Privacy Policy
Thapala Box Private Limited
Last Updated: July 8, 2026
1. Introduction
Thapala Box Private Limited ("ThapalaBox," "Company," "we," "us," or "our"), a company incorporated under the Companies Act, 2013, bearing CIN: U49231TS2025PTC198633, with its registered office at 2-110, Chintha Nekkonda, Parvathagiri, Warangal – 506122, Telangana, India, operates the website thapalabox.com and associated mobile applications (collectively, the "Platform").
This Privacy Policy describes how we collect, use, store, share, and protect your personal data when you access or use our Platform and services, including food delivery and grocery delivery services (collectively, the "Services").
This Privacy Policy is published in compliance with:
- The Digital Personal Data Protection Act, 2023 ("DPDPA")
- The Information Technology Act, 2000 ("IT Act")
- The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
By accessing our Platform or using our Services, you consent to the collection, use, and processing of your personal data as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Platform or Services.
2. Definitions
- "Data Principal" means the individual to whom the personal data relates (i.e., you, the user).
- "Data Fiduciary" means Thapala Box Private Limited, which determines the purpose and means of processing personal data.
- "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
- "Processing" means any operation performed on personal data, including collection, storage, use, sharing, and deletion.
- "Consent Manager" means a person registered with the Data Protection Board who acts as a single point of contact for the Data Principal to manage consent.
3. Personal Data We Collect
3.1 Information You Provide Directly
- Account Information: Full name, email address, mobile phone number, date of birth, gender
- Delivery Addresses: Home address, office address, and any other saved delivery locations
- Payment Information: UPI ID, debit/credit card details (processed through PCI-DSS compliant payment gateways — we do not store full card numbers), wallet information, bank account details for refunds
- Identity Verification: For delivery partners — PAN card, Aadhaar number, driving license, vehicle registration details
- Order Information: Items ordered, delivery instructions, special requests, order preferences
- Communication: Messages, feedback, reviews, ratings, support tickets, and any correspondence with us
3.2 Information Collected Automatically
- Device Information: Device type, operating system, unique device identifiers, browser type and version, mobile network information
- Location Data: Real-time GPS location (with your permission), IP-based approximate location, delivery tracking coordinates
- Usage Data: Pages visited, features used, search queries, order history, browsing patterns, time spent on the Platform
- Log Data: Server logs including IP address, access times, referring URLs, error logs
- Cookies and Tracking: Cookies, pixel tags, web beacons, and similar technologies (see our Cookie Policy for details)
3.3 Information from Third Parties
- Payment Processors: Transaction status, payment confirmation
- Restaurant and Grocery Partners: Order fulfillment status, menu/product updates
- Delivery Partners: Delivery status, location during active deliveries
- Social Media Platforms: If you register or log in through a social media account, we may receive your public profile information
- Analytics Providers: Aggregated usage data from third-party analytics tools
4. Purpose of Data Collection
We process your personal data for the following purposes:
| Purpose |
Legal Basis (DPDPA) |
| To create and manage your user account | Consent |
| To process and fulfill your orders (food, grocery) | Performance of contract / Legitimate use |
| To facilitate payment processing and refunds | Performance of contract |
| To provide real-time order and delivery tracking | Consent / Legitimate use |
| To communicate order updates, delivery status via SMS, email, push notifications | Performance of contract |
| To provide customer support and resolve disputes | Legitimate use |
| To personalize your experience and show relevant recommendations | Consent |
| To send promotional offers, discounts, and marketing communications | Explicit consent (opt-in) |
| To improve our Platform, Services, and user experience through analytics | Legitimate use |
| To detect, prevent, and address fraud, abuse, and security incidents | Legitimate use / Legal obligation |
| To comply with applicable laws, regulations, and legal processes | Legal obligation |
| To enforce our Terms and Conditions | Legitimate use |
5. Consent
5.1 How We Obtain Consent
- We obtain your free, specific, informed, unconditional, and unambiguous consent before collecting and processing your personal data.
- Consent is obtained through clear affirmative action (e.g., checking a consent box, clicking "I Agree," or registering an account).
- For sensitive data (payment information, location data), we obtain explicit, specific consent.
- For marketing communications, we use an opt-in mechanism. You can opt out at any time.
5.2 Withdrawal of Consent
- You may withdraw your consent at any time by contacting us at admin@thapalabox.com or through your account settings.
- Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
- Withdrawal of consent may result in the inability to provide certain Services (e.g., withdrawing location consent will prevent real-time delivery tracking).
- Upon withdrawal, we will cease processing your data for the specified purpose and delete it within a reasonable timeframe, unless retention is required by law.
6. Data Storage and Security
6.1 Storage Location
Your personal data is stored on secure servers located in India, in compliance with the data localization requirements of the DPDPA and IT Act. We use reputable cloud service providers who maintain industry-standard security certifications.
