Last updated: 10 September 2026 · Applies to users in India only
DrinkWise - Digital Vault
NovaWise Innovations Private Limited (“[Service Name]”, “we”, “us”, “our”) respects your privacy and is committed to protecting it. This Privacy Policy (the “Policy”) describes the personal data we collect from you when you access or use the www.drinkWise.club website, DrinkWise - Digital Vault mobile application and other online services (collectively, the “Platform” or “Services”), the purposes for which we process it, the basis on which we do so, and the rights available to you.
This Policy is issued as a notice under Section 5 of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made thereunder, and is also intended to satisfy the requirements of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”). It should be read together with our Terms & Conditions of Service.
Our Services are offered exclusively to users located in India. We do not knowingly offer the Platform to, or process personal data of, individuals located outside India. If you are accessing the Platform from outside India, please do not submit any personal data to us.
This Policy does not apply to personal data that you provide directly to, or that is collected directly by, a third party — including a bar, pub, lounge, nightclub or other hospitality venue on-boarded on our Platform (each, a “Merchant”), a payment gateway, or a social network you use in connection with our Services. We encourage you to consult those third parties directly regarding their privacy practices.
Data Fiduciary. For the purposes of the DPDP Act, NovaWise Innovations Private Limited is the Data Fiduciary in respect of the personal data described in this Policy — that is, we determine the purpose and means of processing your personal data.
Data Principal. You, the individual to whom the personal data relates, are the Data Principal.
Merchants as independent Data Fiduciaries. Where we share your personal data with a Merchant so that the Merchant can fulfil your reservation, package, entry or order, the Merchant acts as an independent Data Fiduciary in respect of that data and is responsible for its own compliance with the DPDP Act. Any CCTV footage, door registers, in-venue Wi-Fi logs or other data captured by a Merchant at its own premises is collected by the Merchant, not by us, and is outside the scope of this Policy.
Processors. We engage third-party service providers (such as cloud hosting, payment gateways, communication and analytics providers) to process personal data on our behalf and on our instructions. We remain responsible to you for such processing and bind these providers by contract.
The Platform is an adults-only service and is not directed to children. Under the DPDP Act, a “child” is an individual who has not completed 18 (eighteen) years of age. You must be at least 18 years old to register for and operate an account on the Platform. Certain Services that relate to the consumption of alcohol are further restricted to the legal drinking age applicable in the State or Union Territory concerned, as set out in our Terms & Conditions.
Accordingly, and consistent with Section 9 of the DPDP Act:
If you believe that a person under 18 has provided us with personal data, please write to us at the address in Section 15 so that we may take corrective action.
We collect only such personal data as is necessary for the specified purposes set out in Section 5. The categories are summarised below.
| Category | Examples |
|---|---|
| Account & identity | Name, mobile number, email address, password, date of birth, gender (optional), profile photograph, city. |
| Age verification | Your declared date of birth, and — where the law or a Merchant requires it — the type and last four digits of a government-issued photo identity document. See Section 4.5 for important limitations on how we handle identity documents. |
| Booking & visit data | Reservation details (venue, date, time, party size), booth/table/VIP-area preference, bottle-service and package selections, cover-charge and guest-list entries, event and ticket bookings, special-occasion notes, dietary or accessibility requests you volunteer. |
| Transaction data | Amount, date, time and status of payments made through the Platform, invoice references, discounts and offers applied, refunds. We do not store full card numbers — see Section 4.4. |
| Loyalty & membership | Points balances, tier status, challenge and reward progress, membership subscription status and history. |
| Your content | Ratings, reviews, photographs, comments, feedback, survey responses, and support or chat correspondence with us. |
| Communications | Records of your correspondence with our support team, including call recordings made for training and quality purposes (you are notified before recording). |
| Category | Examples |
|---|---|
| Device & connection | IP address, device model and operating system, app version, unique device and advertising identifiers, mobile network information, language and time-zone settings. |
| Usage & activity | Pages and venues viewed, search terms, features used, clicks and scroll behaviour, session duration, referral source, crash and error logs, timestamps. |
| Approximate location | City- or area-level location derived from your IP address, used to show you nearby venues. |
| Precise location | GPS location, collected only where you grant the operating-system permission and only while you are using location-based features (such as “venues near me” or in-venue QR payment). You can withdraw this permission at any time in your device settings; certain features may then not work. |
| Cookies & SDKs | Cookies, pixels, SDKs and similar technologies used for authentication, preference storage, analytics and measurement. See Section 9. |
Payments made through the Platform are processed by third-party payment gateways and aggregators authorised by the Reserve Bank of India and validated as PCI-DSS compliant. We do not collect or store your full card number, CVV or PIN. Where card details are stored for repeat use, they are stored by the payment gateway in tokenised form in accordance with RBI’s card-on-file tokenisation framework, and we hold only the token and the last four digits.
