1. Preamble
This Privacy Policy (“Policy”) is issued by QSKIP Private Limited, a company incorporated under the Companies Act, 2013, bearing CIN U56100HR2026PTC142061, having its registered office at House No. 2532/16, Faridabad City, Faridabad – 121002, Haryana (“QSKIP”, “Company”, “Data Fiduciary”, “we”, “us” or “our”).
This Policy sets out the manner in which QSKIP, acting as a “Data Fiduciary” within the meaning of the Digital Personal Data Protection Act, 2023, together with the Digital Personal Data Protection Rules (collectively, the “DPDP Act”), collects, processes, stores, discloses, and safeguards the personal data of users of the QSKIP mobile applications and related services (the “App” or “Platform”).
This Policy shall be read in conjunction with, and forms an integral part of, the QSKIP Terms and Conditions and the Cancellation and Refund Policy.
At the time of registration, the Data Principal shall be required to furnish their name, email address, and mobile number, and to grant Consent by way of a clearly presented, unchecked checkbox requiring an affirmative action prior to Account creation. Consent so obtained is specific to the purposes set out in this Policy and shall not be inferred, implied, or derived from mere download or browsing absent such affirmative action.
2. Definitions
(a) “Consent” means any freely given, specific, informed, and unambiguous indication of the Data Principal’s wishes, by which the Data Principal, by a clear affirmative action, signifies agreement to the processing of Personal Data for the specified purpose, limited to such Personal Data as is strictly necessary for that purpose.
(b) “Data Principal” means the individual to whom the Personal Data relates and, where such individual is a Minor, includes the parent or lawful guardian of such Minor.
(c) “Data Fiduciary” means QSKIP Private Limited, which determines the purpose and means of processing of Personal Data.
(d) “Personal Data” means any data about an individual who is identifiable by or in relation to such data.
(e) “Processing” in relation to Personal Data means a wholly or partly automated operation performed on digital Personal Data, including collection, recording, organization, storage, retrieval, use, transmission, anonymization, or erasure.
(f) “Minor” means an individual who has not completed the age of eighteen (18) years.
(g) “Data Protection Board” means the Data Protection Board of India established under the DPDP Act.
(h) “App”, “Platform”, “User”, “Account”, “Order” and “Partner Outlet” shall bear the meanings assigned to such terms in the QSKIP Terms and Conditions.
3. Personal Data Collected
In delivering our advance food ordering and counter pick-up services, QSKIP collects only the minimum necessary data points:
(a) Account Data: Name, mobile number, and email address, collected for Account creation, identity verification via one-time password (“OTP”) authentication, and transmission of transactional order updates.
(b) Profile Photograph: Where voluntarily uploaded by the Data Principal, used solely for display as the in-app profile avatar.
(c) Payment Data: QSKIP does not collect, receive, process, or store credit/debit card numbers, CVVs, UPI PINs, or net-banking credentials. Such data is entered directly upon the secure payment interface of our PCI-DSS Level 1 certified payment aggregator and does not at any point reside on QSKIP systems.
(d) Transactional Data: Order history, item selections, timestamps, and payment reference tokens, processed to fulfill Orders, generate receipts, and manage customer service.
(e) Device & Technical Data: Device model, operating system version, and IP address, processed strictly for Account security, fraud detection, and platform stability.
(f) Push Notification Tokens: A device-specific push notification token (FCM), processed solely to deliver real-time counter readiness alerts and Order stage updates. Users may disable push notifications in device settings at any time.
(g) Location Data: With the explicit in-app foreground permission of the Data Principal, approximate or precise location is processed for the sole purpose of displaying proximate campus canteens and partner outlets. Location is never tracked continuously or in the background, and permission may be revoked at any time via device settings.
4. Disclosure of Personal Data to Third Parties
QSKIP shares Personal Data strictly with trusted service partners on a need-to-know basis to operate Platform features:
- Firebase (Google LLC): Used for secure push notification delivery, app performance monitoring, crash diagnostics, and telemetry.
- Razorpay (Razorpay Software Private Limited): Certified to PCI-DSS Level 1, processing digital payments (UPI, cards, net banking) directly. QSKIP does not store payment credentials.
- Microsoft Azure: Used for secure cloud storage of profile avatar images with restricted access controls.
- Google Sign-In (Google LLC): An optional federated authentication mechanism. Where used, QSKIP receives the user’s verified name, email address, and profile photo from Google.
- Partner Outlets (Food Vendors): Disclosed solely the Buyer’s first name and Order token number for the limited purpose of handing over the food at the counter. The Buyer’s phone number is never shared with Partner Outlets.
5. Automated Processing & Anti-Fraud
QSKIP uses automated analytical checks to detect payment fraud, coupon abuse, and platform security risks. Where automated processing leads to account restriction, the Data Principal is entitled to human review by filing a grievance under Section 11.
