Resto
Return to Home
Digital Personal Data Protection Act, 2023 (DPDP Act) Compliant

Privacy Policy & Data Protection Notice

Last Updated: October 2026 • Effective Date: October 2026

1Introduction & Roles of Data Fiduciary vs Data Processor

This Privacy Notice describes how SiteKraft Technologies (“Company”, “we”, “our”, or “us”) processes personal data in connection with the Resto contactless table ordering and restaurant management platform.

Restaurant as Data Fiduciary: When diners scan a table QR code and place an order, the specific restaurant where dining takes place acts as the Data Fiduciary under Section 2(i) of the Digital Personal Data Protection Act, 2023. The restaurant determines the purpose and means of customer data collection.

Platform as Data Processor: SiteKraft Technologies operates strictly as a Data Processor under Section 2(k) of the DPDP Act, providing the technical infrastructure, kitchen dispatch queue, Google Sheets database synchronization, and electronic invoicing engine on behalf of the restaurant.

2Categories of Personal Data Processed

  • Diner Ordering Data: Table identification, items ordered, special culinary instructions, timestamps, and order status.
  • Contact Information (Optional): Customer mobile phone number or name when supplied for digital tax receipt generation or SMS/WhatsApp order status notifications.
  • Transaction & Billing Data: Payment method selected (cash, UPI, card), order subtotals, CGST/SGST amounts, and unique invoice numbers. Credit card numbers and UPI MPINs are never collected or stored on our servers.
  • Restaurant Staff & Administrator Data: Name, work email address, hashed credentials, and role assignments (Restaurant Admin, Staff, Super Admin).
  • Technical & Device Data: IP address, user agent, browser type, and PWA service worker cache tokens required to ensure reliable order transmission.

3Legal Grounds for Processing (DPDP Act, 2023)

We process personal data strictly pursuant to recognized lawful grounds:

Consent (Section 6)Voluntary provision of order details by the diner scanning the table QR code to facilitate dining preparation and service.
Legitimate Uses (Section 7)Statutory retention of tax invoices and GST records mandated by the Central Goods and Services Tax Act, 2017 (CGST Act).

4Data Retention & Storage Architecture

- Operational Order Logs: Active order tickets remain in real-time memory and Google Sheets storage for the duration of restaurant shifts.
- Tax Invoices & Receipts: Retained for the statutory minimum period required under Indian financial and tax law (up to 7 years) to satisfy official GST audit requirements.
- No Third-Party Monetization: We do not sell, rent, or trade customer contact numbers to third-party ad networks, telemarketers, or aggregators.

5Rights of Data Principals

Under Chapter III of the DPDP Act, 2023, data principals (both restaurant customers and platform operators) possess the following statutory rights:

Right to Access: Request a summary of personal data being processed.
Right to Correction & Erasure: Rectify inaccurate records or request deletion subject to statutory tax retention exemptions.
Right of Grievance Redressal: Submit grievances regarding data handling directly to our designated officer.
Right to Nominate: Designate an individual to exercise rights in event of death or incapacity.

Grievance Redressal Officer (DPDP Act Compliance)

In accordance with the DPDP Act, 2023, any privacy complaints, requests for data access, or inquiries should be directed to our appointed Grievance Officer:

Designation: Data Protection & Compliance Lead
Officer Name: Grievance Redressal Officer
Entity: SiteKraft Technologies
Address: SiteKraft Technologies, Cyber City, Gurugram, HR, India