Daily99

1. Introduction

2. Identity of the Data Fiduciary

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the entity that determines the purpose and means of processing personal data is called the “Data Fiduciary”. For all personal data collected through the Platform, the Data Fiduciary is:

You, as the individual whose personal data is processed, are the “Data Principal” under the DPDP Act.

3. Personal Data We Collect

3.1 Identity and Contact Data

When you register for an account or transact on the Platform, we collect:

• Full name;
• Mobile phone number and email address;
• Date of birth (for age verification);
• Delivery addresses (including pincode, city, and state);
• Profile photograph (if you choose to upload one).

3.2 Transaction and Financial Data

When you place an Order or make a payment, we collect:

• Order details, including products, quantities, and amounts;
• Payment method type (e.g., UPI, card type); we do not store full card numbers or CVV codes;
• Transaction identifiers and payment gateway reference numbers;
• Invoice and GST-related information (including GSTIN if provided).

3.3 Device and Technical Data

When you access the Platform, we automatically collect:

• IP address, device type, operating system, and browser/app version;
• Device identifiers (IMEI, advertising ID) where permitted;
• App usage data, session duration, and navigation data;
• Crash reports and error logs.

3.4 Location Data

With your prior consent, we may collect approximate or precise location data to enable location-based features such as delivery time estimates and offline truck discovery. You may revoke location permission through your device settings at any time.

3.5 Communications Data

If you contact our customer support or Grievance Officer, we collect the content of your communications, including messages, emails, call recordings (where applicable and with notice), and attachments.

3.6 Gamification and Behavioural Data

We collect data related to your participation in Gamification Features, including Draw Entries earned and used, Coins accumulated and redeemed, spin history, contest entries, badges earned, and draw participation records.

3.7 Third-Party Sign-In Data

If you sign in using a third-party authentication provider (e.g., Google), we receive your name, email address, and profile picture as shared by that provider in accordance with your authorisations.

4. How We Collect Personal Data

We collect personal data through the following means:

• Directly from you when you register, place an Order, contact support, or interact with the Platform;
• Automatically through cookies, web beacons, pixels, and similar technologies when you use the Platform (see our Cookie Policy);
• From third-party service providers, including payment gateways, KYC verification providers, logistics partners, and analytics providers;
• From publicly available sources, where relevant and permitted by Applicable Law.

5. Purposes of Processing and Legal Basis

We process your personal data for the following purposes and on the following legal bases under the DPDP Act:

• Account creation and management: to create, verify, and maintain your account — Legal basis: Consent; contractual necessity.
• Order fulfilment: to process, fulfil, and deliver Orders and to generate tax invoices — Legal basis: Contractual necessity; legal obligation (GST Act).
• Payment processing: to process payments, detect fraud, and facilitate refunds — Legal basis: Contractual necessity; legitimate interest (fraud prevention).
• Lucky Draw Programme: to award Draw Entries, conduct the daily draw, and notify winners — Legal basis: Consent; contractual necessity.
• Customer support: to respond to your enquiries, complaints, and grievances — Legal basis: Contractual necessity; legal obligation.
• Marketing and communications: to send you promotional offers, product recommendations, draw results, and platform updates, subject to your consent preferences — Legal basis: Consent (you may withdraw at any time).
• Platform improvement: to analyse usage patterns, conduct research, and improve the Platform — Legal basis: Legitimate interest (aggregated and anonymised where possible).
• Legal compliance: to comply with applicable legal obligations, respond to court orders, and cooperate with regulatory authorities — Legal basis: Legal obligation.
• Safety and security: to detect and prevent fraud, abuse, and security incidents — Legal basis: Legitimate interest; legal obligation.

6. Consent

6.1 Obtaining Consent

Where we rely on your consent as the legal basis for processing, we will present you with a clear, specific, and informed consent request before collecting or using your data for that purpose. You have the right to refuse consent.

6.2 Withdrawing Consent

You may withdraw your consent at any time for marketing communications by unsubscribing from emails, opting out of push notifications in the App, or contacting us at privacy@daily99.com. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Note that withdrawing consent for processing that is necessary for contractual performance (e.g., order fulfilment) may affect your ability to use certain Platform features.

7. How We Share Your Personal Data

We do not sell your personal data to third parties. We share your personal data only in the following circumstances:

7.1 Service Providers and Data Processors

We share data with trusted third-party service providers who process data on our behalf and under our instructions, including:

• Payment gateway providers: to process transactions and prevent fraud;
• Logistics and delivery partners: to deliver your Orders and provide tracking information;
• KYC verification providers: to verify Vendor identity documents;
• Cloud infrastructure providers: to host and secure Platform data;
• Analytics providers: to analyse Platform usage (aggregated and pseudonymised);
• Customer support platforms: to manage support tickets and communications.

