Privacy Policy

When you place an order

• Your name.
• Your mobile number.
• Your email address, if you give one. It is optional.
• For delivery: your delivery address and a landmark, plus the distance we calculated from it.
• What you ordered, any note you added to the kitchen, the amounts, and how you chose to pay.
• For online payments: the reference numbers the payment gateway returns to us. Never the card number, the CVV or the UPI PIN — those are entered on the gateway’s own screen and never touch our servers.

When you book a table

• Your name, your mobile number and your email address. We email a one-time code to confirm the booking is yours; the mobile number is how we reach you on the day.
• The date, time, number of guests and where you would like to sit.
• The occasion, if you tell us — a birthday or an anniversary — and any note you add. Please do not put anything sensitive in that box; it is read by the floor staff.

Your location, only if you grant it

On the checkout page you can press a button to use your device’s location so we can work out the delivery distance accurately. Your browser will ask you first. If you say no — or never press it — we estimate the distance from the pincode in your typed address instead, and everything still works. If you do grant it, we store the coordinates on that order so the rider can find you.

Automatically

Our server keeps ordinary technical logs — the IP address a request came from, the time, and which page or endpoint was asked for. We use them to keep the site up and to stop somebody hammering the one-time-password endpoint. We do not build a profile from them.

• To cook and deliver your order. Name, phone, address and items. This is the contract you entered when you ordered.
• To hold and honour your table. Name, phone, date, party size.
• To confirm you are you. The one-time code we send before a table is booked — to your email address — which stops somebody booking in your name.
• To send you the confirmation and the status updates you asked for — order accepted, out for delivery, table reminder.
• To keep our books. Bills and tax records, which we are required by law to retain.
• To recognise a returning customer so a first-order offer is used once and your name comes up when you call. This is our legitimate interest in running the restaurant.

We do not send marketing messages unless you have clearly asked for them. If we ever start a mailing list it will be opt-in, with an unsubscribe link that works.

Booking a table verifies your email address with a six-digit code, sent through the email provider that acts for us.

• The code is stored hashed, never in plain text — so nobody with access to our database can read it.
• It expires after a few minutes and can be used once.
• Five wrong attempts and the code stops working; only a few codes can be asked for at a time.
• Expired codes are deleted.

Standard SMS charges from your operator may apply to messages we send you. We never ask for an OTP over the phone — if somebody calls claiming to be from Altitude and asks you to read out a code, it is not us. Hang up and call us on the number on this site.

A handful of service providers process data on our instructions. They may use it only to provide their service to us, and not for their own purposes.

• Our payment gateway — an RBI-regulated Indian payment processor. It handles the card, UPI or net-banking transaction end to end and returns only a reference and a status to us. Your payment credentials are entered on their screen and are governed by their own privacy policy.
• Our email provider — sends booking codes and order and reservation confirmations. It sees your email address, your name and the contents of that message.
• Our SMS provider — sends one-time passwords and status updates. It sees your mobile number and the message text.
• Our hosting and database providers — the servers this site and its data run on.
• Google Maps — the map on our contact page is an embed. Loading that page loads a frame from Google, which will see your IP address under Google’s own privacy policy. Nothing about your order is passed to it.

Beyond those, we share personal data only where the law requires it — a court order, a tax authority, a police request that is properly made — or where it is necessary to establish or defend a legal claim. We will tell you if that happens, unless we are forbidden from doing so.

Our delivery riders are our own staff. Your address and phone number are shown to the rider carrying your order and to no one else.

We use no advertising cookies and no third-party analytics. There is no cookie banner on this site because there is nothing to consent to.

What the site does keep, it keeps on your own device:

• Your cart is stored in your browser’s local storage, under the key altitude-cart. It stays there so a refresh does not lose your dinner. It is not sent to us until you check out, and clearing your browser data removes it.
• Small preferences — the last order type you chose, for example — stored the same way.

The admin portal used by our staff sets a session cookie so they can stay signed in. That is strictly necessary and is not set for customers.

• Orders, bills and reservations — kept for eight years from the end of the financial year they fall in, because Indian tax and GST record-keeping requires it.
• Your customer record — name, phone, email — for as long as you order from us, and then for three years after your last order, so we can answer a question about an old bill. Then it goes.
• One-time passwords — minutes. Expired codes are purged.
• Server logs — kept short-term for security and troubleshooting, then rotated away.
• Delivery coordinates — held on the order record and covered by the same period as the order.

If you ask us to delete your data, we delete what we are free to delete and keep only what the law requires us to keep — the financial record of a bill you actually paid. We will tell you exactly what remains.

The site is served over HTTPS. Passwords for staff accounts and one-time passwords for customers are stored hashed, never in readable form. Access to the admin portal is limited by role, so a kitchen login cannot read customer records and a delivery login sees only the orders assigned to it. Payment credentials never reach our servers at all.

No system is perfect. If we ever discover a breach that is likely to affect you, we will tell you and the Data Protection Board of India, as the DPDP Act requires, and we will tell you what we are doing about it.

Under the DPDP Act 2023 you can ask us to:

• Show you what personal data we hold about you and who we have shared it with.
• Correct anything wrong, incomplete or out of date — a misspelt name, an old address.
• Erase your data, where we are not legally required to keep it.
• Withdraw consent you have given, as easily as you gave it.
• Nominate somebody to exercise these rights on your behalf if you die or become unable to.
• Complain — to us first, and to the Data Protection Board of India if we have not put it right.

Call or write to us with the mobile number you order from. We answer within 30 days, usually far sooner, and we do not charge for it. We may ask you to verify the number by one-time password first, so that nobody else can ask for your data.

This site is not intended for children under 18, and we do not knowingly collect personal data from them. Orders and bookings should be placed by an adult. Children are very welcome at the restaurant — it is the website that expects a grown-up’s mobile number and payment method.

If you believe a child has given us personal data, tell us and we will delete it promptly.

We update this page whenever what we collect or who processes it changes. The date at the top shows when it last changed. If a change is significant — a new category of data, a new purpose — we will make it obvious rather than quietly editing a line.

For anything about your data — a copy, a correction, a deletion, or a complaint — reach the restaurant directly and say it is a privacy request:

Phone

+91 84451 00365, 1:00 PM to 11:30 PM, every day

Email

altitudeagra@gmail.com

Post

Altitude Rooftop Lounge & Kitchen, Top Floor, 19E/63/1-2, 19E/63/33-34, MG Road - 2, Jaipur House, Rana Market, Parshuram Nagar, Shahganj, Agra, Uttar Pradesh 282010

If we have not resolved your complaint to your satisfaction, you may take it to the Data Protection Board of India.

Our terms of service and refunds policy sit alongside this page.