Privacy Policy

AQR INNOVATIONS PRIVATE LIMITED (CIN: U63120KA2026PTC225863, GSTIN: 29ABGCA4237R1Z0), operating the tiffin pickup and delivery service under the brand "Tifio" (hereinafter referred to as "Tifio", "we", "us", or "our"), is the data fiduciary responsible for your personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We are committed to protecting the privacy and safety of our participating families. This Privacy Policy describes how we collect, use, store, share, and safeguard information when you use our daily tiffin pickup and school delivery services in Bengaluru, and it explains the rights available to you as a data principal under Indian law.

Registered office: Unit No. 101, Oxford Towers, 139, HAL Old Airport Rd, Kodihalli, Bengaluru, Karnataka 560008.

1. Information We Collect

To provide our tiffin delivery service safely and accurately, we collect the following types of information:

• Parent Contact Information: Name, phone number (for WhatsApp/SMS updates), email address, and billing details.
• Student/Delivery Details:Child's name, school name, grade, division/section, and locality. This information is required to identify the tiffin and ensure it reaches the correct classroom/handover point.
• Dietary and Allergy Notes: Optional dietary requirements or critical allergy notes you provide to print on the tiffin identification tags for school coordinator awareness.
• Delivery Log Data: Handover timestamps and verification scans captured by our coordinators at the doorstep and school gates.

2. How We Use Your Information

We use the collected data solely to run our services:

• To verify doorstep pickups and match empty/filled tiffins to the correct student.
• To send real-time WhatsApp or SMS notifications when your tiffin is picked up and delivered.
• To coordinate with school administrations and gate personnel for safe handovers.
• To print QR tracking labels affixed securely to each tiffin box.
• To process per-order billing, payments, and pilot deposits.

3. Consent and Children's Personal Data

Because our service necessarily involves the personal data of a school-going child, we process student information (name, school, grade, section, and any dietary/allergy notes) only on the basis of verifiable consent given by the child's parent or lawful guardian, in accordance with Section 9 of the DPDP Act, 2023. By creating a Tifio account and submitting your child's details, you confirm that you are the parent or legal guardian of the child and that you consent to the collection and processing of the child's personal data strictly for the purposes described in this Policy. We do not use student data for behavioural monitoring, targeted advertising, or tracking that could cause detrimental effect to the child, and we do not knowingly permit third parties to do so.

You may withdraw consent at any time by contacting us at hello@tifio.in. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal, but it will mean we can no longer provide the tiffin delivery service to your child until fresh consent is given.

4. QR Tracking and Child Safety

Every tiffin is tagged with a QR code that encodes the student's name, grade, and school. This QR code is scanned by our delivery personnel during each transit phase. The scanned data is accessible only by authorized Tifio coordinators and is used to trace the chain of custody. We do not track or store the real-time physical GPS coordinates of children.

5. Sharing of Information

We respect your data and do not sell or lease it to third-party marketing companies. We only share information with:

• Partner Schools: We share student names and classroom sections with the designated gate staff and administrators of the recipient school to authorize the daily handover.
• Verified Staff: Our police-verified, background-checked coordinators are granted access to delivery manifests only to perform daily pickups and gate deliveries.
• Service Providers: Standard third-party tools used for WhatsApp notifications, billing processors, and hosting services.

6. Data Security and Retention

We follow reasonable security practices and procedures as mandated under the IT Act, 2000 and the SPDI Rules, 2011, including encryption in transit, restricted role-based access, and regular access reviews. Access to student data is heavily restricted to coordinators directly involved in the delivery chain for your route. We retain personal and student data only for as long as you have an active account with us and for a reasonable period thereafter to comply with our legal, tax, and regulatory obligations (including under the Companies Act, 2013 and applicable tax law), after which it is securely deleted or anonymised. Doorstep and delivery log images, where captured, are cleared periodically and are not retained beyond what is necessary for delivery verification and dispute resolution.

Where any personal data is processed or stored using service providers or cloud infrastructure located outside India, such transfers are made only to the extent permitted under the DPDP Act, 2023 and subject to contractual safeguards requiring the recipient to protect your data to a standard consistent with this Policy.

7. Your Rights as a Data Principal

Under the DPDP Act, 2023, you (as the parent/guardian exercising rights on behalf of your child, and in respect of your own data) have the right to:

• Obtain a summary of the personal data we hold about you and your child, and the processing activities carried out on it.
• Request correction, completion, or updating of inaccurate or incomplete personal data.
• Request erasure of personal data that is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
• Withdraw consent at any time, with effect going forward.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Register a grievance regarding the manner in which your personal data is processed, and seek redressal in accordance with Section 8 below.

To exercise any of these rights, contact us at hello@tifio.in. We will respond to verified requests within the timelines prescribed under applicable law.

8. Grievance Officer

In accordance with the IT Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, we have appointed a Grievance Officer to address any complaints or concerns regarding the processing of your personal data:
Email: grievance@tifio.in
Registered office: Unit No. 101, Oxford Towers, 139, HAL Old Airport Rd, Kodihalli, Bengaluru, Karnataka 560008
The Grievance Officer will acknowledge your complaint and work to resolve it within 15 days of receipt of the complaint.

9. Changes to This Policy

We may update this Privacy Policy from time to time to adapt to changes in our delivery routes, school partnerships, or regulatory guidelines, including future rules notified under the DPDP Act, 2023. We will notify you of any material changes via WhatsApp, email, or a notice on our website, and where required by law, we will seek your fresh consent.