Mittai Bandi – Privacy Policy

1. Introduction

Welcome to Mittai Bandi (“Mittai Bandi”, “we”, “us”, “our”). Mittai Bandi is an online marketplace platform, available through our mobile application and website [www.mittaibandi.com], that connects customers with independent sweet shops, bakeries and confectioners (“Partner Shops”) and facilitates delivery of their products through delivery partners (“Delivery Partners”).

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and the choices and rights you have. It applies to everyone who uses our app or website, including customers, Partner Shops and Delivery Partners (together, “Users” or “you”).

By downloading, registering on, or using Mittai Bandi, you confirm that you have read and understood this Privacy Policy and consent to the practices described here. If you do not agree, please do not use our services.

This Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable laws of India.

2. Information We Collect

2.1 Information you provide to us

Customers

• Name, mobile number and email address
• Delivery addresses, landmarks and address labels (Home, Work, etc.)
• Order details, order history, favorites and ratings/reviews
• Dietary preferences or allergy notes you choose to add to an order (for example “no nuts” or “sugar-free”)
• Payment-related information such as the payment method used and transaction status (see Section 2.3)
• Messages, photos and feedback you send to our support team or through in-app chat
• Promo codes, referral details and survey responses

Partner Shops

• Owner/authorized representative name, contact number and email address
• Shop name, address, photographs, menu, pricing and opening hours
• Business registration details such as FSSAI license number, GST number, PAN and shop establishment details
• Bank account details for settlement of payments
• Agreements, correspondence and support requests

Delivery Partners

• Name, mobile number, email address, photograph and date of birth
• Identity and address proof (such as Aadhaar, PAN or driving license) for verification, as permitted by law
• Vehicle details and driving license information
• Bank account details for payouts
• Availability, delivery history, ratings and earnings information

2.2 Information collected automatically

• Location data: With your permission, we collect precise or approximate location from your device to show nearby Partner Shops, auto-fill delivery addresses, enable order tracking and assign deliveries. Delivery Partners' location is collected while they are online/on duty. You can turn off location access in your device settings, but some features may not work.
• Device information: Device model, operating system, unique device identifiers, app version, language, IP address and mobile network information.
• Usage information: Pages and screens viewed, search queries, items viewed or added to cart, time spent, crashes, and interactions with offers and notifications.
• Cookies and similar technologies: Used on our website and app as described in Section 8.

2.3 Payment information

Payments are processed by third-party payment gateways and banks (such as UPI apps, card networks and wallet providers). We do not store your full card number, CVV, UPI PIN or net-banking credentials. We receive only limited information such as transaction ID, payment status, masked card/UPI details and amount.

2.4 Information from third parties

We may receive information from payment gateways, identity/background verification providers (for Delivery Partners), social login providers (if you sign in using Google or similar), analytics and advertising partners, and Partner Shops (for order fulfillment and quality issues).

2.5 Optional permissions

The app may request access to your location, camera/photos (for profile pictures, review photos or document upload), contacts (only for referrals, if you choose), and notifications. You can grant or withdraw these permissions at any time in your device settings.

3. How We Use Your Information

We use personal data for the following purposes:

• To provide our services: Creating and managing your account, enabling you to browse Partner Shops, place and pay for orders, track deliveries and receive invoices.
• To fulfil orders: Sharing necessary details with Partner Shops and Delivery Partners so that your order can be prepared and delivered.
• To process payments, refunds and settlements to Partner Shops and Delivery Partners.
• To verify identity and prevent fraud: Onboarding Partner Shops and Delivery Partners, detecting misuse, fake orders, payment fraud and security threats.
• To communicate with you: Order confirmations, delivery updates, OTPs, service announcements, policy changes and customer support responses via SMS, email, WhatsApp, calls and push notifications.
• To personalize your experience: Recommending shops and sweets, festival offers and relevant content based on your preferences and order history.
• To market and promote: Send offers, discounts and promotional messages, where permitted by law and subject to your consent. You can opt out at any time.
• To improve our services: Analytics, research, quality monitoring, troubleshooting, app performance and developing new features.
• To resolve disputes and enforce our terms: Including handling complaints about food quality, delays, allergies or damaged deliveries.
• To comply with legal obligations: Including tax, accounting, food-safety and regulatory requirements, and to respond to lawful requests from authorities.

4. Consent and Lawful Basis

We process your personal data based on your consent, which you give when you register or use the app, and for certain legitimate uses permitted under the DPDP Act, such as fulfilling a service you requested, complying with legal obligations, responding to medical or safety emergencies, and preventing fraud.

You may withdraw your consent at any time by contacting us (see Section 14) or through the app settings. Withdrawal does not affect processing already carried out, and may limit or prevent your ability to use some or all of our services.