6. Security Safeguards
(a) Encryption in Transit: All data transmitted between the App and QSKIP servers is encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
(b) Encryption at Rest: Sensitive databases and backups are encrypted at rest using industry-standard AES-256 encryption.
(c) No Plaintext Passwords: Passwords and authentication secrets are salted and hashed using cryptographic one-way functions and are never stored in plaintext or logged.
(d) Breach Notification: In the event of a verified personal data breach, QSKIP shall notify the Data Protection Board of India and affected users within the timelines mandated under the DPDP Act.
7. Age Eligibility & Minor Protection
By using the App, you represent and warrant that you are at least eighteen (18) years of age, or that you are using the App under the active consent and supervision of a parent or legal guardian.
The App is not directed to individuals under eighteen (18) years of age, and QSKIP does not knowingly collect Personal Data from minors for independent account operation. Where a minor accesses the App under parental supervision, the parent or guardian is deemed to provide Consent on the minor’s behalf. Data of minors is never used for behavioral profiling, targeted advertising, or secondary commercial purposes. Where QSKIP becomes aware that Personal Data of a minor has been collected without lawful consent, QSKIP reserves the right to delete such data and deactivate the Account with immediate effect.
8. Retention of Personal Data
Personal Data is retained strictly for the duration necessary to fulfill the purposes for which it was gathered:
- Authentication OTPs: Deleted within minutes of verification or expiration;
- Active Login Sessions: Expire automatically upon logout or token invalidation;
- User Profiles & Avatars: Permanently deleted or irreversibly anonymized within forty-five (45) days of an Account deletion request, or following twenty-four (24) months of continuous inactivity; and
- Financial, Order & Invoice Records: Retained in anonymized format for seven (7) years as mandatorily required under applicable Indian taxation, accounting, and consumer protection laws.
9. Rights of the Data Principal
Under the DPDP Act, 2023, you enjoy statutory rights regarding your Personal Data:
- Right to Access: Request a summary of Personal Data processed by QSKIP;
- Right to Correction & Updating: Correct inaccurate or incomplete personal records;
- Right to Erasure: Seek deletion of your personal records, subject to statutory retention obligations;
- Right to Withdraw Consent: Revoke permissions at any time via in-app profile settings;
- Right to Nominate: Nominate another individual to exercise your rights in the event of death or incapacity; and
- Right to Grievance Redressal: Submit grievances regarding data processing directly to our Grievance Officer.
10. Limitation of Liability
To the maximum extent permitted by law, QSKIP disclaims liability for indirect, incidental, or consequential damages arising from: (a) unauthorized account access caused by user failure to safeguard login credentials or OTPs; (b) downtime or outages of third-party infrastructure providers identified in Section 4; or (c) force majeure events beyond reasonable control. Nothing in this Section restricts QSKIP’s mandatory statutory duties under the DPDP Act.
11. Grievance Redressal Mechanism
In accordance with the DPDP Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, QSKIP provides a dedicated grievance redressal channel:
Designation: Nodal Grievance & Compliance Officer
Officer Name: Shivam Kharb
Email:support@qskip.in
Helpline Phone:+91 870 072 2415/+91 84484 63629
Registered Office: House No. 2532/16, Faridabad City, Faridabad – 121002, Haryana
Operating Hours: Monday to Friday, 09:00 AM – 06:00 PM IST
All grievances will be acknowledged within forty-eight (48) hours of receipt, and resolved within thirty (30) calendar days. If unresolved, Data Principals may escalate complaints to the Data Protection Board of India.
12. Deletion of Account & Associated Data
In strict compliance with Google Play Store Developer Policies and the DPDP Act, Users maintain complete ownership of their data and may request permanent account deletion at any time through two convenient methods:
1. In-App Deletion: Navigate to Profile > Settings > Account Management > Delete Account within the QSKIP mobile app, verified via OTP authentication or Google Sign-In.
2. Online Web Deletion Portal: If you have uninstalled the app or lost access to your device, you can request full account and data deletion online through our dedicated web portal:
Official Account Deletion Portal
Submit an instant deletion request for your account, contact details, and stored preferences.
What Happens Upon Deletion:
- FCM notification tokens, active sessions, carts, and unredeemed rewards are permanently and immediately erased;
- Your name, email address, mobile number, and avatar image are deleted from active servers; and
- Order and invoice records are stripped of identifiers and retained in anonymized format for seven (7) years to satisfy statutory tax regulations.
13. Amendment of this Policy
QSKIP reserves the right to amend or update this Policy to reflect operational or regulatory changes. Material changes impacting data processing will be communicated via in-app notification or email, requiring fresh affirmative Consent before taking effect. Continued use after non-material updates constitutes acceptance.
14. Governing Law and Jurisdiction
This Policy shall be governed by and construed in accordance with the laws of India. Any legal dispute or proceeding arising under or in relation to this Policy shall be subject to the exclusive jurisdiction of the competent courts at New Delhi, India.