Privacy Policy

The Digital Personal Data Protection Act, 2023 and Rules, 2025 are being brought into force in stages. Most duties on organisations such as Zappmit start on 14 May 2027. Until then, section 43A of the Information Technology Act, 2000 and the 2011 Reasonable Security Practices and Sensitive Personal Data Rules continue to apply. Where this policy describes a DPDP duty, it says when that duty starts, and it does not present a future duty as already in force.

Who is responsible for your data

Zappmit LLP, with its registered office at Bahina, Samannaya Palli, Mallarpur, Birbhum, West Bengal - 731216, India, decides why and how personal data is processed through the Zappmit website and apps. In the language of the Digital Personal Data Protection Act, 2023 it is the Data Fiduciary. A merchant or service provider decides for itself how it uses data it holds outside the platform.

The law and when it applies

Two regimes matter. Today, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply to Zappmit. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are being brought in on a timetable. This table shows what has and has not started.

This policy describes what Zappmit does today and marks a DPDP duty as a future duty until it starts. The dates come from the Government's Gazette notifications of 14 November 2025. A change to them would be reflected here.

Data collected through this website

• Contact form and email. If you use the contact form we collect your name, your email address and your message. The website passes them to the Zappmit API, which saves them so we can reply. Together with your message the website sends the API your IP address and browser identifier, to help prevent abuse. The form also asks you to answer a security check, which is verified on our own server. If you email us instead, we receive your message and the address it came from, and we use them to reply to you.
• Complaints by email. The online grievance form is not open yet. If you email the Grievance Redressal Officer we receive your message and the address it came from, and we use them to reply. Do not put passwords, OTPs or card details in a complaint.
• Server records. Our server receives your IP address and browser details each time you request a page. These are held in system logs for security and operation.
• Browser storage and cookies. For ordinary visitors the website sets no cookies. It stores your sign-in token, your chosen delivery location, a guest basket and a pending-payment reference in browser storage, as the Cookie Policy lists. Apart from the sign-in token, which accompanies your requests to the Zappmit API, these stay in your browser. The one exception is a short-lived cookie used only by the payment test page described below.
• Payment test page (not for customers). The website contains a test page that lets authorised verifiers check our payment gateway connection in the gateway's sandbox. It is not part of ordering: it creates no order, takes a fixed test amount of ₹10.00, uses placeholder details rather than yours, and moves no real money. It asks for an access code that is given only to those verifiers. When the code is accepted the website sets one cookie, described in the Cookie Policy, and keeps a record of the test attempt on its own server. Do not enter real card, UPI or bank details there.
• Payment hand-off. When online payment is enabled and you pay, the website passes you to the payment provider's own page. We do not see or store your card, UPI or bank credentials.

Customer data in the apps

The customer app does not currently use an analytics service. If that changes we will update this policy before it does.

Merchant data

For merchants and service providers we collect business and owner identity details, business address, GST and PAN details where applicable, licence and registration numbers and copies, including an FSSAI licence for food businesses, bank account details for settlement, and the content of listings such as menus, prices and photos. We use these to verify and onboard you, to display the information customers are entitled to see, to pay you, to issue and keep tax documents, and to meet our legal duties. The Merchant Terms explain what is shown to customers.

Rider data

For riders we collect identity and contact details, identity and vehicle documents (which may include a photograph), bank account details for payouts, emergency contact details you choose to give, live location while you are available or on a delivery, and photos and codes captured as proof of delivery. We use these to verify you, assign and track orders, pay you, protect customers and riders, investigate incidents and meet our legal duties.

Sensitive personal data

Under the 2011 Rules, sensitive personal data includes passwords and financial information such as bank account and payment details. We collect it only for the purposes above, with your consent where the Rules require it, and we do not store your card or UPI credentials, which stay with the payment provider.

Purposes of processing

We process personal data to run the platform. That includes creating accounts, fulfilling orders and bookings, processing payments and refunds, coordinating delivery, supporting customers, preventing fraud, keeping the platform secure, meeting legal, tax and accounting duties, and improving the service.

Consent and other grounds

Today we rely mainly on what is needed to provide a service you have asked for, such as sharing your address with the rider who delivers your order. The customer app does not yet show this policy at sign-up or record your acceptance of it, and the merchant and rider apps show the policy links without storing a record of acceptance. Zappmit is building that capture. From 14 May 2027 the DPDP Act will require a notice with each consent request that itemises the data and the purpose, says how to withdraw consent, how to exercise your rights and how to complain to the Data Protection Board, and that is available in English and any of the 22 scheduled languages as per the user's choice. Consent will have to be free, specific, informed and given by a clear action. It will not be bundled with unrelated purposes. Zappmit is preparing the in-app notices and consent screens for that date.

Who we share data with

These recipients may use the data only for the purposes given, under our contract with them or their own terms. We will update this list when providers change.

Parcel recipients and tracking links

When a customer books a parcel, we collect the recipient's name, phone number and address from the sender. The recipient can follow the parcel through a link that contains a secret token, and the page may show the delivery code and the rider's live location for that parcel. Anyone with the link can see that page, so senders should share it only with the recipient. The sender is responsible for having the recipient's details lawfully.

