Privacy Policy & DPDP Act 2023 Notice

Who is responsible for personal data?

For personal data about a restaurant owner's account and their relationship with Petu POS, Petu POS acts as the responsible entity to the extent it determines the purposes and means of processing. For end-customer information entered into a restaurant's POS account, the restaurant business is the Data Fiduciary and Petu POS acts as its Data Processor, processing that information on the restaurant's documented instructions and to provide the service.

Information we process

Account and owner information can include restaurant and owner names, business email, phone number, outlet address, outlet count, login identifiers, and support communications. Outlet information can include menu, sales, order, staff, inventory, tax configuration, GSTIN, and FSSAI details.

A restaurant may optionally enter an end-customer name and mobile number to prepare a bill or deliver a receipt, including through a WhatsApp action initiated by the restaurant. Petu POS does not sell end-customer phone numbers or use them for Petu POS marketing. The restaurant is responsible for having an appropriate basis to collect and use customer details.

How information is used and shared

We use information to create and secure accounts, provide POS functions, store and display outlet records, support exports, troubleshoot, respond to requests, protect the service, and meet legal obligations. End-customer phone numbers are used for receipt and bill delivery requested by the restaurant, not for advertising or marketing.

If a user chooses WhatsApp delivery, the device may open WhatsApp or another configured app. That third party processes information under its own terms and privacy practices. Payment gateways, hosting, database, authentication, and support providers may process information only as needed to provide their services and subject to applicable agreements.

Security and international processing

We use access controls and technical and organizational safeguards designed to protect information. No internet transmission or storage method can be guaranteed completely secure. Where service providers process information outside India, we take steps required by applicable law and contractual commitments.

Retention schedule

Account and outlet information is retained while an account is active and for up to 90 days after subscription expiry or account closure to support export, reactivation, and service queries. End-customer details are retained as part of the restaurant's records for the same period unless the restaurant deletes them earlier or requests earlier deletion. Information may be retained longer where required by law, for accounting, security, fraud prevention, or an unresolved legal claim.

Deleted information is removed from active systems on the applicable deletion schedule. Encrypted backup copies may persist for up to 180 days before being overwritten, unless a legal or security hold applies.

Your choices, access, export, correction, and deletion

Restaurant account administrators can export outlet data using the outlet data export control in POS administration. They can request correction, access, or deletion of account information by writing to [email protected] or the Grievance Officer below. We may verify identity and authority before acting, and may retain records that law requires us to keep.

For end-customer records, the restaurant is the first point of contact and is responsible for handling requests from its customers. Petu POS will assist the restaurant with applicable processor-side requests, subject to security checks and legal obligations.

Grievance Officer and contact

Name: [Grievance Officer Name]
Designation: [Designation]
Official email: [email protected]
Registered office location: New Delhi, India (street address not provided)

We aim to acknowledge a grievance within 48 hours and resolve it within 30 days, subject to the nature of the request, identity verification, and any longer period permitted by applicable law.

Policy updates

We may update this notice when the service or applicable requirements change. The latest version and its effective date will be published on this page. Material changes will be communicated through the service or the account contact details where appropriate.