Important
This page is a draft that has been through Zappmit’s internal compliance review. It is not yet in effect. It has not been approved by any government body or regulator, and it has not yet been signed off by external legal counsel. Online ordering, payment and delivery are currently disabled on this website.
The Digital Personal Data Protection Act, 2023 and Rules, 2025 are being brought into force in stages. Most duties on organisations such as Zappmit start on 13 May 2027. Until then, section 43A of the Information Technology Act, 2000 and the 2011 Reasonable Security Practices and Sensitive Personal Data Rules continue to apply. Where this policy describes a DPDP duty, it says when that duty starts, and it does not present a future duty as already in force.
Who is responsible for your data
Zappmit LLP, with its registered office at Bahina, Samannaya Palli, Mallarpur, Birbhum, West Bengal - 731216, India, decides why and how personal data is processed through the Zappmit website and apps. In the language of the Digital Personal Data Protection Act, 2023 it is the Data Fiduciary. A merchant or service provider decides for itself how it uses data it holds outside the platform.
Pending management action
Rule 9 of the Digital Personal Data Protection Rules, 2025 will require the business contact of a Data Protection Officer, or of a person who can answer questions, to be published from 13 May 2027. No such person has been designated yet. Until then, questions go to the contact at the end of this policy.
The law and when it applies
Two regimes matter. Today, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply to Zappmit. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are being brought in on a timetable. This table shows what has and has not started.
| Date | What starts | Status on 14 October 2026 |
|---|---|---|
| 13 November 2025 | Sections 1(2), 2, 18 to 26, 35, 38 to 43 and 44(1) and (3) of the Act came into force (G.S.R. 843(E)). The Data Protection Board was established (G.S.R. 844(E)). Rules 1, 2 and 17 to 21 of the Rules came into force (G.S.R. 846(E)). | In force. These provisions set up the Board and do not yet impose duties on Zappmit. |
| 13 November 2026 | Section 6(9) and section 27(1)(d) of the Act, and Rule 4 on Consent Managers. | Not yet in force on the audit date. |
| 13 May 2027 | Sections 3 to 17, 27 (other than 27(1)(d)), 28 to 34, 36, 37 and 44(2) of the Act, and Rules 3, 5 to 16, 22 and 23. These cover notice, consent, security safeguards, breach intimation, children’s data, the rights of Data Principals and the omission of section 43A of the IT Act. | Not yet in force on the audit date. Zappmit plans to meet them by this date. |
This policy describes what Zappmit does today and marks a DPDP duty as a future duty until it starts. The dates come from the Government's Gazette notifications of 13 November 2025. A change to them would be reflected here.
Data collected through this website
- Contact form. If you use the form we collect your name, email address and message. We also record your IP address and browser identifier to prevent abuse. The submission is stored in our database and sent to our contact mailbox, and we use it to reply to you.
- Complaints by email. The online grievance form is not open yet. If you email the Grievance Redressal Officer we receive your message and the address it came from, and we use them to reply. Do not put passwords, OTPs or card details in a complaint.
- Server records. Our server receives your IP address and browser details each time you request a page. These are held in system logs for security and operation.
- Browser storage. The website sets no cookies. It stores one item in session storage and basket items in local storage, as the Cookie Policy lists. These stay in your browser.
- Payment hand-off. When online payment is enabled and you pay, the website passes you to the payment provider's own page. We do not see or store your card, UPI or bank credentials.
Customer data in the apps
| Data | Why we use it |
|---|---|
| Name, mobile number, email address, account credentials such as a PIN | To create and secure your account and sign you in. |
| Delivery and pickup addresses | To deliver your order or collect your parcel. |
| Location, only if you allow it on your device | To show nearby stores, estimate delivery and, for an active order, to show live tracking. |
| Orders, items, amounts, payment status and transaction references | To fulfil the order, give you receipts and invoices, handle refunds and meet tax and accounting duties. |
| Device and notification identifiers | To send you order updates by push notification and to operate and secure the app. |
| Messages and details you give support | To resolve your query or complaint. |
| Complaints you file, and the history of how they were handled | To investigate and answer the complaint, to show you its status, and to keep the record that the law expects of a grievance process. |
The customer app does not currently use an analytics service. If that changes we will update this policy before it does.