6.2 Security Measures
We implement reasonable security practices and procedures as required under Section 8 of the DPDPA and Rule 8 of the SPDI Rules, including:
- Encryption of data in transit (TLS/SSL) and at rest (AES-256)
- Access controls and role-based permissions
- Regular security audits and vulnerability assessments
- Secure payment processing through PCI-DSS compliant gateways
- Multi-factor authentication for internal systems
- Regular employee training on data protection and security
- Incident response procedures for data breach management
- Firewalls, intrusion detection, and monitoring systems
6.3 Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
| Data Type |
Retention Period |
| Account information | Duration of account + 3 years after deletion |
| Order history | 8 years (as per tax/accounting requirements) |
| Payment transaction records | 8 years (as per RBI and tax regulations) |
| Location data | 6 months from collection |
| Customer support records | 3 years from resolution |
| Marketing preferences | Until consent is withdrawn |
| Server logs | 90 days |
| Cookie data | As specified in Cookie Policy |
After the retention period, data is securely deleted or anonymized.
7. Data Sharing and Disclosure
7.1 Service Providers and Partners
We may share your personal data with the following categories of third parties, strictly for the purposes described:
- Restaurant and Grocery Partners: Your name, delivery address, order details, and contact number (to fulfill your order)
- Delivery Partners: Your name, delivery address, phone number, and order details (to complete the delivery)
- Payment Processors: Transaction data necessary to process payments (e.g., Razorpay, PayU, etc.)
- Cloud Hosting Providers: Data stored on secure cloud infrastructure
- Analytics Providers: Anonymized or aggregated usage data for Platform improvement
- Customer Support Tools: Data necessary to resolve your queries
- SMS and Email Service Providers: Contact details for transactional and promotional communications
7.2 Legal Disclosures
We may disclose your personal data if required to do so by law or if we believe in good faith that such disclosure is necessary to:
- Comply with a legal obligation, court order, or government request
- Protect and defend the rights, property, or safety of ThapalaBox, our users, or the public
- Detect, prevent, or address fraud, security, or technical issues
- Enforce our Terms and Conditions
7.3 Business Transfers
In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity. We will provide notice before your data is transferred and becomes subject to a different privacy policy.
7.4 No Sale of Data
We do not sell, rent, or trade your personal data to third parties for their marketing purposes.
8. Your Rights Under DPDPA 2023
As a Data Principal, you have the following rights:
8.1 Right to Access Information
You have the right to obtain a summary of your personal data being processed by us and the processing activities undertaken.
8.2 Right to Correction and Erasure
You have the right to:
- Correct inaccurate or misleading personal data
- Complete incomplete personal data
- Request erasure of your personal data that is no longer necessary for the purpose for which it was collected
8.3 Right to Grievance Redressal
You have the right to have readily available means of grievance redressal provided by us in respect of any act or omission regarding your personal data.
8.4 Right to Nominate
You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights.
8.5 How to Exercise Your Rights
To exercise any of the above rights, contact us at:
- Email: admin@thapalabox.com
- Postal Address: Data Protection Officer, Thapala Box Private Limited, 2-110, Chintha Nekkonda, Parvathagiri, Warangal – 506122, Telangana
We will respond to your request within 30 days.
9. Children's Privacy
Our Platform and Services are not intended for individuals under the age of 18 years. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete such data promptly.
As required under Section 9 of the DPDPA, processing of personal data of children requires verifiable consent from their parent or lawful guardian. We have implemented age-gating mechanisms to prevent collection of children's data.
10. Data Breach Notification
In the event of a personal data breach that is likely to cause harm to the Data Principal, we will:
- Notify the Data Protection Board of India as required under the DPDPA
- Notify affected Data Principals without unreasonable delay
- Take immediate steps to mitigate the effects of the breach
- Maintain records of all data breaches, including the facts, effects, and remedial actions taken
11. Grievance Officer
In accordance with Section 11 of the DPDPA and the IT Act 2000, we have appointed a Grievance Officer:
- Name: Sai Vusirikapally
- Designation: Grievance Officer
- Email: admin@thapalabox.com
- Phone: +91 7702613638
- Address: Thapala Box Private Limited, 2-110, Chintha Nekkonda, Parvathagiri, Warangal – 506122, Telangana
The Grievance Officer will address your concerns within 30 days of receiving the complaint. If your grievance is not resolved satisfactorily, you may file a complaint with the Data Protection Board of India established under the DPDPA.
12. Third-Party Links
Our Platform may contain links to third-party websites, apps, or services that are not operated by us. We are not responsible for the privacy practices of such third parties. We encourage you to read the privacy policies of every website you visit.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will:
- Post the updated Privacy Policy on this page with a revised "Last Updated" date
- Notify you of material changes via email or a prominent notice on our Platform
- Where required by law, obtain your consent to the updated Privacy Policy
Your continued use of the Platform after the changes become effective constitutes your acceptance of the revised Privacy Policy.
14. Governing Law
This Privacy Policy shall be governed by and construed in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and any rules and regulations made thereunder. Any disputes arising from this Privacy Policy shall be subject to the exclusive jurisdiction of the courts at Warangal, Telangana.
15. Contact Us
Thapala Box Private Limited
2-110, Chintha Nekkonda, Parvathagiri, Warangal – 506122, Telangana