DPDP Act 2023 Compliant Effective Date: 1 January 2026

Privacy Policy & Personal Data Notice

This Privacy Notice is issued by Pogakulas Technologies Private Limited ("SuperQR", "SuperQR.in", "we", "us", "Data Fiduciary") in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the Information Technology Act, 2000, and the applicable Digital Data Protection Rules.

Data Protection Principles We Uphold
Purpose Limitation: Processed only for specified loyalty & ordering purposes.
Data Minimization: Only necessary personal data (phone, name, table) collected.
Right to Erasure: You can request complete deletion of your records at any time.
Zero Child Profiling: We do not track or direct ads toward minors.

1. Identification of the Data Fiduciary

Under the DPDP Act, 2023, the entity determining the purpose and means of processing your digital personal data is:

Pogakulas Technologies Private Limited
Brand: SuperQR.in
Website: superqr.in
Corporate Address: Road No 36, Jubilee Hills, Hyderabad, Telangana - 500033, India
Grievance Email: [email protected]

2. Notice and Lawful Grounds for Processing

2.1. We collect and process personal data exclusively with your informed, clear, and affirmative Consent, or for specified legitimate uses recognized under Section 7 of the DPDP Act, 2023 (such as fulfilling requested food orders or complying with statutory tax/GST obligations).

2.2. Prior to or at the time of collecting your personal data, you are presented with clear itemized notice specifying what data is gathered and the explicit purpose for which it will be processed.

3. Categories of Personal Data Collected

In accordance with data minimization rules, we collect only the minimal data required to provide services:

  • Customer / Diner Data: Mobile phone number (for OTP verification and loyalty stamp accrual), customer name, visit timestamps, and active gift voucher codes.
  • Table Dining & Order Data: Selected food & beverage items, table numbers, order notes, and order settlement status.
  • Business Merchant Data: Merchant contact name, business registered name, outlet address, GST certificate (optional verification), and store phone number.
  • Technical & Session Data: IP address, device browser type, and essential security tokens (e.g. CSRF cookies) required for platform integrity.

Note: We do NOT store credit/debit card numbers, CVVs, or Net Banking credentials on our servers. All financial transactions are securely tokenized through RBI-authorized payment aggregators (e.g. Razorpay, UPI).

4. Specified Purpose of Processing

Your digital personal data is processed solely for:

  1. Registering your diner profile and tracking your visit stamp milestone progress;
  2. Generating and validating single-use gift discount vouchers for in-store redemption;
  3. Routing your table orders directly to the restaurant kitchen / cashier in real time;
  4. Sending transactional SMS or OTP alerts regarding your account security or vouchers;
  5. Preventing malicious fraud, duplicate stamp abuse, and platform security breaches.

5. Rights of the Data Principal (Under DPDP Act, 2023)

As a Data Principal residing in India or accessing services within India, you hold the following statutory rights under Chapter III of the DPDP Act, 2023:

1. Right to Access Information

You have the right to obtain a summary of your personal data processed by us and the identities of data fiduciaries with whom it has been shared.

2. Right to Correction & Erasure

You can request correction of inaccurate data, completion of incomplete data, or complete erasure of your personal data when no longer needed.

3. Right of Grievance Redressal

You have the right to readily accessible grievance redressal provided by our Data Protection Officer before escalating to the Data Protection Board of India.

4. Right to Nominate

You may nominate another individual who shall exercise your rights as a data principal in the event of death or incapacity.

To exercise any of these rights, you may submit a request from your Customer / Business Profile Settings or email our Grievance Officer at [email protected].

6. Processing Data of Children

In accordance with Section 9 of the DPDP Act, 2023, we do not undertake processing of personal data that is likely to cause any detrimental effect on the well-being of a child (individuals below 18 years of age). We strictly prohibit targeted advertising or behavioral tracking directed at minors.

7. Data Security Safeguards & Breach Management

7.1. We implement comprehensive physical, technical, and administrative controls (including 256-bit TLS/SSL encryption, Argon2/Bcrypt password hashing, database firewalls, and least-privilege access) to prevent unauthorized access or modification of personal data.

7.2. In the rare event of a personal data breach affecting your records, we maintain an established incident response protocol to notify both the Data Protection Board of India (DPBI) and impacted Data Principals in the prescribed manner and time form.

8. Data Retention & Erasure Policy

We retain personal data only for as long as necessary to satisfy the purpose for which it was gathered (e.g. keeping your loyalty stamps active for your next cafe visit), or to meet statutory tax/accounting compliance requirements. When you close your account or withdraw consent, all personal identifiers are securely expunged or anonymized from active production databases within 30 days.

9. Data Protection Officer & Grievance Redressal

Pursuant to Section 8(9) of the DPDP Act, 2023, we have designated an official Data Protection & Grievance Redressal Officer responsible for addressing data privacy concerns and questions:

Grievance Redressal Officer • SuperQR
Pogakulas Technologies Private Limited
Email: [email protected]
Address: Jubilee Hills, Hyderabad, Telangana - 500033, India
Response within 30 Days