This Privacy Policy ("Policy") explains how Loyal Hospitality Private Limited ("LHPL") and Loyal Hospitality Kitchens Private Limited ("LHKPL") (together, "we", "us" or "our") collect, use, share, store and protect personal data, and how you can exercise your rights. It is issued under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules").
This Policy applies to:
customers who order food from our brands through the Flickit app, our website, or third-party platforms such as Swiggy or Zomato;
delivery partners engaged by LHKPL;
employees of LHPL and LHKPL;
job applicants;
visitors to our website, kitchens, hubs and offices, including persons recorded on CCTV;
vendors, suppliers, restaurant partners and other business partners, and their contact persons; and
anyone else who contacts us.
In this Policy, "you" means the individual whose personal data we process (a "Data Principal" under the DPDP Act). "Platform" means our website (kitchens-at.com), the Flickit mobile application, the delivery partner application, and related digital services.
Where we rely on your consent, we ask for it separately, in clear and plain language, and you can withdraw it at any time.
1. Who we are and who is responsible for your data
LHPL and LHKPL are group companies that share one website. Each is a separate Data Fiduciary for the personal data it collects.
| LHPL | LHKPL | |
|---|---|---|
| Full name | Loyal Hospitality Private Limited | Loyal Hospitality Kitchens Private Limited |
| CIN | U55101KA2014PTC076418 | U55208KA2020PTC137078 |
| Registered office | No. 13, 6th Floor, Cumulus, Prestige Tech Cloud, Navarathna Agrahara Village, Sadahalli Gate, Bengaluru, Karnataka 562110, India | Same as LHPL |
| Telephone and email | 9606888803 · info@loyalhospitality.in | 9606888803 · info@loyalhospitality.in |
The company responsible for your data depends on your relationship with us:
| If you are | Your Data Fiduciary is |
|---|---|
| A customer ordering through Flickit | LHKPL |
| A delivery partner | LHKPL |
| An employee or job applicant | The company that employs you, or to which you applied |
| A website visitor or person making an enquiry | LHPL or LHKPL, depending on the service you use |
| A person recorded on CCTV | The company that operates the kitchen, hub or office |
| A vendor, supplier or restaurant partner | The company you have contracted with |
LHPL and LHKPL share personal data with each other only where needed for the purposes in this Policy, such as shared administration, IT, accounts and HR services. Both companies follow this Policy.
2. Personal data we collect and why
We collect only the personal data needed for the purposes listed below, and use it only for those purposes.
2.1 Flickit customers (LHKPL)
| Personal data | Purpose |
|---|---|
| Mobile number | Creating your account and logging you in by one-time password (OTP); order updates; customer support |
| Name | Identifying you for delivery and support |
| Delivery address and the map location you select | Delivering your order; checking delivery availability and time |
| Delivery instructions (such as leave at the door, hand over to security, or do not ring the bell) and your choice of payment, including Cash on Delivery | Delivering your order as you prefer |
| Order history, ratings and feedback | Processing, tracking and refunding orders; resolving complaints; tax records; improving our food and service |
| Payment details (payment method, transaction reference, amount and status) | Processing payments and refunds through our payment gateway. We do not store your full card number, CVV or UPI PIN. |
| Device and usage data (device type, app version, IP address, crash and usage logs) | Security, fraud prevention, fixing errors, and in-house analytics |
| Your marketing preference | Sending promotional SMS, WhatsApp and email messages, only if you consent |
If you order from our brands through a third-party platform such as Swiggy or Zomato, we receive your name, delivery address and order details from that platform, only to prepare your order, deliver it where applicable, and handle any complaint. That platform’s privacy policy also applies to the data it collects.
