न NamastePOS Privacy policy

Data Processing Addendum

Version dpa-2026-09-19 · Effective 19 September 2026 · Forms part of the Terms of Service

This Addendum applies whenever you use NamastePOS to process personal data about other people — principally your diners. It is written in plain language on purpose. Nothing in it reduces your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Who is who

For your diners' data — names, phone numbers, order history, loyalty balances, delivery addresses — you are the Data Fiduciary and we are your Data Processor. You decide what to collect and why; we process it on your instructions.

For your own account data — your name, email, phone, GSTIN, billing records, and how you use the product — we are the Data Fiduciary, and the Privacy Policy governs.

2. What we process, and for how long

Subject matter: providing the NamastePOS point-of-sale and restaurant-management service. Duration: for as long as your subscription is active, plus the retention periods set out in section 5 of the Privacy Policy. Categories of data principals: your diners, your staff, and you. Types of personal data: name, phone number, email address where given, order and payment history and wallet balances, delivery address for online orders, and staff names, roles and PIN hashes.

3. Our obligations

  1. Only on your instructions. We process diner data to run the service for you and for no other purpose. We do not sell it, and we do not use one restaurant's data to market to another's diners.
  2. Confidentiality. Access is limited to people who need it to operate or support the service, under confidentiality obligations. Our own staff accounts are denied access to tenant data by default and every access is written to an audit log.
  3. Security. Reasonable technical and organisational measures, described in section 7 of the Privacy Policy: encryption in transit, role-based tenant-isolated access, hashed passwords and rate-limited staff PINs, two-factor authentication on administrative access, and nightly encrypted database backups with a tested restore procedure.
  4. Sub-processors. We use the companies listed at namastepos.in/sub-processors, each under its own data-processing terms and receiving only what its function requires. We keep that page current and tell subscribed restaurants by email before a material change takes effect.
  5. Helping you answer your diners. We give you the tools to satisfy access, correction and erasure requests yourself, and diners can exercise those rights directly at namastepos.in/my-data. Where a request reaches us instead, we act on your instruction and tell you what we did.
  6. Breach notice. If we become aware of a personal data breach affecting your diners, we tell you without undue delay and in any event within 48 hours, with what we know, what we are doing, and what you may need to tell your diners. We notify the Data Protection Board where the law requires it.
  7. Deletion. On termination, and on request, we delete or anonymise diner personal data, except records Indian tax law requires either of us to keep (invoices, GST records), which are retained for the statutory period and then deleted.
  8. Information. On reasonable request we give you the information you need to show a regulator that your processing through NamastePOS is compliant, including our security documentation and this register.

4. Your obligations

You give the notice and obtain the consent the DPDP Act requires from your diners. We help by displaying a standard privacy line wherever the product captures a phone number — at the counter, on the QR menu and on the bill — but the duty is yours, because you decide what to collect. Do not put personal data into fields not meant for it (order notes, item names), and do not use the product to send marketing to people who have not agreed to receive it.

5. Processing outside India

Our servers and database are currently in Singapore, and some sub-processors process data in other countries; the register says where. Section 16 of the DPDP Act permits this, subject to any country the Central Government restricts. If a restriction applies to a country we use, we will move that processing or stop it.

6. Artificial intelligence

The AI features are optional and off-limits to your diners' identifiers: phone numbers, emails, GSTINs, UPI IDs, PAN, Aadhaar, card numbers and customer names are removed before any prompt leaves our servers. Prompts go to Google's Gemini API, whose free tier permits Google to use inputs to improve its models. You can switch the AI off for your restaurant entirely in Settings → AI features, and no prompt is sent while it is off.

7. Changes

We will post a new version here and, for material changes, notify you in the app or by email before it takes effect. The version identifier at the top of this page is what your account records as accepted.

8. Contact

Grievance Officer: Shivhari Lokhande, support@namastepos.in. We acknowledge within 48 hours and answer within 30 days, and in no case later than 90 days.