Privacy Policy &
WhatsApp Communication
Last Updated: February 2026
Digital Personal Data Protection Act, 2023
CulinaOS is compliant with India's DPDP Act 2023. We act as a Data Fiduciary under the Act and are committed to lawful, fair, and transparent processing of personal data with your explicit consent.
CulinaOS integrates with the WhatsApp Business API to provide seamless hospitality management. This policy explains how we handle your data for automated order updates, token alerts, and table-ready notifications. We are committed to transparency and ensuring your guest communication is secure, compliant, and efficient.
Data We Collect
We collect and process specific identifiers to facilitate communication via the WhatsApp Business API, including:
- Verified Phone Numbers
- Real-time Order Status
- Guest Names & Reservations
How We Use WhatsApp
WhatsApp is used exclusively for operational excellence and guest engagement:
- Transactional Updates (KOT, Billing, Queue)
- Opted-in Promotional Offers
- Table Readiness Notifications
Opt-out & User Control
Guests maintain full control over their communication preferences at all times.
Instructions
Reply 'STOP' to any WhatsApp message or update preferences via the CulinaOS Guest Settings portal.
DPDP Act 2023 — Your Rights as a Data Principal
India LawUnder the Digital Personal Data Protection Act, 2023, you (the Data Principal) have the following rights:
Right to Access
Request a summary of your personal data we hold and details of how it has been processed.
Right to Correction
Request correction of inaccurate, incomplete, or misleading personal data.
Right to Erasure
Request deletion of your personal data when no longer necessary for the purpose it was collected.
Right to Grievance Redressal
Raise a grievance with our Data Protection Officer and receive a response within a reasonable timeframe.
Right to Nominate
Nominate another individual to exercise your rights in the event of death or incapacity.
Right to Withdraw Consent
Withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Our Obligations as Data Fiduciary
- Process personal data only for specified, lawful purposes with explicit consent
- Maintain reasonable security safeguards to prevent data breaches
- Notify Data Principals and the Data Protection Board in event of a breach
- Not retain personal data beyond the period necessary for its purpose
- Ensure accuracy and completeness of personal data before using it
- Appoint a Data Protection Officer (DPO) for grievance redressal
- Not transfer personal data outside India except to notified countries
- Publish contact details of DPO for Data Principals to exercise rights
Third-party Sharing
Data is processed strictly via official WhatsApp Business Solution Providers (BSPs).
We NEVER sell your personal data to third-party advertisers.