2.2 Delivery partners (LHKPL)
| Personal data | Purpose |
|---|---|
| Name, date of birth, gender, photograph, mobile number and address | Onboarding, identification and communication |
| Aadhaar number, PAN, driving licence, identity and address proof, and vehicle documents where applicable | Identity verification; registration with the Karnataka Platform Based Gig Workers Welfare Board; compliance with law |
| Background and police verification results, if any | Safety of customers, staff and the public |
| Bank account details (including Aadhaar-linked account) and e-Shram UAN | Payouts; Welfare Board registration; welfare fee records |
| Real-time location, only while logged in to the app | Order allocation, navigation, delivery tracking and emergency (SOS) support |
| Orders, earnings, incentives, deductions, ratings and performance records | Payouts and invoices; answering your requests under the Karnataka Platform Based Gig Workers (Social Security and Welfare) Act, 2025; grievances |
| Nominee’s name, phone number, address and bank details, and accident and insurance claim records | Personal accident insurance, claims, and support to your nominee or legal heirs |
| Grievance, Internal Dispute Resolution Committee and harassment complaint records | Handling grievances and complaints as required by law |
We do not track your location when you are logged out of the app.
Please inform your nominee that you have shared their details with us.
2.3 Employees (LHPL and LHKPL)
| Personal data | Purpose |
|---|---|
| Name, mobile number, email address and residential address | Employment administration, communication, payroll and HR |
| Information required by law, such as PAN, bank account, and PF and ESI details, where applicable | Salary, tax, social security and other statutory compliance |
2.4 Job applicants
| Personal data | Purpose |
|---|---|
| Your CV and the details in it (name, contact details, education and work history) | Assessing your application and contacting you |
Please do not include your Aadhaar number, health information or other unnecessary personal details in your CV.
2.5 Website visitors and enquiries
| Personal data | Purpose |
|---|---|
| Name, contact details and your message | Responding to your enquiry |
| IP address, browser type and cookie data | Running the website securely and preventing misuse |
2.6 CCTV at our kitchens, hubs and offices
| Personal data | Purpose |
|---|---|
| Images and video of persons on our premises | Safety and security, food safety and hygiene, preventing crime, and investigating incidents |
Signs are displayed wherever CCTV is in use. CCTV is not installed in washrooms or changing areas, and footage is not used for any other purpose.
2.7 Vendors, suppliers and restaurant partners (LHPL and LHKPL)
| Personal data | Purpose |
|---|---|
| Name, designation, phone number and email address of contact persons | Contracts, Communication, onboarding and managing the business relationship |
| For Entities, individuals and sole proprietors: PAN, GSTIN, bank account details, Certificate of Incorporation, FSSAI licence and other KYC documents | Contracts, payments, tax compliance and food safety compliance, obtaining Licenses |
3. Consent and other lawful grounds
Consent. Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, given by a clear action such as ticking a box or tapping "Agree", and limited to the data needed for the stated purpose. We rely on consent for, among other things, creating your Flickit account, processing a delivery partner's onboarding data, and sending promotional messages.
Other lawful grounds. Under Section 7 of the DPDP Act, we may process personal data without separate consent:
where you voluntarily give it to us for a specific purpose, such as placing an order or sending an enquiry, and have not objected;
for employment purposes, including safeguarding our premises and preventing loss;
to comply with law, a court order or a government direction, including registration and reporting under the Karnataka Platform Based Gig Workers (Social Security and Welfare) Act, 2025, and tax and labour laws; and
to respond to a medical emergency or ensure safety during a disaster or breakdown of public order.
Withdrawing consent. You can withdraw consent as easily as you gave it: through the settings in the app (as applicable for such person/s), or by writing to our IT Grievance Officer (Section 11). Withdrawal does not affect processing already done. Once you withdraw, we and our service providers stop processing the data within a reasonable time, unless the law requires us to keep it. If you withdraw consent for data that is essential to a service, we may no longer be able to provide that service to you.
Promotional messages. We send promotional SMS, WhatsApp and email messages to Flickit customers. You can opt out at any time by replying STOP, using the unsubscribe link, changing your app settings, or writing to our IT Grievance Officer. Order-related messages such as OTPs and delivery updates will continue.
Consent Managers. Where available, you may give, manage, review and withdraw your consent through a Consent Manager registered with the Data Protection Board of India.
