This Privacy Policy describes how Puff & Brew, a unit of Essence of Asia (“Company”, “we”, “us”), the data fiduciary for the Puff & Brew website and ordering platform (the “Platform”), collects, uses, discloses, and safeguards personal data, in accordance with the Digital Personal Data Protection Act, 2023 and other applicable Indian law. By using the Platform, you consent to the practices described here.
1. Personal data we collect
- Identity & contact data: name, phone number (via OTP sign-in), and email, where provided.
- Order data: items ordered, order value, order history, notes/customizations, and wallet top-up/spend history.
- Payment metadata: transaction status, payment method chosen, and gateway reference IDs. We do not collect or store your card number, UPI PIN, or bank credentials — these are handled directly by our payment partners (PhonePe, Paytm).
- Technical data: device/browser information, IP address, and usage data collected automatically for security, fraud prevention, and service improvement.
- Authentication data: processed via Firebase (Google) for phone-number sign-in, subject to Google’s own privacy practices.
2. How we use personal data
- To process and fulfil orders, top-ups, and wallet transactions.
- To authenticate you and secure your account.
- To provide customer support and respond to grievances.
- To detect, prevent, and investigate fraud, abuse, or misuse of promotions and the wallet.
- To comply with applicable law, tax, and food-safety record-keeping requirements.
- To improve the Platform, menu offerings, and operations through aggregated/anonymised analysis.
- To send order-related, transactional, and (where not opted out) promotional communications.
3. Legal basis and consent
We process personal data on the basis of your consent (given by using the Platform and providing your data), for performance of your order, and as necessary to comply with legal obligations. You may withdraw consent for non-essential processing (such as promotional communications) at any time by contacting us; this will not affect the lawfulness of processing carried out before withdrawal, and may limit our ability to provide certain features (e.g., order status updates) if consent is withdrawn for essential processing.
4. Sharing of personal data
We may share personal data with:
- Payment aggregators/gateways (PhonePe, Paytm) to process payments and refunds.
- Firebase/Google, for authentication (OTP/reCAPTCHA) and related infrastructure.
- Our staff, contractors, and service providers strictly to operate the Platform (e.g., hosting, analytics, order management).
- Government or regulatory authorities where required by law, court order, or to protect our legal rights, safety, or property.
- A successor entity in the event of a merger, acquisition, or sale of business assets.
We do not sell personal data to third parties. Third-party service providers process data under their own privacy policies and terms, and we are not responsible for their independent data practices.
5. Data retention
We retain personal data for as long as necessary to fulfil the purposes described in this Policy, including to maintain order and transaction records for accounting, tax, and food- safety compliance, to resolve disputes, and to enforce our agreements, after which it is deleted or anonymised, unless a longer retention period is required by law.
6. Security
We use reasonable technical and organisational measures designed to protect personal data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your device and any OTP/session confidential.
7. Your rights
Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the right to:
- Access a summary of the personal data we hold about you and the processing activities.
- Request correction, completion, or updating of your personal data.
- Request erasure of personal data that is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
- Withdraw consent for non-essential processing.
- Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
- Register a grievance regarding the processing of your personal data (see Section 10).
To exercise these rights, contact us using the details in Section 10. We may request reasonable verification of your identity before acting on a request.
8. Children’s data
The Platform is not directed at children under 18. If we become aware that we have collected personal data from a child without verifiable parental/guardian consent, we will take steps to delete such data.
9. Cross-border transfer
Some of our service providers (e.g., Firebase/Google) may process or store data outside India. Where such transfer occurs, we require these providers to maintain appropriate safeguards consistent with applicable law.
10. Grievance officer / Data protection contact
- Name: Grievance Manager
- Email: privacy@puffandbrew.com
- Address: Chennai
We aim to respond to privacy-related requests and grievances within 30 days, as required by applicable law.
11. Changes to this Policy
We may update this Privacy Policy from time to time by posting the revised version on the Platform with an updated “Last updated” date. Your continued use of the Platform after such changes constitutes acceptance of the revised Policy.