In accordance with the Reserve Bank of India’s directions on the storage of payment system data, all payment data relating to transactions on the Platform is stored only on servers located in India.
Age verification at a Merchant’s premises is performed by the Merchant’s staff, not by us. Our general position is as follows:
Certain data we handle may constitute “sensitive personal data or information” under the SPDI Rules — in particular passwords and financial information. We apply enhanced safeguards to this data, including encryption in transit and at rest, and strict access controls.
We do not seek to collect health data, biometric data, caste or religious affiliation, sexual orientation, or political beliefs. Please do not volunteer such information in reviews, chat messages or special-request fields. If you choose to disclose a dietary, accessibility or medical requirement in order for a Merchant to accommodate you, we will process and share it with that Merchant solely for that purpose.
A note on inference. Because the Platform relates to bars, pubs and nightclubs, your booking history may reveal patterns about your social habits and alcohol consumption. We treat this data as confidential; we do not sell it; we do not use it to make decisions about your creditworthiness, insurance or employment; and we do not disclose it to employers, insurers or credit bureaus.
Under the DPDP Act, we may process your personal data either (a) on the basis of your consent, which must be free, specific, informed, unconditional and unambiguous and given by a clear affirmative action; or (b) for a “certain legitimate use” permitted under Section 7 of the DPDP Act. The table below sets out each purpose and the corresponding basis.
| Purpose | What this involves | Basis |
|---|---|---|
| Account creation and management | Registering you, authenticating logins, maintaining your profile and preferences. | Consent; and voluntary provision of data for a specified purpose (Section 7(a)). |
| Delivering the Services | Processing reservations, packages, cover charges, guest-list entries and ticket bookings; sharing necessary details with the Merchant; sending confirmations. | Consent; performance of the service you have requested. |
| Payments and refunds | Processing payments, adjusting Booking Fees and Cover Charges, issuing refunds, reconciling with Merchants. | Consent; compliance with legal obligation (tax and accounting records). |
| Age and eligibility checks | Confirming that you meet the applicable age requirement before permitting an alcohol-adjacent booking. | Compliance with State excise law and other applicable law (Section 7(c)). |
| Loyalty and memberships | Operating points, tiers, challenges, rewards and paid memberships. | Consent. |
| Personalisation | Recommending venues, events and offers based on your booking history and stated preferences. | Consent — you may withdraw this at any time (Section 8). |
| Marketing communications | Sending promotional messages by email, SMS, WhatsApp or push notification. | Consent — opt-out available at any time. |
| Safety, fraud and security | Detecting fraudulent bookings, payment fraud, ticket touting, abusive behaviour and account takeover; protecting users, Merchants and staff. | Certain legitimate uses (Section 7); our and our users' legitimate interests in safety. |
| Support and grievance redressal | Responding to your queries, disputes and complaints; investigating incidents. | Consent; compliance with legal obligation. |
| Analytics and improvement | Understanding how the Platform is used and improving it; primarily using aggregated or de-identified data. | Consent; legitimate use for business improvement. |
| Legal and regulatory compliance | Meeting obligations under tax, excise, consumer-protection, IT and data-protection law; responding to lawful requests. | Compliance with law (Sections 7(c)–(g)). |
We will not use your personal data for a materially different purpose without first giving you notice and, where required, obtaining your fresh consent.
Where we rely on your consent, we obtain it through a clear affirmative action — such as ticking an unticked box, tapping “Allow”, or granting a device permission. We present our consent notice in clear and plain language, and you may access it in English or in any language specified in the Eighth Schedule to the Constitution of India, as made available on the Platform.
You have the right to withdraw your consent at any time, and withdrawing consent must be as easy as giving it. You can do so as follows:
Withdrawal of consent takes effect prospectively. It does not affect the lawfulness of processing carried out before withdrawal. Where processing is necessary to complete a booking you have already made, to settle a payment, or to comply with a legal obligation, we may need to continue that specific processing notwithstanding withdrawal, and we will tell you where this is the case. Withdrawing consent that is essential to a Service may mean we can no longer provide that Service to you.
Consent Managers. Where a Consent Manager registered with the Data Protection Board of India is available, you may give, manage, review and withdraw your consent through that Consent Manager. We will honour instructions received through a registered Consent Manager.
Third-party data. If you provide us with personal data relating to another person — for example, when adding guests to a booking or a guest-list — you confirm that you have that person’s consent to share their data with us for that purpose, and you agree to indemnify us against any claim arising from your failure to have obtained it.
