Privacy Policy

This policy explains how [Registered legal entity name] handles personal data when you visit this website, when a hospitality business uses the MYDIX platform, and when a guest uses the browser-based guest experience.

Our role differs depending on whose data it is:

• Website visitors and enquiries — we decide why and how your data is used, so we act as the data fiduciary (controller).
• Partner and staff accounts — we act as data fiduciary for the account relationship, billing and support.
• Guest data — the property decides why guest data is collected and used. We process it on the property's instructions, as a data processor acting on their behalf.

If you are a guest and want your data corrected or erased, the property you ordered from is the right first point of contact. We will support them in responding.

• Enquiry data — name, business or property name, business type, mobile number, business email and city, submitted through the demo, onboarding or contact forms.
• Account data — property details, staff names, roles and login credentials.
• Operational data — orders, service requests, locations such as room or table, kitchen notes and order history.
• Guest-provided data — whatever a guest submits when ordering or raising a request at a property.
• Payment-related data — transaction references and status. Card and UPI credentials are handled by the payment gateway, not by us.
• Technical data — IP address, browser user agent, and timestamps, recorded with form submissions for security and abuse prevention.

• To respond to demo requests, onboarding requests and contact enquiries.
• To provide, operate, secure and support the platform.
• To process subscription billing and maintain records required by tax law.
• To prevent spam, fraud and abuse of our forms and services.
• To comply with legal and regulatory obligations.

We rely on your consent where the law requires it, on the performance of our contract with you, and on our legitimate interests in operating and securing the service. We do not sell personal data.

• The property you interacted with, where you are a guest.
• Payment gateway (Razorpay), where online payment is enabled, under the property's own gateway agreement.
• Hosting and infrastructure providers engaged to run the platform.
• Professional advisers and authorities, where disclosure is required by law or to establish or defend legal claims.

Service providers are engaged under terms that restrict them to processing data on our instructions.

We keep personal data only as long as needed for the purpose it was collected for, and then for any period required by law — for example, tax and accounting records. Indicative periods: enquiry records [retention period], account and operational records [retention period], and statutory financial records for the period prescribed by applicable law.

We apply reasonable technical and organisational measures to protect personal data, including role-based access control, access scoped to the outlets a staff member works in, encrypted transport, and restricted administrative access. No system can be guaranteed completely secure.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may request access to your personal data, correction of inaccurate data, erasure, withdrawal of consent, and a summary of processing. You may also nominate another individual to exercise your rights in the event of death or incapacity.

To exercise a right, contact our Grievance Officer using the details below. We may need to verify your identity before acting on a request.

Full detail on the cookies this website sets, what each one does, and your choices is in the Cookie Policy. In summary, the site currently uses only the cookies strictly necessary to run it — nothing used for analytics, advertising or cross-site tracking.

The platform is intended for use by businesses and by adult guests. We do not knowingly collect personal data of children except as permitted by law and with the verifiable consent required under applicable regulation.

In accordance with applicable Indian law, the Grievance Officer for data protection matters is:

• Name: [Grievance Officer name]
• Email: [grievance@yourdomain.com]
• Address: [Registered office address]

We aim to acknowledge grievances promptly and to resolve them within the period prescribed by applicable law.

We may update this policy as the platform or the law changes. The date at the top of this page shows when it was last revised.