All Data Processors are required to protect your data and process it only in accordance with our instructions and Applicable Law.

7.2 Vendors

To fulfil your Order, we share your delivery address, contact number, and order details with the relevant Vendor. Vendors are required to treat your data confidentially and use it solely for Order fulfilment. Vendors are not permitted to use your data for their own marketing purposes.

7.3 Legal and Regulatory Disclosure

We may disclose your personal data to courts, regulatory authorities, law enforcement agencies, or other governmental bodies when required to do so by a valid court order, subpoena, legal process, or Applicable Law.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of Daily99’s assets, your personal data may be transferred to the successor entity, subject to appropriate privacy protections.

8. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, as required by Applicable Law, or as necessary to resolve disputes and enforce our agreements. Specific retention periods include:

• Account data: retained for the duration of your account and for up to 3 years thereafter for audit and legal compliance purposes;
• Order and transaction data: retained for a minimum of 8 years in compliance with GST and accounting laws;
• Support communications: retained for 3 years from the date of resolution;
• Marketing preferences and consent records: retained for 3 years or until withdrawn, whichever is earlier;
• Device and usage logs: retained for up to 12 months in anonymised form for analytics purposes.

When your personal data is no longer required for any applicable purpose, we will securely delete, anonymise, or aggregate it.

9. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights with respect to your personal data:

9.1 Right of Access and Summary

You have the right to obtain a summary of the personal data we hold about you and the processing activities we carry out with your data. You may submit an access request at privacy@daily99.com.

9.2 Right to Correction and Completion

You have the right to request correction of inaccurate personal data and completion of incomplete personal data. You may update most of your personal data directly through your account settings.

9.3 Right to Erasure

You have the right to request erasure of your personal data where: (a) your data is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and there is no other lawful basis for processing; or (c) your data has been processed unlawfully. Note that we may be required to retain certain data under Applicable Law (e.g., GST records) even following an erasure request.

9.4 Right to Grievance Redressal

You have the right to raise a grievance about our processing of your personal data. Please contact our Grievance Officer at grievance@daily99.com. If you are dissatisfied with our response, you may lodge a complaint with the Data Protection Board of India, once constituted under the DPDP Act.

9.5 Right of Nomination

You have the right to nominate another individual who may exercise your data rights in the event of your death or incapacity, in accordance with the DPDP Act.

9.6 Exercising Your Rights

To exercise any of the above rights, please submit a written request to privacy@daily99.com from your registered email address. We will respond within 30 days of a valid request. We may request additional information to verify your identity before processing any request.

10. Children's Personal Data

The Platform is not directed at children under 18 years of age, and we do not knowingly collect personal data from children. If you are under 18, please do not use the Platform. If we discover that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete such data. If you believe that a child has provided personal data to us, please contact us at privacy@daily99.com.

11. Security of Personal Data

Daily99 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS) encryption for all data transmissions;
• Encryption of sensitive data fields at rest using industry-standard algorithms;
• Access controls ensuring that only authorised personnel can access personal data;
• Regular security assessments, penetration testing, and vulnerability management;
• Employee training on data protection and privacy obligations.

Despite these measures, no security system is impenetrable and we cannot guarantee the absolute security of your data. In the event of a personal data breach that poses a risk to your rights, we will notify you and the relevant regulatory authority in accordance with Applicable Law.

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve your experience on the Platform. Please refer to our separate Cookie Policy (available on the Platform) for full details of the types of cookies we use, their purposes, and how to manage your cookie preferences.

13. Third-Party Links and Services

The Platform may contain links to third-party websites or services. This Policy does not apply to third-party services, and Daily99 is not responsible for the privacy practices of such third parties. We encourage you to review the privacy policy of any third-party service you access.

14. International Data Transfers

Your personal data may be processed or stored on servers located outside India, including in cloud infrastructure operated by our service providers. Where data is transferred internationally, we ensure that appropriate safeguards are in place in accordance with the DPDP Act and Applicable Law, including standard contractual clauses or equivalent protections.

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations. The revised Policy will be published on the Platform with an updated “Last Updated” date. For material changes, we will provide notice via email or in-app notification. We encourage you to review this Policy regularly. Continued use of the Platform following the effective date of any revision constitutes acceptance of the updated Policy.

16. Data Protection Officer / Grievance Officer

For all privacy-related queries, complaints, or to exercise your data rights, please contact:

We will acknowledge your request within 48 hours and respond within 30 days.

Last Updated: April 2026