Privacy Policy

1. Introduction

Welcome to Zayka Food (accessible via https://zaykafood.online). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains our practices regarding the collection, storage, processing, transfer, and disclosure of personal data when you access or use our customer web portal, merchant portals, courier interfaces, or related online services (collectively, the "Platform").

This Privacy Policy is formulated in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable laws of the Republic of India.

2. Who Operates Zayka Food

The Zayka Food platform is owned and operated as an Individual / Sole Proprietorship business enterprise registered under the proprietor's trade name and Permanent Account Number (PAN) in the Union Territory of Jammu & Kashmir, India.

3. Scope of this Policy

This policy applies to all Data Principals interacting with Zayka Food, including:

• Customers / Consumers: Individuals browsing menus, adding items to cart, and placing delivery or pickup orders.
• Merchant / Restaurant Partners: Independent hotels, restaurants, bakeries, and cloud kitchens registering to list food and beverage offerings.
• Delivery Partners / Couriers: Independent delivery personnel registering to fulfill transit and delivery jobs.
• Visitors: Any individual accessing or navigating public pages of our website.

4. Information We Collect

We collect personal data directly from you when you interact with our platform, automatically through device sensors and browser sessions, and through operational interactions during order fulfillment.

5. Location and GPS Information

• Customer Location: Collected only with your explicit permission via your device browser dialog when you search for nearby restaurants, add a delivery address, or proceed to checkout. Zayka Food does NOT continuously track customer location in the background when the website is closed or idle.
• Manual Location Search: If you decline GPS permissions, you may manually search and select verified localities, villages, and towns from our regional dataset (e.g. Kehnusa, Watlab, Aloosa, Bandipora, Sopore).
• Courier Partner Tracking: Delivery partners transmit real-time GPS coordinates only while on active duty ("ONLINE" status) and during active order deliveries to facilitate live dispatch, ETA calculations, and pickup/drop-off navigation.
• Control: You can enable, modify, or revoke browser location permissions at any time through your browser or device system settings.

6. Payment-Related Information

Zayka Food supports Cash on Delivery (COD) and Online Electronic Payments (UPI, Credit/Debit Cards, Net Banking).

For online payments, transactions are processed directly by our authorized, Reserve Bank of India (RBI) compliant payment gateway partner (e.g. Razorpay). Zayka Food does NOT store your raw debit card numbers, credit card numbers, CVV/CVC codes, or banking net-banking passwords on our servers. All online card payments are handled under PCI-DSS Level 1 compliant tokenized gateway environments.

7. Device and Technical Information

When you access our platform, our servers automatically log technical parameters necessary for operational reliability, security, and rate-limiting:

• Internet Protocol (IP) address and rough network locality
• Browser type, version, and device operating system
• Date and timestamp of API requests
• Session identifiers, error logs, and performance metrics

8. Cookies and Browser Storage

We use strictly necessary browser storage (such as localStorage and session tokens) for authentication session persistence, cart preservation across page reloads, and user theme preferences.

We do not use third-party advertising cookies, behavioral ad retargeting networks, Google Analytics, or Meta Pixel trackers. For complete details, please read our dedicated Cookie Policy.

9. How We Use Your Information

We process personal data only for lawful, legitimate, and explicit operational purposes:

• Order Processing & Fulfillment: Transmitting your order, items, and preparation instructions to the selected restaurant.
• Delivery Coordination: Assigning an available courier, calculating distance fees, routing pickup and delivery, and verifying handovers via OTP.
• Payment Processing: Reconciling order payments, processing refunds for cancelled or rejected orders, and calculating merchant settlements.
• Communication & Notifications: Sending transactional order updates, preparation status, courier transit alerts, and OTP codes.
• Security & Fraud Prevention: Preventing duplicate registrations, unauthorized logins, payment fraud, and unauthorized role access.
• Customer Support & Grievances: Investigating failed orders, missing items, payment discrepancies, and resolving disputes.
• Legal & Statutory Compliance: Maintaining accounting ledgers, tax records, and responding to lawful requests from law enforcement authorities.

10. Information Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties for advertising or commercial marketing. Data is shared strictly on a need-to-know basis with the following entities:

11. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is mandated by Indian tax, consumer protection, or accounting regulations.

• Account Information: Retained while your account remains active. You may request deletion of your account at any time.
• Order & Transaction Records: Retained for statutory periods (minimum 5 to 7 years) to comply with Indian Goods and Services Tax (GST) laws and financial audit standards.
• Ephemeral Location Logs: Real-time courier GPS coordinates are purged or aggregated periodically after order delivery completion.

12. Your Rights under the DPDP Act, 2023

As a Data Principal under Indian law, you have specific statutory rights regarding your personal data:

To exercise any of these rights, please email our Grievance Team at businesscity05@gmail.com.

13. Data Security & Incident Management

We implement technical and organizational measures designed to protect your data, including HTTPS / TLS 256-bit encryption in transit, strict Role-Based Access Control (RBAC), one-way password hashing (Bcrypt), and secure tokenized API communications.

In the unlikely event of a confirmed personal data breach affecting data principals, Zayka Food will promptly notify the Data Protection Board of India and affected users in compliance with the DPDP Act, 2023 and applicable rules.

14. Protection of Children's Data

Zayka Food is not intended for unsupervised use by minors under the age of 18. We do not knowingly collect or process personal data belonging to children without verifiable parental or guardian consent. If we discover that personal data of a minor has been submitted without appropriate consent, we will take immediate steps to delete such information.

15. Updates to this Policy

We may update this Privacy Policy periodically to reflect technological changes, new platform features, or evolving statutory requirements in India. When revisions are made, the updated document will be published on this page with an updated "Effective Date". Your continued use of the platform following the posting of changes constitutes your acknowledgment of the revised terms.

16. Grievance Redressal & Contact Information

In compliance with the DPDP Act 2023, Information Technology Act 2000, and Consumer Protection (E-Commerce) Rules 2020, our designated grievance contact is: