct DPIAs include: (a) large-scale processing of Personal Data for fraud detection and prevention; (b) systematic monitoring of User behaviour for personalisation and analytics; (c) processing of payment data and financial information; (d) cross-border transfers of Personal Data to third-party service providers; and (e) introduction of new technologies, features, or processing activities that involve significant Personal Data processing.
• The Company reviews and updates its DPIAs on an annual basis, or more frequently when there is a material change in the nature, scope, or purpose of processing, when new technologies are adopted, or when directed by the Data Protection Board of India.
• The outcomes of DPIAs inform the Company's implementation of appropriate safeguards, technical measures, and organisational controls to mitigate identified risks.

16. Data Breach Notification

• In the event of a Personal Data breach that is likely to cause significant harm to Data Principals, the Company shall:
• Notify the Data Protection Board of India ("DPB") in the prescribed manner and form, within seventy-two (72) hours of becoming aware of the breach, in compliance with Section 8(6) of the DPDP Act and the DPDP Rules, 2025.
• Notify the affected Data Principals without undue delay, and in any event within forty-eight (48) hours of notification to the DPB, via SMS and/or email to the registered contact details. The notification shall include: (a) the nature and description of the breach; (b) the categories and approximate scope of Personal Data affected; (c) the likely consequences of the breach for the affected Data Principals; (d) the measures taken or proposed to be taken by the Company to address the breach, contain its effects, and mitigate potential harm; and (e) contact details for obtaining further information (care@raagas.co.in).
• Take immediate technical and organisational measures to contain the breach, remediate the vulnerability, and prevent recurrence.
• Maintain comprehensive records of all Personal Data breaches — including the facts and circumstances, the categories and volume of data affected, the effects and consequences, and the remedial and corrective actions taken — for a minimum of three (3) years from the date of the breach.

17. Third-Party Links

The Platform may contain links to third-party websites, applications, or services that are not owned, operated, or controlled by the Company. This Privacy Policy applies solely to Personal Data collected and processed by the Company through the Platform and does not extend to the practices of third parties. The Company is not responsible for the privacy practices, data collection policies, security standards, content, or terms of use of any third-party services. The Company encourages You to review the privacy policies and terms of any third-party services before providing Your Personal Data to them or using their services.

18. Changes to This Privacy Policy

• The Company reserves the right to modify, amend, or update this Privacy Policy at any time, to reflect changes in its data processing practices, legal requirements, regulatory guidance, technology, or business operations. Any changes shall be effective upon publication of the revised Policy on the Platform, with the updated "Last Updated" date reflected at the top of this page.
• For material changes that significantly affect how Your Personal Data is collected, used, shared, or otherwise processed — including changes to the categories of data collected, new purposes of processing, new categories of recipients, or changes to retention periods — the Company shall provide conspicuous notice through one or more of: email to Your registered email address, in-app notification, SMS, or a prominent banner on the Platform, at least seven (7) days before the changes take effect.
• Where Applicable Law — including the DPDP Act and DPDP Rules — requires the Company to obtain fresh consent for material changes in processing activities, the Company shall obtain such consent through a clear affirmative action before implementing the changes.
• Your continued access to or use of the Platform after the publication of the revised Policy constitutes Your acknowledgement of the changes. If You disagree with any changes to this Policy, You should discontinue use of the Platform and may request deletion of Your Account and Personal Data by writing to care@raagas.co.in.

19. Grievance Redressal and Data Protection Officer

• In accordance with the Digital Personal Data Protection Act, 2023, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Consumer Protection (E-Commerce) Rules, 2020 (including Rule 4(4) — Nodal Officer), the Company has appointed the following officer:
• Designation: Director, Grievance Redressal Officer, Nodal Officer, and Data Protection Officer
• Email: care@raagas.co.in
• Address: Carnatic Foods Private Limited, Plot No. 87, Sun Garden, Morattandi, Auroville, Vanur, Villupuram, Tamil Nadu 605101, India
• The Grievance Redressal Officer / Data Protection Officer shall: (a) acknowledge every complaint, grievance, or data subject request within forty-eight (48) hours of receipt; (b) investigate the complaint and provide a reasoned resolution within thirty (30) days of receipt; (c) maintain a comprehensive record of all complaints received, actions taken, and resolutions provided; and (d) coordinate with law enforcement agencies, regulatory authorities, and the Data Protection Board as required under Applicable Law.
• When writing to the Grievance Officer or DPO, please provide: Your registered phone number or email address (for identity verification), a detailed description of Your complaint, grievance, or request, the specific right You wish to exercise (if applicable), and any supporting documentation or evidence.

20. Contact the Data Protection Board of India

• If You are not satisfied with the resolution provided by the Company's Grievance Officer or Data Protection Officer, or if the Company fails to acknowledge or respond within the prescribed timelines, You have the right to file a complaint with the Data Protection Board of India ("DPB") established under Chapter V of the DPDP Act, 2023.
• The DPB is the statutory authority constituted by the Central Government, responsible for determining non-compliance with the provisions of the DPDP Act and imposing penalties. The DPB adjudicates complaints filed by Data Principals regarding the processing of their Personal Data by Data Fiduciaries. Details of how to file a complaint with the DPB shall be available on the official website of the Data Protection Board of India and the Ministry of Electronics and Information Technology (MeitY) at www.meity.gov.in.
• You may also contact the National Consumer Helpline at 1800-11-4000 (toll-free) or 14404 for consumer-related grievances, or file a complaint through the National Consumer Helpline portal at consumerhelpline.gov.in, or the e-Daakhil portal at edaakhil.nic.in for filing cases before Consumer Disputes Redressal Commissions.