Merchant data
For merchants and service providers we collect business and owner identity details, business address, GST and PAN details where applicable, licence and registration numbers and copies, including an FSSAI licence for food businesses, bank account details for settlement, and the content of listings such as menus, prices and photos. We use these to verify and onboard you, to display the information customers are entitled to see, to pay you, to issue and keep tax documents, and to meet our legal duties. The Merchant Terms explain what is shown to customers.
Rider data
For riders we collect identity and contact details, identity and vehicle documents (which may include a photograph), bank account details for payouts, emergency contact details you choose to give, live location while you are available or on a delivery, and photos and codes captured as proof of delivery. We use these to verify you, assign and track orders, pay you, protect customers and riders, investigate incidents and meet our legal duties.
Sensitive personal data
Under the 2011 Rules, sensitive personal data includes passwords and financial information such as bank account and payment details. We collect it only for the purposes above, with your consent where the Rules require it, and we do not store your card or UPI credentials, which stay with the payment provider.
Purposes of processing
We process personal data to run the platform. That includes creating accounts, fulfilling orders and bookings, processing payments and refunds, coordinating delivery, supporting customers, preventing fraud, keeping the platform secure, meeting legal, tax and accounting duties, and improving the service.
Consent and other grounds
Today we rely mainly on what is needed to provide a service you have asked for, such as sharing your address with the rider who delivers your order. The customer app does not yet show this policy at sign-up or record your acceptance of it, and the merchant and rider apps show the policy links without storing a record of acceptance. Zappmit is building that capture. From 13 May 2027 the DPDP Act will require a notice with each consent request that itemises the data and the purpose, says how to withdraw consent, how to exercise your rights and how to complain to the Data Protection Board, and that is available in English or in a language listed in the Eighth Schedule to the Constitution. Consent will have to be free, specific, informed and given by a clear action. It will not be bundled with unrelated purposes. Zappmit is preparing the in-app notices and consent screens for that date.
Who we share data with
| Recipient | What and why |
|---|---|
| The merchant or service provider | Your name, delivery address and order details, so they can fulfil your order. |
| The rider | Pickup and delivery address, order details and contact details needed for the delivery, only while the order is active. |
| Payment providers (currently PayU and Cashfree are integrated) | Payment details and transaction status, to authorise and confirm payments and refunds. They handle your payment credentials under their own terms. |
| Google Maps services | Address and location information, to show maps, route and estimate delivery. |
| Google Firebase Cloud Messaging | A device token and message content, to deliver push notifications. |
| Hosting, email and SMS providers (the SMS provider in the backend is currently Fast2SMS) | The data needed to host our systems, send emails and send OTPs and order messages for us, under contract. |
| Government portals | For riders, the identity and engagement details that the Code on Social Security, 2020 and its rules require us to share with the Government's designated portal (e-Shram) so that a platform worker can be registered, and to report when the work stops. |
| Zappmit staff handling complaints | A grievance and its history are visible to staff who hold grievance permissions, and each time one is opened the access is recorded. |
| Government and legal authorities | Data we are required to disclose by law, a court order or a lawful request. |
These recipients may use the data only for the purposes given, under our contract with them or their own terms. We will update this list when providers change.
Parcel recipients and tracking links
When a customer books a parcel, we collect the recipient's name, phone number and address from the sender. The recipient can follow the parcel through a link that contains a secret token, and the page may show the delivery code and the rider's live location for that parcel. Anyone with the link can see that page, so senders should share it only with the recipient. The sender is responsible for having the recipient's details lawfully.
Messages from us
Service messages such as OTPs, order updates and delivery updates are sent because you use the service. This website sends no promotional messages. Any promotional message or call from us would have to follow the Telecom Commercial Communications Customer Preference Regulations, 2018, as amended, which require, among other things, a registered sender, your recorded consent and an option to opt out.
Data retention
We keep personal data only as long as needed for the purposes above and for legal duties. The retention periods we can state today are these.
- Photos captured as proof of delivery are kept on the live server for 72 hours by default, and a backup copy is kept. No end date has been set for the backup copy.
- Contact-form messages, grievances with their history and notifications, and rider location history are currently kept with no deletion date, because no purge has been built for them and the period has not been decided.
- Tax and accounting records, including invoices and credit notes, are kept for the period the tax and company-law rules require.
