Privacy Policy

This Policy reflects the way we think about your data:

• Transparency you can scan. Plain words, no hype. We tell you what we do with your data.
• Collect only what we need. We practise data minimisation and ask only for what is required to serve you.
• You stay in control. You can access, correct, or delete your data and withdraw consent at any time.
• Consumer-first and farmer-first. Your data is used to serve you better, never to exploit you.
• Security by default. We protect your information with reasonable technical and organisational safeguards.

The Platform is owned and operated by PYAAS DAIRY PRIVATE LIMITED. For the purposes of the DPDP Act, Pyaas is the “Data Fiduciary” that determines the purposes and means of processing your personal data. You are the “Data Principal”.

During its launch pilot, Pyaas offers doorstep delivery of Parag milk and dairy products in association with the Pradeshik Cooperative Dairy Federation (PCDF) / Lucknow Milk Union. Parag is a brand of PCDF; Pyaas operates the digital ordering and delivery service.

This Policy applies to all users of the Platform, including customers, subscribers, delivery recipients, and website visitors, and to the personal data we process about them.

This Policy does not apply to third-party websites, applications, or services that we do not own or control, even if they are linked from or integrated with the Platform. Your use of those services is governed by their own privacy policies.

“Personal Data”

means any data about an individual who is identifiable by or in relation to such data.

“Sensitive Personal Data or Information (SPDI)”

has the meaning given under the SPDI Rules and includes, for example, financial information such as payment instrument details.

“Processing”

means any operation performed on personal data, such as collection, storage, use, sharing, or erasure.

“Data Principal”

means you, the individual to whom the personal data relates.

“Data Fiduciary”

means Pyaas, which determines the purpose and means of processing.

“Delivery Partner”

means riders, logistics providers, and supply partners engaged to fulfil and deliver your orders.

“Platform”

means the Pyaas app, website, and related services.

Information you provide to us.

• Account & identity: name, mobile number, email address, password, and profile details.
• Delivery information: delivery address(es), flat/house number, tower, society or apartment name, landmark, PIN code, gate/security instructions, delivery preferences, and the recipient’s name.
• Subscription & order details: products selected, quantities, delivery slots, subscription schedules, vacation/pause settings, and order history.
• Payment information: UPI ID, card details, wallet/credits, billing details, transaction records, and GST number (if you provide one). Full card numbers and payment credentials are processed by our payment gateway partners; we do not store your complete card details on our systems.
• Communications & feedback: messages and call records with our support team, ratings, reviews, survey responses, complaints, and any other information you choose to share.
• Referrals: contact details you provide to refer a friend. You must have their consent before sharing their information with us.

Information we collect automatically.

• Device & technical data: device model, operating system, unique device identifiers, IP address, mobile network, app version, language settings, and diagnostic/crash logs.
• Usage & interaction data: screens and pages viewed, features used, taps, time spent, search queries, and referring links.
• Location data: precise or approximate location (with your permission) to determine serviceability, map your delivery address, and enable rider navigation.
• Cookies & similar technologies: as described in Section 8.
• Know-Your-Milk scan activity: when you scan the QR code on a pack, we record the scan event, the pack/batch identifier, and the time, so we can show you the product’s traceability record and improve quality.

Information from third parties. We may receive information about you from payment gateways and banks (transaction status), Delivery Partners, analytics and attribution providers, third-party sign-in services (if you choose to use them), PCDF / Lucknow Milk Union and dairy supply partners (for order fulfilment and product/traceability data), and publicly available sources.

Sensitive personal data. We do not ordinarily seek sensitive personal data. Where we handle financial information as part of a payment, we treat it as SPDI and apply reasonable security practices. We do not require health, biometric, genetic, or similar data to provide the service.

We use your personal data for the following purposes:

• To create, manage, and secure your account and to authenticate you.
• To process, fulfil, and deliver your orders and subscriptions to your doorstep.
• To optimise delivery routes and slots and to enable rider navigation.
• To process payments, generate invoices, issue refunds, and manage your wallet and credits.
• To provide the Know-Your-Milk traceability experience, quality records, and QR verification.
• To provide customer support and to receive and resolve your queries and complaints.
• To send you transactional and service communications relating to your orders, deliveries, payments, and subscriptions.
• To send you offers, promotions, newsletters, and personalised recommendations, where you have consented.
• To operate our loyalty, referral, and rewards programmes.
• To understand usage and to analyse, maintain, and improve the Platform, our products, and our service quality.
• To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• To comply with legal, regulatory, tax, and accounting obligations and to enforce our terms and policies.
• For any other purpose disclosed to you at the time of collection or with your consent.

We process your personal data on the basis of your consent and, where permitted by the DPDP Act, for “certain legitimate uses”, for example, the purpose for which you have voluntarily provided your data, compliance with a legal obligation, and responding to an emergency involving a threat to life or safety.

You may withdraw your consent at any time (see Section 13). Withdrawal will not affect the lawfulness of processing carried out before withdrawal, and it may limit or prevent our ability to provide certain features or services.

We and our service providers use cookies, software development kits (SDKs), pixels, device identifiers, and similar technologies to keep you signed in, remember your preferences, understand how the Platform is used, measure the performance of our communications and campaigns, and improve your experience.

These technologies fall into broad categories: strictly necessary (required for the Platform to function), functional (to remember your choices), analytics (to understand usage), and advertising (to measure and, where you consent, personalise marketing).

