Legal
Privacy Policy
Last updated: 16 September 2026
This policy is a standard-structure draft prepared to align with the Australian Privacy Principles (Privacy Act 1988 (Cth)). It should be reviewed by a qualified Australian lawyer before being treated as final or legally binding.
This page covers customers — anyone using our website, account dashboard, or (in future) customer app. If you're a Delivery Partner (driver) using our Delivery Partner app, see our Delivery Partner Privacy Policy instead — it covers the additional information collected from that app (location, proof-of-delivery photos, payroll and vehicle/compliance details).
1. Who we are
Mumbai Dabbawala ("we", "us", "our") operates a meal-subscription service delivering home-style dabbas in Perth, Western Australia. This policy explains how we collect, hold, use and disclose personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
Registered business name: Mumbai Dabbawala, operated by INDIAN DABBAWALA PTY LTD. ABN: 71 698 497 602. ACN: 698 497 602. Registered address: 2 Elmwood Ct, Marangaroo WA 6064, Australia.
2. Personal information we collect
Depending on how you interact with us (browsing, joining the waitlist, subscribing, managing your account, or contacting support), we may collect:
- Identity details — name, date of birth (if provided)
- Contact details — email address, mobile number, delivery/pickup address
- Account credentials and authentication data (e.g. one-time codes, session tokens)
- Order and subscription details — plan, meal preferences, allergens/dietary flags, delivery history
- Payment information — processed by our payment provider (Stripe); we do not store full card numbers ourselves
- Communications — support enquiries, feedback, poll responses, marketing consent preferences
- Technical data — device/browser information and analytics cookies, only where you have given consent (see our Cookie Consent banner)
- Device push-notification token — only where you have granted notification permission on your device, used to send order and delivery status updates
We do not collect precise location from a customer's own device — a customer's real-time driver-tracking map is populated from the Delivery Partner's location (see our Delivery Partner Privacy Policy), not the customer's device.
3. How we collect it
We collect personal information directly from you — joining our waitlist, creating an account, placing an order, completing checkout, contacting support, or responding to a poll or feedback request. Where reasonable and practicable, we collect information directly from you rather than from third parties.
4. Why we collect, hold, use and disclose it
We use personal information to:
- Create and manage your account and subscription
- Process orders, payments, billing and refunds
- Plan and deliver meals, including managing allergen and dietary safety
- Provide customer support and respond to enquiries or complaints
- Show you your delivery's real-time progress on your account dashboard
- Send transactional communications (order confirmations, OTP codes, delivery updates, billing notices)
- Send marketing communications, but only where you have given consent — you can withdraw this consent at any time (see section 8)
- Improve our service, including via analytics — only where you have given cookie consent
- Meet our legal, financial and regulatory obligations, including tax and consumer-law record-keeping
5. Disclosure of personal information
We may disclose personal information to third parties who help us operate the service, including payment processors (e.g. Stripe), email/SMS delivery providers, delivery/logistics staff and contractors, and IT hosting providers. We require these providers to protect your information consistently with the APPs. We do not sell personal information. We do not disclose personal information overseas except where a service provider we use processes data outside Australia as part of providing that service (e.g. a hosting or email-delivery provider) — in that case we take reasonable steps to ensure the overseas recipient does not breach the APPs.
6. Data security
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure, including access controls, encryption in transit, and staff role-based permissions. No system is completely secure, and we cannot guarantee absolute security.
7. Access, correction and deletion
You can view and update most of your personal information (name, contact details, addresses, allergens) directly from your account at /account/settings. You may also:
- Request a copy of the personal information we hold about you
- Ask us to correct inaccurate or out-of-date information
- Close your account, which anonymises your profile — financial and order records are retained only as long as required by law (e.g. tax record-keeping)
To make an access, correction or deletion request that isn't available self-service, contact us using the details in section 10.
8. Marketing communications and cookies
We only send marketing/promotional emails to customers who have opted in. Every marketing email includes an unsubscribe mechanism, and you can also withdraw consent at any time from your account notification preferences. Our website uses a cookie consent banner — analytics and advertising cookies are only loaded after you actively accept them, and you can reject or change this choice at any time.
9. Complaints
If you believe we have breached the APPs or mishandled your personal information, you can lodge a complaint using the contact details in section 10. We will acknowledge your complaint and aim to resolve it within a reasonable time. If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
10. Contact us
For any privacy question, access/correction request or complaint, contact us at support@mumbaidabbawala.com.au or by post at 2 Elmwood Ct, Marangaroo WA 6064, Australia.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision.