We do not sell your personal data. We share it only as described below.
When you make a reservation, book a package, purchase entry or buy a ticket, we share with the relevant Merchant only what that Merchant needs to serve you — typically your name, mobile number, party size, booking time, package or ticket details, any special request you have made, and your loyalty tier where a member benefit applies. The Merchant processes this data as an independent Data Fiduciary under its own privacy policy. We do not control, and are not responsible for, a Merchant’s subsequent use of that data. We encourage you to review the privacy policy of any Merchant you transact with.
We share personal data with providers who perform functions on our behalf under contract and on our instructions, including: cloud hosting and storage; payment gateways and aggregators; SMS, email, WhatsApp and push-notification providers; customer-support and ticketing tools; analytics and crash-reporting providers; fraud-prevention and identity-risk providers; and accounting and audit firms. These providers are permitted to use the data only for the purposes we specify and are required to maintain appropriate security safeguards.
We may disclose personal data where we believe in good faith that disclosure is necessary or appropriate to: comply with applicable law or a lawful order, summons, notice or direction from a court, tribunal, or a government, tax, excise, police or regulatory authority; respond to a request from the Data Protection Board of India; enforce our Terms & Conditions or investigate a suspected breach of them; detect, prevent or address fraud, security incidents or technical issues; or protect the rights, property or safety of DrinkWise - Digital Vault, our users, Merchants, staff or the public — including in an emergency involving a threat to life or personal safety.
If we are involved in a merger, acquisition, financing, reorganisation, or sale of all or part of our business or assets, personal data may be transferred as part of that transaction. We will require the acquirer to continue to honour this Policy in respect of transferred data, and we will notify you where required by law.
We may create and share aggregated, anonymised or de-identified data — such as footfall trends, popular time slots, or category-level spend patterns — with Merchants, partners and in public reporting. This data does not identify you and is not personal data. We do not attempt to re-identify such data and we contractually prohibit recipients from doing so.
Reviews, ratings, photographs and other content you choose to post publicly on the Platform, together with the display name and profile photograph associated with your account, are visible to other users and may be visible to Merchants and to the public. Please exercise care and avoid including personal details you do not wish to make public.
Your personal data is stored on servers located in India. All payment data is stored exclusively in India, in accordance with the Reserve Bank of India’s directions on the storage of payment system data.
Because our Services are offered only in India and our user base is entirely Indian, we do not, as a matter of ordinary course, transfer personal data outside India. Where a limited technical function of a service provider (for example, an email delivery or crash-reporting service) would involve processing outside India, we will: (a) restrict such transfer to countries not restricted by notification of the Central Government under Section 16 of the DPDP Act; (b) impose contractual safeguards on the recipient; (c) transfer only the minimum data required; and (d) update this Policy to reflect the position. Payment data will not be transferred outside India for storage.
We and our partners use cookies, pixels, software development kits (SDKs), mobile advertising identifiers and similar technologies to operate and improve the Platform. Broadly, we use them for four purposes:
You can manage non-essential cookies through the cookie banner or preference centre on our website, through Profile → Privacy Controls in the app, and through your browser or device settings. On mobile devices, you can reset or limit the use of your advertising identifier through your operating-system settings. Note that mobile advertising identifiers behave differently from browser cookies and cannot be deleted in the same way.
We retain personal data only for as long as is necessary for the purpose for which it was collected, and we erase it when that purpose is no longer being served and retention is not required by law — as required by Section 8(7) of the DPDP Act.
Our indicative retention periods are set out below. Where multiple periods apply to the same data, the longest applicable period governs.
| Data | Retention period | Reason |
|---|---|---|
| Account profile data | For the life of your account, then deleted within 90 days of account deletion. | To provide the Services; short buffer for reversal of erroneous deletion and backup rotation. |
| Booking and visit history | 3 years from the booking date. | Dispute resolution, loyalty accrual, and consumer-protection claims. |
| Transaction and invoice records | 8 years from the end of the relevant financial year. | Income-tax and GST record-keeping requirements. |
| Payment tokens | Until you remove the instrument, or account deletion, whichever is earlier. | To enable repeat payments at your instruction. |
| Age-verification records (where collected) | Deleted once the specific verification purpose is served. | Data minimisation; no ongoing purpose. |
| Support tickets and call recordings | 24 months from closure of the ticket. | Quality assurance, training, and complaint audit trail. |
| Public reviews and ratings | Until you delete them or your account is deleted. | Content you have chosen to publish. |
| Server, security and access logs | 180 days. | IT Rules 2021 record-keeping and security investigation. |
| Records relating to a live dispute, investigation or legal proceeding | Until final resolution plus the applicable limitation period. | Establishment, exercise or defence of legal claims. |
After the applicable period, we securely delete or irreversibly anonymise the data. Residual copies may persist in encrypted backups for a limited period until those backups are rotated out, during which time the data is not used for any live purpose.