You can manage cookies through your browser settings and control advertising identifiers and ad personalisation through your device settings. Disabling some cookies or identifiers may affect the functionality of the Platform.

We do not sell your personal data. We share it only where necessary, and only with parties bound to protect it, including:

• Delivery Partners and riders to fulfil and deliver your orders (for example, your name, address, phone number, delivery instructions, and order details).
• PCDF / Lucknow Milk Union and dairy supply and production partners for order fulfilment, product supply, quality assurance, and traceability, on a need-to-know basis.
• Payment processors, gateways, banks, and UPI providers to process your payments and refunds securely.
• Technology service providers cloud hosting and storage, communications (SMS, email, WhatsApp, push notifications), analytics, mapping, and customer-support providers, under confidentiality and data-protection obligations.
• Marketing and advertising partners to deliver and measure campaigns, where you have consented.
• Professional advisors and auditors such as lawyers, accountants, and insurers, where reasonably required.
• Legal and regulatory authorities where required by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Pyaas, our users, or the public, and to prevent fraud.
• Group companies and affiliates for the purposes described in this Policy.
• In a business transfer in connection with a merger, acquisition, reorganisation, financing, or sale of assets, subject to this Policy.
• With your consent for any other disclosure.

Data we share, stated plainly. Some data leaves our systems the moment you use the service, and we would rather say so than bury it. This is the same list our app store data-safety declaration must carry, so the two always agree.

• Your phone number is shared with our SMS provider every time we send a one-time password or a delivery notification. It is transferred and stored by them to deliver the message. Without this you cannot sign in.
• Your payment details are shared with our payment processor when you pay. Card and UPI credentials go directly to the processor and are handled under their PCI-DSS obligations. We never receive or store your full card number.
• Your name, address and phone are shared with delivery partners so an order can physically reach you.

The Platform may contain links to, or integrations with, third-party websites, applications, and services (for example, payment pages and social media). We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing them with your information.

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, to provide the Platform to you, and to comply with our legal, tax, accounting, and regulatory obligations, resolve disputes, and enforce our agreements. The periods we work to are set out below.

When your personal data is no longer required, we will delete, anonymise, or de-identify it. Some data may persist for a limited period in secure backups before being overwritten.

We implement reasonable security practices and procedures in line with the IT Act and the SPDI Rules, including encryption of data in transit, access controls, secure infrastructure, and appropriate organisational measures. Payment card data is handled by PCI-DSS-compliant payment partners; we do not store your full card details.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for any activity under your account. If we become aware of a personal data breach, we will act in accordance with applicable law, including notifying the Data Protection Board of India and affected users where required.

Subject to applicable law, you have the following rights in relation to your personal data:

• Right to access to obtain a summary of the personal data we process about you and how we process it.
• Right to correction and completion to have inaccurate or incomplete data corrected, completed, or updated.
• Right to erasure to request deletion of your personal data, subject to legal and regulatory retention requirements.
• Right to withdraw consent to withdraw consent you have given, at any time, as easily as you gave it.
• Right of grievance redressal to have your grievances addressed by our Grievance Officer.
• Right to nominate to nominate another individual to exercise your rights in the event of your death or incapacity.
• Marketing choices to opt out of promotional communications at any time.
• Device permissions to manage location, notification, and other permissions through your device settings.

To exercise any of your rights, contact us at support@pyaasdairy.com or reach our Grievance Officer using the details in Section 21. To delete your account and personal data, you can also use our dedicated account & data deletion page. We may need to verify your identity before acting on your request. We will respond within the timelines prescribed under applicable law.

If you are not satisfied with our response, you may escalate your grievance to the Data Protection Board of India in accordance with the DPDP Act.

The Platform is intended for individuals who are 18 years of age or older. We do not knowingly collect the personal data of children (individuals under 18) without the verifiable consent of a parent or lawful guardian, as required under the DPDP Act. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

If you believe that a child has provided us with personal data without appropriate consent, please contact us and we will take steps to delete it.

Where you have consented, we may send you offers, updates, and promotional content by SMS, email, WhatsApp, push notification, or phone call. You can opt out at any time using the unsubscribe option in the message, your app notification settings, or by contacting us.

Please note that transactional and service messages, for example, order confirmations, delivery updates, and payment alerts, are not marketing communications and may still be sent to you while you use the Platform. We honour applicable Do-Not-Disturb (DND) and telecom regulatory requirements.

With your permission, we collect precise or approximate location data to check whether we deliver in your area, to map your delivery address accurately, to enable rider navigation, and to improve delivery reliability. You can enable or disable location access at any time through your device settings, though doing so may affect certain delivery features.

Your personal data is generally stored and processed on servers located in India. Where we transfer or store data outside India (for example, with cloud or technology providers), we do so in accordance with the DPDP Act and other applicable law, and we apply appropriate safeguards to protect your data.

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. Where changes are material, we will notify you through the Platform or by other appropriate means. The “Last updated” date at the top of this Policy indicates when it was last revised. Your continued use of the Platform after an update constitutes your acceptance of the revised Policy.

This Policy is governed by and construed in accordance with the laws of India. Subject to applicable law, the courts at Gautam Buddha Nagar (Greater Noida), Uttar Pradesh shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

In accordance with the Information Technology Act, 2000 and the rules made under it, and the DPDP Act, the contact details of our Grievance Officer / data protection contact are:

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, storage, sharing, and processing of your personal data as described here. If you do not agree with this Policy, please do not use the Platform.