4. Who we share your data with
We do not sell your personal data. We share it only as set out below, and only as much as each purpose needs.
| Recipient | Data shared | Purpose |
|---|---|---|
| Razorpay (payment gateway) | Payment and transaction details | Processing payments and refunds |
| Sinch India (messaging) | Mobile number and message content | Sending OTPs, order updates and, with consent, promotional messages |
| Xencia Technologies (cloud hosting) | Data stored on our Platform | Hosting and running the Platform |
| Google (Google Maps Platform) | Addresses and location data | Maps, address search and navigation |
| Delivery partners | Customer's name, delivery address, phone number and order details | Delivering the order |
| Customers | Delivery partner's name and live location during an active order | Tracking the order |
| The Oriental Insurance Company Limited and Hero Insurance Broking India Private Limited | Delivery partner's name, age, address, nominee details and claim information | Personal accident insurance and claims |
| Background verification agencies and the police, if any | Delivery partner's identity documents and details | Background and police verification |
| Karnataka Platform Based Gig Workers Welfare Board, including its Payment and Welfare Fee Verification System | Delivery partner's registration details, payouts and welfare fee records | Compliance with the Karnataka Platform Based Gig Workers (Social Security and Welfare) Act, 2025 |
| Banks | Bank account details | Salaries, payouts and vendor payments |
| Tax, labour and social security authorities (such as Income Tax, GST, EPFO and ESIC) | Data required by law | Statutory compliance |
| Courts, law enforcement and regulators | Data required by law or court order | Legal obligations |
| Auditors, lawyers and other professional advisers | Data needed for their work, under confidentiality | Audits, legal advice and compliance |
| LHPL and LHKPL (each other) | Data needed for shared services | Administration, IT, accounts and HR |
Our service providers act as Data Processors. They process personal data only on our instructions, under obligations that require them to keep it secure and to delete it when it is no longer needed.
5. Where your data is stored
Personal data on our Platform is hosted by Xencia Technologies on servers hosted in India only on Microsoft Azure cloud. Xencia is our service provider for this.
Some service providers, such as Google, may process personal data outside India. Any such transfer is made only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and the same safeguards described in this Policy apply.
6. How long we keep your data
We keep personal data only as long as the purpose needs, or as long as the law requires, and then erase it.
| Data | How long we keep it |
|---|---|
| Flickit customer account data | While your account is active. If you do not use your account for 3 years, we erase your data, after notifying you at least 48 hours in advance. |
| Order, invoice and payment records | 8 years, as required under tax and company laws |
| Delivery partner records | During the engagement and for 3 years after it ends, or longer if required under the Karnataka Gig Workers Act, tax laws, or for a pending claim or dispute |
| Delivery partner location data | 1 year |
| Employee records | During employment and for 8 years after it ends, or longer if required under labour, tax or social security laws |
| Job applicant CVs | 12 months from the date of application, unless you join us |
| Vendor and partner records | During the contract and for 8 years after it ends, as required under tax and company laws |
| CCTV footage | 20 days, unless needed to investigate an incident, for a legal claim, or at an authority’s request |
| System and processing logs | At least 1 year, as required by the DPDP Rules |
When a retention period ends, we erase the data and instruct our service providers to do the same, unless the law requires us to keep it.
7. How we protect your data
We take reasonable security safeguards to prevent personal data breaches, including:
encryption, masking or tokenization of personal data where appropriate, including Aadhaar numbers and payment data;
access limited to staff and service providers who need it, with access controls and confidentiality obligations;
logs and monitoring to detect and investigate unauthorized access;
regular backups to keep data available; and
Obligations requiring our service providers to maintain similar safeguards.
If a breach happens. If a personal data breach occurs, we will inform affected individuals without delay. We will tell you what happened, when, its likely impact on you, what we are doing about it, the steps you can take to protect yourself, and whom to contact. We will also inform the Data Protection Board of India without delay, and send it a detailed report within 72 hours.
