01 Who we are
Quality Cook ("we", "us", or "the platform") is a civic-technology platform that supports food-safety readiness among street-food vendors in Tamil Nadu. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Quality Cook is the Data Fiduciary that determines the purpose and means of processing personal data through the platform.
This policy explains what personal data we collect, why we collect it, how we protect it, who we share it with, and the rights available to you as a Data Principal.
02 Who this applies to
This policy applies to the three categories of individuals whose data is processed through the platform:
- Food Safety Officers — government officers verified through the official registry provided by the food-safety administration.
- Student Survey Team members — field surveyors onboarded through partner institutions.
- Vendors and their staff — individuals whose food outlets are surveyed for readiness assessment.
03 Information we collect
Food Safety Officers
Officer profiles are pre-loaded from the official registry and may include name, designation, employee identifier, assigned district and jurisdiction, and office details. We do not create these records; we verify against them.
Student Survey Team members
To verify eligibility and enable field work, we collect: full name, date of birth, gender, district, city, address, phone number, institution, department, year of study, a College ID photograph, an Aadhaar photograph, and an Aadhaar number.
Vendors and outlets (surveyed)
During a readiness survey we collect information about the outlet and its operation, which may include: outlet and owner details, food type and menu information, equipment and hygiene practices, and details of staff working at the outlet (such as name, gender, state of origin, and salary range). We also capture photographs of the premises, tagged with location and time at the moment of capture.
All data is stored in English.
04 Aadhaar & sensitive data
Where an Aadhaar number is collected, it is encrypted at all times and is never stored or transmitted in plain text. When displayed within the platform, it is masked to the last four digits only. The full number is not visible to officers or other users. We handle Aadhaar data in line with the DPDP Act and applicable Aadhaar regulations, and only for the limited purpose of identity verification.
05 Why we process your data
We process personal data only for specified, lawful purposes:
- To verify the role and eligibility of users (officer, student, vendor).
- To conduct food-safety readiness surveys and prepare vendors for certification.
- To generate readiness assessments and analytics for the food-safety administration.
- To maintain the integrity, security, and audit record of the platform.
We practise purpose limitation and data minimisation: we collect only what a given purpose requires, and we do not use data for unrelated purposes.
06 Consent & legal basis
We process personal data on the basis of your consent, obtained through a clear notice at the point of collection, or on other lawful bases permitted under the DPDP Act. Your consent is free, specific, informed, and limited to the stated purpose. You may withdraw consent at any time (see Section 09); withdrawal does not affect processing already carried out lawfully before withdrawal.
07 How your data is stored and secured
- Personal and sensitive data is encrypted at rest, on both devices and servers.
- Survey data captured in the field is held on the surveyor's device only transiently. Once a completed survey is confirmed as received, the local copy is deleted from the device.
- Incomplete drafts held on a device automatically expire and are removed if not completed within a short defined window.
- Access is role-restricted: officers can view only records within their own jurisdiction, and sensitive personal fields are hidden or masked based on role.
- We maintain an append-only audit record of key actions for accountability.
08 Who we share data with
Readiness data is prepared to be shared with the food-safety administration and its official systems, as part of the platform's purpose of supporting food-safety compliance. We do not sell personal data. We do not use personal data for advertising. We do not share personal data with third parties except as required to deliver the stated purpose or as required by law.
09 Your rights as a Data Principal
Under the DPDP Act, you have the right to:
- Access a summary of the personal data we hold about you and how it is processed.
- Correct or update inaccurate or incomplete data.
- Erase your personal data where it is no longer required for the purpose.
- Grievance redressal — raise a complaint with us and receive a response.
- Nominate another individual to exercise your rights in the event of death or incapacity.
- Withdraw consent to further processing.
To exercise any of these rights, contact us using the details in Section 12.
10 Data retention
We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required to meet legal, regulatory, or food-safety administration requirements. When data is no longer required, it is deleted or irreversibly anonymised. On-device data is retained only transiently, as described in Section 07.
11 Children's data
The platform is intended for users aged 18 and above. We do not knowingly process the personal data of a child (a person under 18) without verifiable consent from a parent or lawful guardian, as required by the DPDP Act, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If we become aware that a child's data has been collected without the required consent, we will delete it.
12 Grievance redressal & contact
If you have questions about this policy, wish to exercise your rights, or want to raise a grievance about how your data is handled, please contact:
Grievance / Data Protection contact
Denny Antony
Email: contact@qualitycooktn.in
Quality Cook, Chennai, Tamil Nadu, India
We will acknowledge and respond to grievances within the timelines prescribed under the DPDP Act.
13 Changes to this policy
We may update this policy from time to time to reflect changes in law, technology, or our practices. The current version and its effective date will always be published on this page. Material changes will be communicated through the platform where appropriate.