Last updated: 29 October 2026

1. About This Policy

Abhiruchi Caterers ("Abhiruchi", "we", "us", "our") respects your privacy. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, how we protect it, and the rights you have over it.

Abhiruchi Caterers is a partnership firm registered under the GST laws (GSTIN 36ABZFA8015D1Z9). Its principal place of business is at 27-46/1/2, Plot No. 2, Ground Floor, Vinayak Nagar, Neredmet, Secunderabad, Medchal-Malkajgiri District, Telangana – 500056, and it operates the website abhiruchicaterers.com. Under the Digital Personal Data Protection Act, 2023, we are the "Data Fiduciary" for your personal data, and you are the "Data Principal".

This policy applies to personal data we collect when you:

• visit or use our website;
• submit an enquiry or booking form;
• contact us by phone, WhatsApp, email or social media; or
• book or receive our catering services.

Browsing our website does not, by itself, mean you consent to anything. Where we need your consent, we ask for it clearly, for example through a checkbox on our enquiry form or our cookie banner. You can withdraw it at any time (Section 14).

You may ask us for this policy in Telugu, Hindi or any other language listed in the Eighth Schedule to the Constitution of India by contacting us (Section 18).

2. Laws We Follow

We handle personal data in line with the following Indian laws, as amended from time to time:

• Digital Personal Data Protection Act, 2023 ("DPDP Act") and Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). This is India's main data protection law. Its provisions are coming into force in phases up to May 2027, and we have written this policy to meet its requirements now.
• Information Technology Act, 2000, including Sections 43A and 72A, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), which continue to apply until they are replaced by the DPDP framework.
• CERT-In Directions dated 28 April 2022, issued under Section 70B(6) of the IT Act, on reporting cyber security incidents and keeping system logs.
• Telecom Commercial Communications Customer Preference Regulations, 2018, issued by the Telecom Regulatory Authority of India (TRAI), for promotional calls and messages.
• Goods and services tax and income-tax laws, which require us to keep billing and accounting records.

If any part of this policy conflicts with applicable law, the law will prevail.

3. Personal Data We Collect

We collect only the personal data we need to respond to you and to cater your event.

We do not ask for Aadhaar, PAN, passport or other government ID numbers, card details, bank passwords or OTPs. If a law ever requires us to collect a particular document, we will tell you why at that time.

Dietary and health information. Allergy and medical dietary information can reveal a health condition, which the SPDI Rules treat as sensitive personal data. We collect it only with your express consent, use it only to prepare and serve food safely at your event, and share it only with the kitchen and service team handling that event. Please share only what is needed, such as "one guest has a peanut allergy", and not medical records.

Providing personal data is voluntary. If you choose not to share the details we need, we may not be able to give you a quotation or cater your event.

4. How We Use Your Data and Why

We use your personal data only for the purposes below. We will not use it for a new purpose without telling you and, where required, asking for your consent again.

We do not make decisions about you by fully automated means.

5. Enquiries and Bookings

Submitting an enquiry does not confirm a booking. A booking is confirmed only after the menu, guest count, date, venue, price, advance payment and other terms are agreed with Abhiruchi Caterers and confirmed in writing, including by WhatsApp or email.

We use enquiry details to contact you, understand your requirements and prepare a quotation. If your enquiry does not become a booking, we keep the details only for the period in Section 13 and then delete them.

Information about other people. If you share details of other people, such as an on-site coordinator's phone number or a guest's allergy, please make sure they know you are sharing it with us and agree to it. We will use that information only for your event.

Venues and event planners. If a venue or event planner contacts us for you, we use the details they share only to respond to that enquiry and, if you book, to coordinate your event with them.

6. WhatsApp, Phone, Email and Promotional Messages

When you give us your phone number, WhatsApp number or email address, we use it to contact you about your enquiry, quotation, booking and event. These service messages are part of handling your request.

Promotional messages. We send festive menus, offers or news about our services only if you have separately opted in. You can opt out at any time by replying "STOP" on WhatsApp or SMS, or by calling us (Section 18). Opting out does not affect your enquiry or booking. We keep your number on an opt-out list so that we do not message you again.

Do Not Disturb (DND). We respect the preferences you have registered under TRAI's regulations. We do not make promotional calls or send promotional SMS to numbers on the DND register unless you have given us your consent.

WhatsApp. WhatsApp is a service of Meta Platforms. Messages you exchange with us on WhatsApp are also handled under WhatsApp's own terms and privacy policy. We use WhatsApp Business only on devices controlled by us and protected by a passcode.

Calls. We do not record phone calls without telling you first.