8. Your rights
Under the DPDP Act, you have the right to:
Access a summary of your personal data we process, how we process it, and the identities of other Data Fiduciaries and Data Processors we have shared it with, with a description of what was shared;
Correct, complete or update your personal data;
Erase your personal data, unless we must keep it to comply with law;
Withdraw consent at any time (Section 3);
Grievance redressal for any concern about how we handle your data (Section 11); and
Nominate one or more persons to exercise these rights on your behalf in the event of your death or incapacity.
How to exercise your rights. Use the help section of the app, or write to our IT Grievance Officer (Section 11). We may ask you to verify your identity before acting on a request. We will respond within 30 days, and in any case within 90 days.
Delivery partners also have the right, under the Karnataka Platform Based Gig Workers (Social Security and Welfare) Act, 2025, to seek information on how our systems decide on fares, earnings, ratings and customer feedback that affect them. Such requests can be made and are answered within 5 working days.
Your duties. Under Section 15 of the DPDP Act, you must give us accurate information, must not impersonate another person, and must not file false or frivolous complaints. Breach of these duties can attract a penalty of up to ₹10,000.
9. Children
Only persons aged 18 or above may use Flickit, work as delivery partners, or be employed by us. We do not knowingly collect personal data of anyone under 18. If we learn that we have, we will erase it. If you believe a child has given us personal data, please contact our IT Grievance Officer.
10. Cookies, social media, account security and other websites
Cookies. Our website uses cookies that are necessary for it to work securely. Analytics or other non-essential cookies, if any, are used only with your consent. You can block or delete cookies in your browser settings, but some parts of the website may then not work.
Social media. We operate pages on social media sites to engage with customers, and we review comments and posts about us to improve our services. Please do not share sensitive information, such as identity numbers, financial details or health information, with us through social media. We are responsible only for our own use of information we receive through these sites.
Account security. Flickit uses OTP-based login. Never share your OTP, password or UPI PIN with anyone. LHPL and LHKPL staff will never ask for them by phone, SMS, WhatsApp or email. Please report any such request to our IT Grievance Officer.
Other websites. Our Platform may link to other websites and services, such as payment pages and maps. This Policy does not cover them; please read their privacy policies.
11. IT Grievance Officer, Grievance Manager and complaints
For any question, request or complaint about your personal data, contact our IT Grievance Officer, who acts for both LHPL and LHKPL:
| Name | Mr. Niyas K, IT Grievance Officer |
|---|---|
| niyas@loyalhospitality.in | |
| Telephone | 96068 88822 |
| Address | No. 13, 6th Floor, Cumulus, Prestige Tech Cloud, Navarathna Agrahara Village, Sadahalli Gate, Bengaluru, Karnataka 562110 |
We will acknowledge your grievance within 2 working days and resolve it within 30 days, and in any case within 90 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India, after first using our grievance process.
Delivery partners. For any concern relating to your engagement with LHKPL, such as payouts, deductions, ratings, slots, de-registration or termination, you may contact our Grievance Manager:
| Name | Mr. Jamshed Rehman, Grievance Manager |
|---|---|
| Telephone | 96064 98886 |
| Address | No. 13, 6th Floor, Cumulus, Prestige Tech Cloud, Navarathna Agrahara Village, Sadahalli Gate, Bengaluru, Karnataka 562110 |
Delivery partners may also approach the Internal Dispute Resolution Committee, or the Karnataka Platform Based Gig Workers Welfare Board through its web portal, as set out in Clause 11 of the Delivery Partner Terms and Conditions.
12. Changes to this Policy and language
Changes. We may update this Policy to reflect changes in law or in how we process personal data. We will notify you of significant changes through the app, website, SMS or email before they take effect. For delivery partners, changes will be notified at least 14 days in advance, in line with the Delivery Partner Terms and Conditions. Where a change needs fresh consent, we will ask for it.
Language. This Policy is available in English and Kannada. On request, we will provide it in any other language listed in the Eighth Schedule to the Constitution of India.
For Loyal Hospitality Private Limited and Loyal Hospitality Kitchens Private Limited
Mr. Junaiz Kizhakkayil
Founder & CEO