- The CERT-In Directions of 28 April 2022 require system logs to be kept for a rolling 180 days within India. From 13 May 2027, Rule 8(3) of the DPDP Rules will require certain personal data and logs to be kept for at least one year. Zappmit has not yet evidenced that its logs are kept for those periods.
Pending management action
Zappmit has not yet approved a full retention schedule or a deletion process that covers every kind of data and every system. The periods above are the ones the law fixes or that the system already applies, and the system already removes old sign-in sessions and unused device tokens on a schedule. This policy does not promise any other period. A complete schedule must be approved before 13 May 2027.
Security safeguards
We apply technical and organisational safeguards that are reasonable for the data we hold, including role-based access controls for staff, storing bank account numbers in encrypted form, and secure connections to our servers. Staff views and downloads of identity documents are not yet recorded in an audit log. No system is completely secure. We do not claim a security certification such as ISO 27001. The 2011 Rules treat compliance with ISO 27001 or an equivalent standard as one way to show reasonable security, and a decision on whether to adopt one is pending. From 13 May 2027 Rule 6 of the DPDP Rules will set minimum safeguards, such as encryption or masking, access control, logging and monitoring, backups and contracts with processors.
Security incidents and breaches
The CERT-In Directions of 28 April 2022 require Zappmit to report listed cyber incidents to CERT-In within six hours of noticing them. From 13 May 2027 Rule 7 of the DPDP Rules will also require us to tell each affected person without delay and the Data Protection Board without delay, with a detailed report to the Board within 72 hours, unless it allows more time. We will follow these duties as they apply.
Pending management action
A written incident-response runbook, a named CERT-In point of contact and a test of the six-hour reporting path have not been confirmed. They are listed as open items in the compliance audit.
Your rights
Today you can ask to review the personal data you gave us and to have it corrected, and you can withdraw consent you gave, by writing to us. From 13 May 2027 the DPDP Act will give you the right to access a summary of your data, to correct and update it, to have it erased, to have your grievance addressed and to nominate another person to exercise your rights if you die or cannot do so yourself. We will respond within the time the law sets, which for a grievance is at most 90 days under the DPDP Rules.
Withdrawing consent
You may withdraw consent you gave. It will not affect processing already done. Withdrawal may mean we can no longer provide a feature that needs the data, and we may still need to keep data the law requires us to keep. Write to contact@zappmit.com to withdraw. From 13 May 2027 withdrawing will have to be as easy as giving consent, and Zappmit is preparing an in-app control for that.
Correction and deletion
You can update some account details in the app. At present, to have your account or data deleted or corrected beyond that, write to contact@zappmit.com from the email or number registered to your account so that we can confirm it is you. We will review the request and delete what we are not required or permitted to keep.
Pending product decision
The customer app does not currently offer a self-service way to delete an account. Whether to build one before 13 May 2027 is a product decision. Until then the email request above is the route.
Children's data
You must be at least 18 years old and capable of entering into a binding contract to create an account or place an order. A person under 18 may use the platform only through, and with the consent of, a parent or legal guardian who is responsible for that use.
We do not knowingly collect personal data from a person under 18 without a parent's or guardian's involvement. From 13 May 2027 section 9 of the DPDP Act will require verifiable consent of a parent or lawful guardian before a child's data is processed, and will ban tracking, behavioural monitoring and targeted advertising directed at children.
Transfers outside India
Some providers, such as Google for maps and notifications, may process data on servers outside India. We use them to provide the service and we will stop using a provider that the Government restricts under the law. We have not published a country-by-country list.
Cookies and tracking
The website sets no cookies and has no analytics or advertising trackers. See the Cookie Policy for the list of browser storage.
Complaints
Send a privacy complaint through the Grievance Redressal process. If you are not satisfied, from 13 May 2027 you will be able to complain to the Data Protection Board of India in the manner it notifies. The Board has been established but we are not aware of a complaint channel that is open yet, so we do not give an address for it.
Policy changes
We will update this policy when the law or our practices change. A change is shown by a new version number and review date at the top of the page, and we will tell you of a material change before it applies to you.
Contact information
Privacy questions can be sent to contact@zappmit.com, or by post to Bahina, Samannaya Palli, Mallarpur, Birbhum, West Bengal - 731216, India.
