Privacy

Privacy Policy

Last updated: 11 May 2026

The Belgian Waffle Xpress ("TBWX", "we") collects only what we need to deliver a hot waffle and update you about it. This policy follows the Digital Personal Data Protection Act, 2023 (DPDP).

1. Who we are

The Belgian Waffle Xpress operates this ordering app. We are the Data Fiduciary for orders placed here.

2. What we collect

  • Name + WhatsApp number — to confirm and update your order
  • Delivery address — only when you choose delivery; not stored otherwise
  • Order history — what you ordered, when, from which outlet
  • Location (optional) — only if you grant geo permission, used to pick the nearest outlet; not retained server-side
  • IP address + device info — captured in server logs for fraud and analytics, anonymised after 30 days

We do not collect: Aadhaar, PAN, biometrics, payment card numbers (Razorpay handles those directly), or any sensitive personal data.

3. Why we use it

  • To prepare and deliver your order
  • To send WhatsApp / SMS order status updates
  • To run the Waffle Coins loyalty programme
  • To process refunds within 24 hours of approval
  • Anonymous, aggregated analytics — never sold

4. Who we share it with

We share strictly what's needed with the following Data Processors:

  • Razorpay — name, phone, amount, order ID (payment processing)
  • Petpooja — first name, masked phone, items, address (POS at the outlet preparing your order)
  • Porter / Shadowfax — name, phone, drop address (delivery rider only — for delivery orders)
  • Meta (WhatsApp Cloud API) — phone number, to send order status messages
  • Hostinger — our VPS provider; logs are encrypted at rest

We never sell your data, and we never share it for third-party marketing.

5. How long we keep it

  • Delivery addresses: auto-purged after 90 days of inactivity
  • Full account / contact: deleted after 2 years of inactivity
  • Order records (anonymised): retained 7 years to meet GST requirements
  • IP / device logs: 30 days, then anonymised

6. Your rights under DPDP

  • Right to access — message us on WhatsApp with "MY DATA" and we'll send your records within 5 business days
  • Right to correct — same WhatsApp channel, ask for corrections
  • Right to erase — send "DELETE MY DATA" — we'll wipe everything except the anonymised order line items we're required to retain for tax
  • Right to grievance redressal — see Section 9
  • Right to nominate — you may nominate someone to exercise your rights on your behalf

7. Consent

We collect consent at the point of order. Marketing messages (offers, new drops) require a separate opt-in — you can decline the marketing checkbox at checkout and still place orders.

You may withdraw consent at any time by texting "STOP" on WhatsApp. Withdrawing consent for order processing means we can't keep filling orders, but it does not affect orders already placed.

8. Children

This service is not intended for users under 18. We do not knowingly collect data from children. If we learn we have, we will delete it promptly.

9. Grievance Officer

Email grievance@tbwxpress.com. We respond within 5 working days as required by DPDP.

If unresolved, you may complain to the Data Protection Board of India.

10. Cross-border transfer

Some processors (Meta, Razorpay) operate servers outside India. DPDP permits these transfers except to countries the Central Government has blacklisted.

11. Changes to this policy

We'll update the "last updated" date and message active customers on WhatsApp when this policy materially changes.