Please do not send OTPs, card numbers, UPI PINs or passwords to us through any channel.

7. Cookies and Website Analytics

Cookies are small files your browser stores on your device. We use them to run our website and, only with your consent, to understand how visitors use it and to measure our advertising.

When you first visit, a cookie banner lets you accept or reject non-essential cookies, and rejecting them is as easy as accepting them. Google Analytics and Meta Pixel load only after you accept them. You can change your choice at any time through the "Cookie Settings" link at the bottom of each page, or by blocking or clearing cookies in your browser. Blocking strictly necessary cookies may stop parts of the website from working.

Google, Meta and other embed providers process this data under their own privacy policies and may store it outside India (Section 9).

8. Event Photographs

We may photograph or film our food, buffet set-ups and live counters at events to show our work on our website and social media.

• We frame photos to focus on food and décor, not on guests.
• We do not publish a photo in which a person can be clearly identified without that person's consent.
• We do not publish identifiable photos of children without the consent of a parent or lawful guardian.
• We do not name the host or reveal private event details, such as a home address, without permission.
• You can ask us to remove any photo of you or your event, and we will take it down from our website and our own social media accounts within 7 days.

Tell us when you book if you do not want any photos taken at your event.

9. Sharing Your Data

We do not sell or rent your personal data. We share it only when needed for the purposes in Section 4, and only as much as each recipient needs.

Data Processors. Service providers that process personal data for us do so under a contract, only on our instructions, with reasonable security safeguards, as required by Section 8(2) of the DPDP Act. They must delete or return the data when their service ends.

Business changes. If our business is restructured, merged or transferred, your data may pass to the new owner, who must continue to protect it in line with this policy and applicable law. We will inform you of any such change.

Transfers outside India. Some of our providers, such as cloud hosting, WhatsApp and analytics services, may store or process data on servers outside India. The DPDP Act allows such transfers except to countries that the Central Government restricts by notification. We will follow any such restriction and use only providers that maintain reasonable security safeguards.

10. Payment Information

We do not collect or store card numbers, CVVs, UPI PINs, net banking passwords or OTPs through our website, WhatsApp or email.

We accept payment by UPI, bank transfer and cash. UPI payments and bank transfers are processed by banks and UPI apps regulated by the Reserve Bank of India, which handle your payment details under their own terms and privacy policies. We record only what we need to confirm a payment, such as your name, the amount, date, payment mode and transaction reference, and keep it with your invoice. For cash payments, we issue a receipt.

Beware of fraud. Abhiruchi Caterers will never ask you for an OTP, UPI PIN, CVV or password, and will never send you a payment "collect" request you did not expect. Pay only to the bank account or UPI ID shown on your official quotation or invoice, and confirm any change in payment details by calling us on +91 90001 60619. You can report suspected cyber fraud at cybercrime.gov.in or on the national helpline 1930.

11. How We Protect Your Data

We use reasonable security safeguards, as required by the DPDP Rules and the SPDI Rules, to protect personal data against unauthorised access, use, disclosure, alteration, loss or destruction. These include:

• HTTPS (SSL/TLS) encryption for data sent through our website;
• strong passwords and two-factor authentication on our website administration and WhatsApp Business accounts;
• access limited to staff who need the data, under confidentiality obligations;
• keeping our website software, theme and plugins updated, and using a website firewall and spam protection;
• regular backups, so that data can be restored after an incident;
• monitoring access and keeping security logs for at least one year, to detect and investigate unauthorised access;
• passcode-protected phones and computers, and locked storage for paper records such as order books; and
• contracts requiring our service providers to protect your data.

We review these measures periodically, using IS/ISO/IEC 27001 as a reference standard.

No website, internet transmission or electronic storage is completely secure. Please avoid sending us sensitive information we have not asked for.

12. Data Breach and Information Loss

A personal data breach is any unauthorised processing, or any accidental disclosure, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. Examples include a hacked website or email account, a lost or stolen phone or laptop, a message sent to the wrong person, and a lost order book or paper file.

If a breach affects your personal data, we will:

1. Act immediately to contain it, for example by resetting passwords, locking accounts or taking the website offline.
2. Assess what data was affected, how many people are involved and the likely impact.
3. Inform you without delay by phone, WhatsApp or email, in clear and plain language.
4. Inform the Data Protection Board of India without delay, and send it a detailed report within 72 hours of becoming aware of the breach, or within any longer period the Board allows.
5. Report the incident to CERT-In within 6 hours of noticing it, where it is a cyber security incident that must be reported under the CERT-In Directions.
6. Fix the cause, strengthen our safeguards and keep a record of the incident and the steps we took.