5. How We Share Your Information

We do not sell your personal data. We share it only as described below:

• Partner Shops: Your name, order details, delivery address (where needed), and any special instructions or allergy notes, so they can prepare your order.
• Delivery Partners: Your name, contact number (which may be masked or routed through a virtual number), delivery address, and order details, so they can deliver to you.
• Customers: Limited information about Delivery Partners (name, photo, vehicle number, contact) and Partner Shops (name, address) is shown to customers for the order.
• Service providers: Payment gateways, cloud hosting and storage providers, SMS/email/WhatsApp communication providers, mapping and navigation services, analytics tools, customer support platforms, verification agencies and marketing partners. These parties are permitted to use your data only to provide services to us and are bound by confidentiality and security obligations.
• Legal and regulatory authorities: Where required by law, court order, or government request, or to protect the rights, safety and property of Mittai Bandi, our Users or the public.
• Business transfers: In connection with a merger, acquisition, restructuring or sale of assets, your data may be transferred to the successor entity, which will continue to be bound by this Policy.
• With your consent: For any other purpose that we disclose to you and for which you give consent.

We may also share aggregated or anonymized data that cannot identify you, for analytics, research and business purposes.

6. Data Retention

We retain personal data only for as long as necessary to provide our services, fulfil the purposes described in this Policy, and comply with legal, tax, accounting and dispute-resolution requirements. For example, transaction records are generally retained for the period required under applicable tax and company laws.

When you delete your account or request erasure, we will delete or anonymise your personal data unless we are required or permitted by law to retain it (for example, for pending disputes, fraud prevention or statutory record-keeping).

7. Data Security

We use reasonable technical, administrative and physical safeguards to protect your personal data against unauthorized access, loss, misuse, alteration or disclosure. These include encryption of data in transit, access controls, secure servers and periodic security reviews.

However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. Please protect your account by keeping your login details and OTPs confidential and never sharing them with anyone, including people claiming to represent Mittai Bandi. If you suspect unauthorized access to your account, contact us immediately.

In the event of a personal data breach, we will notify affected Users and the relevant authorities as required by applicable law.

8. Cookies and Similar Technologies

We use cookies, SDKs, pixels and similar technologies to keep you logged in, remember your preferences and cart, understand how our website and app are used, measure the performance of our campaigns, and show relevant offers.

You can control or delete cookies through your browser settings, and manage advertising identifiers through your device settings. Disabling certain cookies may affect the functionality of our website or app.

9. Your Rights and Choices

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and the processing activities carried out;
• Correct or update inaccurate or incomplete data (you can edit most details directly in your profile);
• Erase your personal data, which you can request or do by deleting your account in the app;
• Withdraw consent previously given;
• Grievance redressal – to raise a complaint about how your data is handled (see Section 13);
• Nominate another individual to exercise your rights in the event of your death or incapacity, as provided under the DPDP Act.

You may also opt out of promotional messages by using the “unsubscribe” link or by changing notification settings in the app. Service-related messages (such as order updates and OTPs) will continue as they are necessary for the service.

To exercise these rights, contact us using the details in Section 14. We may need to verify your identity before acting on a request.

10. Children's Privacy

Mittai Bandi is intended for users who are 18 years of age or older. We do not knowingly collect personal data from children under 18 without verifiable consent of a parent or lawful guardian. If you believe a child has provided us with personal data without such consent, please contact us and we will take steps to delete it. We do not track, monitor the behavior of, or target advertising at children.

11. Data Storage and International Transfers

Your data is primarily stored and processed on servers located in India. Some of our service providers may process data outside India. Where this happens, we take steps to ensure that your data is handled in accordance with this Policy and applicable law, and any transfer will comply with restrictions notified by the Government of India under the DPDP Act.

12. Third-Party Links and Services

Our app and website may contain links to third-party websites, payment pages, social media platforms or services. We do not control and are not responsible for their privacy practices. We encourage you to read their privacy policies before providing any personal data.

Partner Shops are independent businesses. While we require them to handle your data responsibly and only for order fulfillment, they may have their own privacy practices for data you share directly with them.

13. Grievance Redressal

In accordance with the Information Technology Act, 2000 and the rules made thereunder, and the DPDP Act, the contact details of our Grievance Officer are:

We will acknowledge your complaint within 48 hours and endeavor to resolve it within 15 days of receipt, or within any shorter period required by law. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is operational, as provided under the DPDP Act.

14. Contact Us

For any questions, requests or concerns about this Privacy Policy or your personal data, please contact:

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology or legal requirements. When we make material changes, we will notify you through the app, by email or by a notice on our website, and update the effective date above. Your continued use of Mittai Bandi after the changes take effect means you accept the updated Policy. We encourage you to review this page periodically.

By using Mittai Bandi, you acknowledge that you have read, understood and agreed to this Privacy Policy.