Messages from us

Service messages such as OTPs, order updates and delivery updates are sent because you use the service. This website sends no promotional messages. Any promotional message or call from us would have to follow the Telecom Commercial Communications Customer Preference Regulations, 2018, as amended, which require, among other things, a registered sender, your recorded consent and an option to opt out.

Data retention

We keep personal data only as long as needed for the purposes above and for legal duties. The retention periods we can state today are these.

• Photos captured as proof of delivery are kept on the live server for 72 hours by default, and a backup copy is kept. No end date has been set for the backup copy.
• Contact-form messages, grievances with their history and notifications, and rider location history are currently kept with no deletion date, because no purge has been built for them and the period has not been decided.
• Tax and accounting records, including invoices and credit notes, are kept for the period the tax and company-law rules require.
• The CERT-In Directions of 28 April 2022 require system logs to be kept for a rolling 180 days within India. From 14 May 2027, Rule 8(3) of the DPDP Rules will require certain personal data and logs to be kept for at least one year. Zappmit has not yet evidenced that its logs are kept for those periods.

Security safeguards

We apply technical and organisational safeguards that are reasonable for the data we hold, including role-based access controls for staff, storing bank account numbers in encrypted form, and secure connections to our servers. Staff views and downloads of identity documents are not yet recorded in an audit log. No system is completely secure. We do not claim a security certification such as ISO 27001. The 2011 Rules treat compliance with ISO 27001 or an equivalent standard as one way to show reasonable security, and a decision on whether to adopt one is pending. From 14 May 2027 Rule 6 of the DPDP Rules will set minimum safeguards, such as encryption or masking, access control, logging and monitoring, backups and contracts with processors.

Security incidents and breaches

The CERT-In Directions of 28 April 2022 require Zappmit to report listed cyber incidents to CERT-In within six hours of noticing them. From 14 May 2027 Rule 7 of the DPDP Rules will also require us to tell each affected person without delay and the Data Protection Board without delay, with a detailed report to the Board within 72 hours, unless it allows more time. We will follow these duties as they apply.

Your rights

Today you can ask to review the personal data you gave us and to have it corrected, and you can withdraw consent you gave, by writing to us. From 14 May 2027 the DPDP Act will give you the right to access a summary of your data, to correct and update it, to have it erased, to have your grievance addressed and to nominate another person to exercise your rights if you die or cannot do so yourself. We will respond within the time the law sets, which for a grievance is 30 days.

Withdrawing consent

You may withdraw consent you gave. It will not affect processing already done. Withdrawal may mean we can no longer provide a feature that needs the data, and we may still need to keep data the law requires us to keep. Write to contact@zappmit.com to withdraw. From 14 May 2027 withdrawing will have to be as easy as giving consent, and Zappmit is preparing a strictly self-service in-app control for that.

Correction and deletion

You can update some account details in the app. At present, to have your account or data deleted or corrected beyond that, write to contact@zappmit.com from the email or number registered to your account so that we can confirm it is you. We will review the request and delete what we are not required or permitted to keep.

Children's data

You must be at least 18 years old and capable of entering into a binding contract to create an account or place an order. A person under 18 may use the platform only through, and with the consent of, a parent or legal guardian who is responsible for that use.

We do not knowingly collect personal data from a person under 18 without a parent's or guardian's involvement. From 14 May 2027 section 9 of the DPDP Act will require verifiable consent of a parent or lawful guardian before a child's data is processed, and will ban tracking, behavioural monitoring and targeted advertising directed at children.

Transfers outside India

Some providers, such as Google for maps and notifications, may process data on servers outside India. We use them to provide the service and we will stop using a provider that the Government restricts under the law. We have not published a country-by-country list.

Cookies and tracking

For ordinary visitors the website sets no cookies, and it has no analytics or advertising trackers. The only cookie it can set is a short-lived, essential one for the payment test page, and only after an authorised verifier enters the access code. See the Cookie Policy for that cookie and for the list of browser storage.

Significant Data Fiduciary (SDF) Classification

While Zappmit LLP is currently a standard Data Fiduciary, if designated as a Significant Data Fiduciary (SDF) by the government, Zappmit will appoint an India-based Data Protection Officer (DPO), an Independent Data Auditor, and conduct periodic Data Protection Impact Assessments (DPIAs) and independent audits as prescribed under the DPDP Act.

Complaints

Send a privacy complaint through the Grievance Redressal process. If you are not satisfied, from 14 May 2027 you will be able to complain to the Data Protection Board of India in the manner it notifies. The Board has been established but we are not aware of a complaint channel that is open yet, so we do not give an address for it.

Policy changes

We will update this policy when the law or our practices change. A change is shown by a new version number and review date at the top of the page, and we will tell you of a material change before it applies to you.

Contact information

Privacy questions can be sent to contact@zappmit.com, or by post to Bahina, Samannaya Palli, Mallarpur, Birbhum, West Bengal - 731216, India.