Our message to you will explain:

• what happened, including the nature, extent, timing and location of the breach;
• the consequences likely to affect you;
• what we have done, and are doing, to reduce the harm;
• steps you can take to protect yourself, such as changing passwords or watching for fraudulent calls; and
• the name and contact details of the person who can answer your questions.

If you notice anything suspicious, such as a message falsely claiming to be from Abhiruchi Caterers, please tell us immediately (Section 18). You can also report cyber fraud at cybercrime.gov.in or on the national helpline 1930.

13. How Long We Keep Your Data

We keep personal data only as long as needed for the purposes in Section 4, or as long as the law requires. The DPDP Rules require us to keep personal data and related logs for at least one year from the date of processing. After the periods below, we delete or anonymise the data, and ask our service providers to do the same.

If you withdraw consent or ask us to erase your data, we will delete it once these legal minimum periods have passed, and stop using it for any other purpose in the meantime.

14. Your Rights

Under the DPDP Act and other applicable law, you have the right to:

• Access a summary of the personal data we hold about you, how we use it, and who we have shared it with.
• Correct and update inaccurate or misleading data, and complete incomplete data.
• Erase data that is no longer needed, unless a law requires us to keep it.
• Withdraw consent at any time, as easily as you gave it. We will stop processing, and ask our service providers to stop, within a reasonable time. Withdrawal does not affect processing done before it, and may mean we cannot continue with your enquiry or booking.
• Raise a grievance with us about how we handle your data.
• Nominate a person to exercise these rights for you if you die or become unable to act. Write to us with the nominee's name and contact details.
• Opt out of promotional messages at any time (Section 6).

How to make a request. Contact our Grievance Officer (Section 18) by phone, WhatsApp or post. Tell us your name, the phone number or email you used with us, and what you would like us to do. To protect your data, we may verify your identity, for example by confirming the request from the number you used with us.

We do not charge for requests. We will acknowledge your request within 2 working days and respond within 30 days. If we cannot carry out a request, for example because tax law requires us to keep an invoice, we will explain why.

15. Your Duties

Under Section 15 of the DPDP Act, when you share personal data with us or exercise your rights, you must:

• follow applicable laws;
• not impersonate another person;
• not hide material information when providing your personal data;
• not file false or frivolous complaints with us or the Data Protection Board of India; and
• give only verifiably authentic information when asking us to correct or erase your data.

The Data Protection Board of India may impose a penalty of up to ₹10,000 for a breach of these duties.

16. Children and Persons with Disabilities

Under the DPDP Act, a child is anyone under 18 years of age. Our website and services are meant for adults, and we do not knowingly collect personal data directly from children.

• Enquiries and bookings for children's events, such as birthday parties, should be made by a parent or lawful guardian.
• We collect a child's dietary or allergy information only from a parent or lawful guardian, with their consent, and only to serve food safely.
• We do not track or monitor the behaviour of children, or direct targeted advertising at them.
• If we learn that a child has given us personal data without a parent's or guardian's consent, we will delete it. Parents or guardians can also contact us to ask for this.

For a person with a disability who has a lawful guardian, we act on the consent of that guardian.

17. Third-Party Links and Services

Our website may link to or embed third-party services, such as Google Maps, YouTube, Instagram, Facebook, WhatsApp and payment pages. These services have their own privacy policies, and Abhiruchi Caterers is not responsible for their privacy practices, security or content.

Comments or messages you post on our social media pages are also handled under that platform's policies. Please review a service's privacy policy before sharing personal data with it.

18. Grievance Officer and Contact

For any question, request or complaint about your personal data, contact our Grievance Officer, who is also the person responsible for answering questions about how we process personal data.

We will acknowledge your complaint within 2 working days and resolve it within 30 days.

Data Protection Board of India. If you are not satisfied with our response, or we do not respond within this time, you may complain to the Data Protection Board of India under the DPDP Act, following the procedure and online platform notified by the Board. The DPDP Act requires you to use our grievance process first.

19. Changes, Governing Law and Jurisdiction

We may update this policy when our website, services or legal obligations change, including when we add new features to our website. We will post the updated policy on this page with a new "Last updated" date.

If a change is significant, we will display a clear notice on our website. If we want to use your personal data for a new purpose that needs consent, we will ask for your consent first.

This policy is governed by the laws of India. Subject to your right to approach the Data Protection Board of India or any other authority, the competent courts having jurisdiction over Secunderabad, Telangana will have jurisdiction over any dispute arising from this policy.