Privacy Policy

Last updated: 10 June 2026

This Privacy Policy explains how PRPM Services Pvt. Ltd. (“OneKiraana”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use our ordering platform, website, and related services (the “Platform”). We process personal data in accordance with India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable rules.

This Platform is a business-to-business service. The personal data we process relates primarily to the individuals who register, authorise, or transact on behalf of a retailer business.

1. Data We Collect

We may collect the following categories of personal data:

  • Identity and contact data: name, mobile number, email address, and the business name and details you provide.
  • Account data: login credentials and account preferences.
  • Transaction data: orders placed, products purchased, quantities, and delivery addresses. We do not collect or store payment card or bank account details on the Platform.
  • Communications data: messages and order instructions exchanged through WhatsApp and other channels, and records of your interactions with us.
  • Cookies: first-party cookies set by our own website for site functionality, as described in Section 8. We do not collect device, location, or third-party tracking data.

2. How We Use Your Data

We use personal data to:

  • create and manage your account;
  • receive, process, confirm, and fulfil orders;
  • communicate with you about orders, deliveries, payments, and service updates;
  • provide customer support and resolve disputes;
  • operate, maintain, secure, and improve the Platform; and
  • comply with legal, tax, and regulatory obligations.

We do not carry out automated profiling or AI-based analysis of your personal data through the Platform.

We process your data on the basis of your consent and, where applicable, for the performance of our contract with you, compliance with legal obligations, and other legitimate uses permitted under the DPDP Act.

3. WhatsApp and Third-Party Messaging

Ordering and communication features are provided in part through WhatsApp, which is operated by Meta. When you communicate with us via WhatsApp:

  • your messages and number are processed through our messaging service provider, Engati, acting as our data processor; and
  • Meta processes message metadata and content in accordance with its own terms and privacy practices, over which we have no control.

4. How We Share Your Data

We do not sell your personal data. We share it only with:

  • Service providers and processors who help us operate the Platform, namely our messaging service provider (Engati) and our cloud infrastructure provider, who are permitted to use it only to provide services to us;
  • Cloud infrastructure provider: your data is hosted on Amazon Web Services (AWS) in the Mumbai (India) region;
  • Authorities and regulators where required by law, legal process, or to protect our rights; and
  • Successors in the event of a merger, acquisition, or business transfer.

5. Data Retention

We retain personal data for as long as your account remains active and for as long as necessary to fulfil the purposes set out in this Policy. Transaction and related records are generally retained for a period of eight (8) years, including to meet our legal, accounting, and tax obligations under applicable Indian law. When data is no longer required for these purposes, we delete or anonymise it.

6. Data Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission or storage is fully secure, and we cannot guarantee absolute security.

7. Your Rights

Under the DPDP Act, you have the right, subject to conditions and exceptions in the law, to:

  • access a summary of the personal data we process about you and the processing activities;
  • request correction, completion, or updating of inaccurate or incomplete data;
  • request erasure of your personal data where no longer required;
  • nominate another individual to exercise your rights in the event of death or incapacity; and
  • withdraw consent where processing is based on consent, and to raise a grievance about our handling of your data.

To exercise these rights, contact our Grievance Officer (Section 9). Withdrawing consent may limit your ability to use parts of the Platform.

8. Cookies

Our website uses first-party cookies that we set ourselves to enable core site functionality and to remember your preferences. We do not use third-party or advertising cookies. You can control or delete cookies through your browser settings; disabling cookies may affect how the website functions.

9. Grievance Officer

In accordance with the DPDP Act, you may contact our Grievance Officer for any questions, requests, or complaints regarding your personal data:

Name: Dev Makwana Email: info@onekiraana.com Address: C-107, Pawane Village Rd, Indira Nagar, MIDC Industrial Area, Turbhe, Kopri, Navi Mumbai, Maharashtra 400703 Phone: +91 93218 85935

We will respond to grievances within the timelines required under applicable law.

10. Changes to This Policy

We may update this Policy from time to time. The current version is always available at https://onekiraana.com/privacy, with the “Last updated” date reflecting the latest revision.

11. Contact

For general privacy questions:

PRPM Services Pvt. Ltd. C-107, Pawane Village Rd, Indira Nagar, MIDC Industrial Area, Turbhe, Kopri, Navi Mumbai, Maharashtra 400703 Email: info@onekiraana.com