The DPDP Act gives you the following rights in respect of your personal data. There is no fee for exercising them.
| Right | What it means and how to exercise it |
|---|---|
| Right to access | You may obtain a summary of the personal data we process about you, the processing activities undertaken, and the identities of other Data Fiduciaries and Processors with whom we have shared it, along with a description of what was shared. Request via Profile → Privacy Controls → Download My Data, or write to the Grievance Officer. |
| Right to correction, completion and updating | You may correct inaccurate or misleading data, complete incomplete data, and update data that has changed. Most fields can be edited directly in Profile → Edit Profile; otherwise write to the Grievance Officer. |
| Right to erasure | You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, unless retention is required by law. Use Profile → Account → Delete Account, or write to the Grievance Officer. |
| Right to grievance redressal | You may raise a grievance about our handling of your data or our exercise of your rights. See Section 12. |
| Right to nominate | You may nominate another individual to exercise your rights under the DPDP Act on your behalf in the event of your death or incapacity. Write to the Grievance Officer. |
| Right to withdraw consent | You may withdraw consent at any time, as described in Section 6. |
We will verify your identity before acting on a request, usually by confirming control of the registered mobile number or email address. We will respond to a rights request within 30 (thirty) days of receipt, or such shorter period as may be prescribed. If we need longer for a complex request, we will tell you why within that period.
We may decline or limit a request where: the request is manifestly unfounded, frivolous, vexatious or excessive, or is a repeat of a request we have already answered; complying would infringe the rights or safety of another person; the data is required to be retained under a legal obligation; the data relates to an existing or anticipated legal proceeding between you and us, or to an investigation into an offence or a breach of our Terms; or disclosure is otherwise restricted by law. Where we decline a request, we will tell you why and inform you of your right to complain.
Section 15 of the DPDP Act places certain duties on you. In particular, you must: comply with applicable law when exercising your rights; not impersonate another person when providing personal data for a specified purpose; not suppress any material information when providing personal data for any document, identifier, proof of identity or proof of address issued by the State; not register a false or frivolous grievance or complaint; and furnish only information that is verifiably authentic when exercising your right to correction or erasure. Breach of these duties may attract a penalty under the DPDP Act.
If you have a question, concern or complaint about how we handle your personal data, or about the way we have responded to a rights request, please contact our Grievance Officer. The Grievance Officer is designated under Section 8(9) of the DPDP Act and under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
We will acknowledge your grievance within 72 (Seventy-two) hours of receipt and endeavour to resolve it within 15 (fifteen) days, or such shorter period as may be prescribed under applicable law.
Escalation to the Data Protection Board of India. If you are not satisfied with our response, or if we fail to respond within the prescribed period, you may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act and the rules made thereunder. You must ordinarily exhaust the grievance-redressal mechanism described above before approaching the Board.
We implement reasonable security safeguards to prevent a personal data breach, as required by Section 8(5) of the DPDP Act and the SPDI Rules. These include:
In the event of a personal data breach, we will notify the Data Protection Board of India and each affected Data Principal in the form and within the timelines prescribed under the DPDP Act and the rules made thereunder. Our notification to you will describe, to the extent known, the nature and extent of the breach, its likely consequences, the measures we have taken to mitigate risk, and the steps you may take to protect yourself.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You play an important part in protecting your data: keep your password confidential, do not share your one-time passwords with anyone, use the device-lock features on your phone, and log out of shared devices. We will never ask you for your password, OTP, CVV or card PIN. If we receive instructions authenticated with your credentials, we will treat them as authorised by you.
We may amend this Policy from time to time to reflect changes in law, in our processing practices, in the features of the Platform, or in technology. The “Last updated” date at the top of this Policy indicates when it was last revised. Where a change is material — for example, a new purpose of processing, a new category of recipient, or a change to retention — we will give you prominent notice on the Platform and, where required by law, obtain your fresh consent before the change takes effect in respect of you. Your continued use of the Platform after a change takes effect constitutes acceptance of the revised Policy in respect of non-material changes.
For any question about this Policy or about how we handle your personal data, please contact us:
By using the Platform, you confirm that you have read and understood this Privacy Policy.
Questions about this policy? Contact support.
DrinkWise is available on the App Store. Android is coming soon.
