Overview
Box8 (operated by Poncho Hospitality Pvt. Ltd.) is a major player in the Indian cloud kitchen and FoodTech space. Processing thousands of daily orders involves handling sensitive PII including real-time GPS locations, mobile numbers, and payment preferences. This analysis evaluates their current policy against the Digital Personal Data Protection Act (DPDP) 2023.
DPDP Readiness: Section-by-Section Analysis
Section 5 & 6 — Notice and Consent 🔴
Box8 utilizes a “deemed consent” or “bundled consent” model. By accessing the website or app, users are told they automatically agree to the privacy policy.
What the policy says: “By using our Website/App… you consent to our use and disclosure of your personal information in accordance with this Privacy Policy.”
DPDP Requirement: Section 6 requires consent to be free, specific, informed, unconditional, and an unambiguous affirmative action. The current “use equals consent” model is now legally insufficient. Furthermore, Box8 does not provide the mandatory Section 5 Notice at the time of collection, which must describe the data being collected and the purpose in plain language.
Gap: No granular checkboxes for different processing purposes (e.g., ordering vs. marketing).
Section 8 — Obligations of Data Fiduciary ✅
The policy demonstrates a strong commitment to security safeguards, which aligns with Section 8 requirements.
Strength: Box8 specifies that sensitive information (like credit card details) is encrypted during transmission via SSL technology and that data is stored on secure servers with restricted access. This meets the “reasonable security safeguards” threshold.
Section 9 — Data Retention and Erasure ⚠️
DPDP mandates that personal data must be erased as soon as the purpose for which it was collected is no longer served or consent is withdrawn.
Gap: Box8’s policy states they retain data “for as long as it is relevant for the purposes for which it was collected” or “to comply with legal requirements.” This is too broad. Under DPDP, the fiduciary must proactively ensure erasure once the specific purpose (the meal delivery) is completed, unless a specific law requires a longer hold.
Section 11 — Right to Access, Correction, and Erasure ⚠️
The policy allows users to “review and correct” their information through account settings or by contacting the Grievance Officer.
Gap: While correction is addressed, the policy does not explicitly facilitate the Right to Erasure (Right to be Forgotten) in the manner prescribed by DPDP Section 11. There is no clear workflow for a user to request the complete deletion of their profile and historical location data.
Section 14 — Right to Nominate 🔴
Critical Gap: A unique feature of the DPDP Act is the right of a Data Principal to nominate any other individual to exercise their rights in the event of death or incapacity. Box8’s policy contains no mention of nomination rights, which is a specific non-compliance under the new Act.
Section 12 — Grievance Redressal ⚠️
Box8 has appointed a Grievance Officer as per the old SPDI Rules 2011.
Gap: Under DPDP Section 12, the Data Fiduciary must provide a clear mechanism for redressal. While a contact email is provided, the policy fails to mention that if a grievance is not resolved within the stipulated time, the user has the legal right to approach the Data Protection Board (DPB) of India.
Section 16 — Transfer of Personal Data outside India ⚠️
The policy notes that data may be shared with “entities and affiliates” who may be located outside India.
Gap: DPDP Section 16 permits cross-border transfers unless the Central Government restricts them (blacklisting). However, the policy does not specify the safeguards (like Standard Contractual Clauses) used to ensure that the overseas recipient provides the same level of protection as required by the Act.
Risk Assessment
| Category | Risk Level | Impact |
|---|---|---|
| Consent Architecture | High | Non-compliance with Section 6 leads to the highest tier of penalties. |
| Data Retention | Medium | Failure to implement auto-deletion triggers for inactive accounts. |
| Principal Rights | Medium | Lack of nomination and erasure mechanisms limits consumer control. |
| Regulatory Alignment | High | References to “IT Act 2000” instead of “DPDP Act 2023” signal a lack of legal updates. |
Recommendations
- Notice Overhaul: Implement a Section 5 compliant notice that is separate from the Terms of Service, available in multiple languages if required by the rules.
- Consent Manager: Integrate a Consent Manager to allow users to manage, withdraw, or view their consent history.
- Erasure Policy: Define specific retention periods (e.g., 3 years for tax compliance, 6 months for customer service) and provide a “Delete My Data” button in the app.
- Nomination Feature: Add a field in the user profile to allow the nomination of a legal representative for data rights.