Purpose and scope
This Data Privacy and Retention Policy establishes how Brewszilla Technologies Private Limited ("Brewszilla") collects, processes, retains, and deletes personal data in compliance with Indian data privacy and technology laws.
It applies to all data handled through the Brewszilla app, website, partner interfaces, and business operations, including users, merchants, employees, contractors, and service providers.
Definitions
- Personal data: Any data about an identifiable individual processed digitally or intended for digital processing.
- Sensitive data: Includes financial, health, biometric, or other categories requiring enhanced protection under Indian law.
- Data Principal: The individual to whom the data relates.
- Data Fiduciary: Brewszilla, which determines the purpose and means of processing.
- Data Processor: Entities engaged by Brewszilla to process data on its behalf under written contracts.
Principles of data handling
Brewszilla handles data in accordance with the DPDPA and IT Act, following these core principles:
- Lawfulness and transparency – data is processed with consent or lawful basis and accompanied by clear notices.
- Purpose limitation – collected only for specified, explicit, and legitimate purposes.
- Data minimization – limited to what is necessary for those purposes.
- Integrity and security – protected through organizational and technical controls.
- Storage limitation – retained only as long as needed for the purpose or legal requirement, whichever is longer.
Categories of data collected
Brewszilla may collect and process:
- Contact details (name, phone, email, address)
- Transaction and order information
- Payment and billing identifiers (through secure third‑party gateways)
- Device, app usage, and technical logs
- Geolocation (with consent for service functionality)
- Business and tax identifiers for partners or merchants
Retention principles
1. Purpose‑driven retention
Personal data will be retained only until the purpose for which it was collected is fulfilled or consent is withdrawn, whichever is earlier, except where retention is necessary to comply with legal or regulatory obligations.
2. Legal and audit retention
Certain records (e.g., invoices, financial transactions, tax records) are retained as per statutory timelines under tax, corporate, and financial compliance laws.
3. Operational retention
Account and activity logs may be preserved for limited durations for fraud detection, grievance redressal, or analytics until anonymized.
4. Special retention for large‑scale entities
Under the draft DPDP Rules, e‑commerce and social intermediaries with over two crore users may retain data up to three years from the last user interaction or withdrawal of consent, whichever is later.
5. Deletion and anonymization
Once retention periods end, personal data will be securely deleted, de‑identified, or archived in anonymized form unless continued retention is legally mandated.
Security and protection measures
Brewszilla implements reasonable security practices and procedures per the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including:
- Encryption of data in transit and at rest
- Role‑based access control and regular password rotation
- Secure data transmission via SSL/TLS channels
- Vendor compliance audits and NDAs
- Periodic vulnerability scans and breach response protocols
Data sharing and disclosure
Brewszilla may share data:
- With trusted service providers (e.g., payment gateways, logistics partners) under binding agreements
- With law enforcement or government authorities when legally required
- To comply with contractual, audit, or regulatory obligations
Data is never sold or disclosed for unauthorized marketing or profiling without valid consent.
Rights of individuals (Data Principals)
Under the DPDPA, users have the right to:
- Request access to their personal data and obtain information on its processing
- Seek correction or completion of inaccurate data
- Request erasure upon purpose completion or consent withdrawal
- Nominate another individual to exercise rights in the event of death or incapacity
- File grievances through the designated officer or directly before the Data Protection Board of India upon rollout of enforcement mechanisms
Responses will be issued in clear terms within statutory timelines, consistent with DPDPA standards.
Cross‑border data transfers
Where personal data is transferred outside India, Brewszilla ensures that the destination jurisdiction or recipient provides equivalent protection as defined under the DPDPA and any government‑designated rules.
Transfers occur via contractual clauses or adequacy decisions to safeguard individuals' rights and limit processing to legitimate business needs.
Data breach management
Brewszilla maintains incident response protocols including:
- Immediate containment of affected systems
- Notification to the Data Protection Board of India and affected users as required
- Root‑cause analysis and corrective measures
- Documentation and audit of breaches
Data deletion requests
Data principals may request deletion through in‑app privacy settings or by writing to support@brewszilla.com.
Requests will be processed within 30 days, subject to verification and lawful retention exceptions (such as financial or tax compliance).
Data retention schedule (indicative)
Data Category Retention Period Action After Expiry User account & identity data Until account deletion or 3 months of inactivity Secure erasure or anonymization Financial and tax records 8 years (per fiscal law) Archived for audit or purged Transaction logs 3 years from order date Anonymized for analytics Marketing & consent records Until consent withdrawal Deleted upon request Employee/Contractor data Term of engagement + legal limit Archived or erased securely Grievance redressal and contact
For questions or complaints about this policy or data handling, contact Brewszilla's Data Protection Officer (DPO):
Email: support@brewszilla.com
Postal Address: Brewszilla Private Limited, Indiranagar, Bangalore, Karnataka, India
Grievances will be acknowledged within seven working days and resolved within 30 days, in accordance with DPDPA and IT compliance timelines.
Policy review and updates
This policy is reviewed annually or upon regulatory updates and may be revised to align with new rules issued under the DPDPA or other applicable Indian laws.
Continued use of Brewszilla after updates takes effect constitutes acknowledgment and acceptance of the revised policy.
Governing law
This Data Privacy and Retention Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Disputes are subject to the exclusive jurisdiction of the courts in Bangalore, India.
Account & data deletion
How to delete your account
You can request deletion of your Brewszilla account directly from the app:
- Open the Brewszilla app and log in to your account.
- Go to Account → Settings.
- Tap Deactivate Account.
- Confirm your request.
What happens after deletion
Once you request account deletion:
- Your account is immediately deactivated and hidden from other users.
- You have a 60‑day grace period during which you can reactivate your account by logging back in.
- After 60 days, all your data is permanently deleted and cannot be recovered.
Data that is deleted
- Profile information (name, email, phone number, profile photo)
- Saved preferences and favourites
- Reviews and ratings
- Chat messages and community interactions
- Activity history
Data that may be retained
- Transaction and payment records (as required by law for accounting and tax purposes)
- Anonymised and aggregated data that does not identify you personally
Request immediate deletion
If you would like to request immediate permanent deletion of your account and data without waiting 60 days, please contact us at support@brewszilla.com with the subject line "Account Deletion Request". We will process your request within 7 business days.