Legal

Privacy Policy

How TOPO collects, uses, shares and protects your personal data when you use our app and website.

Template notice: This is an industry-standard privacy-policy template drafted for a hyperlocal delivery platform operating in India (aligned to the Digital Personal Data Protection Act, 2023 and the IT Rules, 2011). It is not legal advice. Every placeholder in [square brackets] must be completed and the whole document reviewed and approved by a qualified lawyer before publishing.

Effective date: [DD Month YYYY] Last updated: [DD Month YYYY]

1. Introduction

This Privacy Policy explains how [TOPO Legal Entity Name Pvt. Ltd.] (“TOPO”, “we”, “us” or “our”) collects, uses, discloses and safeguards personal data when you use the TOPO mobile application, website and related services (together, the “Platform”). TOPO is a hyperlocal commerce platform that connects customers with local restaurants, kirana (grocery) stores, natural beverage sellers, street-food vendors and delivery partners.

By using the Platform, you acknowledge that you have read and understood this policy. If you do not agree with it, please do not use the Platform. This policy should be read together with our Terms & Conditions and Cookie Policy.

2. Information we collect

We collect the following categories of information:

Information you provide to us

  • Account details: name, mobile number, email address and password.
  • Delivery information: delivery addresses, landmarks and contact details.
  • Order details: items ordered, order history, notes and preferences.
  • Payment information: handled by our third-party payment processors; we do not store full card numbers. We may retain a masked reference and transaction records.
  • Communications: messages, reviews, ratings and support requests you send us.
  • Merchant/partner details (where applicable): business name, GSTIN, FSSAI licence, bank details and KYC documents.

Information we collect automatically

  • Location data: precise or approximate location (with your permission) to show nearby sellers and enable delivery.
  • Device & usage data: device model, operating system, app version, IP address, identifiers, and how you interact with the Platform.
  • Cookies and similar technologies on our website (see Section 6).

Information from third parties

  • Payment processors, mapping and location providers, analytics providers, and login providers if you sign in through them.

3. How we use your information

We use personal data to:

  • Create and manage your account and authenticate you.
  • Process, fulfil and deliver your orders, and share necessary details with the relevant merchant and delivery partner.
  • Process payments, refunds and cancellations.
  • Show you nearby sellers and personalise your experience.
  • Provide customer support and respond to your requests.
  • Send service communications (order updates) and, where permitted, promotional messages you can opt out of.
  • Improve, secure and troubleshoot the Platform, and prevent fraud and misuse.
  • Comply with legal obligations and enforce our terms.

We process personal data on the basis of your consent, for the performance of the services you request, to comply with legal obligations, and for our legitimate interests (such as securing the Platform and preventing fraud), consistent with applicable law including the Digital Personal Data Protection Act, 2023.

Where we rely on consent, you may withdraw it at any time (see Section 9). Withdrawing consent may limit our ability to provide certain features or complete your orders.

5. How we share information

We do not sell your personal data. We share it only as described below:

  • Merchants and delivery partners: the details needed to prepare and deliver your order (e.g. name, delivery address, contact number and order items).
  • Service providers: payment processors, cloud hosting, mapping/location, communications (SMS/email/push), analytics and customer-support tools, who process data on our behalf under contract.
  • Legal and safety: where required by law, court order or a valid request from a public authority, or to protect the rights, safety and property of TOPO, our users or others.
  • Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this policy.

6. Cookies & tracking

Our website uses cookies and similar technologies for essential functionality, remembering your preferences, measuring performance and (with consent) marketing. You can manage non-essential cookies through our cookie banner and your browser settings. For details, see our Cookie Policy.

7. Data retention

We retain personal data only for as long as necessary to provide the services, comply with legal, tax and accounting obligations, resolve disputes and enforce our agreements. When data is no longer required, we delete or anonymise it. Specific retention periods are set out in our internal data-retention schedule. [Insert summary of key retention periods after legal review.]

8. Data security

We implement reasonable technical and organisational measures — such as encryption in transit, access controls and regular reviews — to protect personal data against unauthorised access, loss or misuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal-data breach affects you, we will notify you and the relevant authorities as required by law.

9. Your rights & choices

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you and request a summary of processing.
  • Correct, complete or update inaccurate data.
  • Request erasure of your data, subject to legal retention requirements.
  • Withdraw consent and opt out of promotional communications.
  • Nominate another individual to exercise your rights in the event of death or incapacity, where the law provides for this.
  • Raise a grievance with our Grievance Officer (see Section 13).

To exercise any of these rights, contact us using the details in Section 13. We may need to verify your identity before acting on a request.

10. Children’s privacy

The Platform is not intended for children under the age of 18. We do not knowingly collect personal data from children without verifiable parental consent as required by law. If you believe a child has provided us data, please contact us so we can take appropriate action.

11. International transfers

Your data is primarily processed in India. Where we use service providers located outside India, we transfer data only in accordance with applicable law and take steps to ensure it receives an adequate level of protection. [Confirm transfer mechanisms and countries after legal review.]

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you through the Platform. Your continued use of the Platform after changes take effect means you accept the updated policy.

13. Contact & grievance officer

If you have questions, requests or complaints about this policy or your personal data, contact us:

  • Company: [TOPO Legal Entity Name Pvt. Ltd.]
  • Registered address: [Full registered address], Bengaluru, Karnataka, India
  • Email: privacy@topo.example (placeholder)
  • Grievance Officer: [Name], reachable at grievance@topo.example (placeholder)

In accordance with applicable law, we will acknowledge and address grievances within the statutory timeframe. [Confirm the response timeframe your policy commits to.]