What they may do · DPDP §6(4)
What Zomato (Eternal Limited) does with your data
Zomato's policy is written for the whole Eternal group, so what you do on Zomato can be shared with sister companies like Blinkit and Hyperpure, and it says AI tools look at your personal data to spot patterns and suggest things. If you delete your account, the policy still allows copies to sit in backups afterwards.
-
Shares your data with partners
Passed to group companies, advertisers or analytics firms you never chose.
What this costs you. Your number and habits travel to companies you have never heard of and never agreed to. This is the step where the spam calls start.
Show me where they say that
Zomato (Eternal Limited)’s own policy says “we may share your information with our affiliates, including entities like Blinkit and Hyperpure, as well as other current or future Eternal group companies.”
Our summary shares information with affiliates including Blinkit and Hyperpure and other Eternal group companies.
-
Builds an advertising profile of you
They watch what you view, tap and buy, and use it to decide which ads you see.
What this costs you. Your attention gets priced. What you hesitate over becomes a bid — and a profile built to predict you is a profile built to persuade you.
Show me where they say that
Zomato (Eternal Limited)’s own policy says “share your preferences or availed services (if applicable) for marketing/promotional activities, enable us to show you advertisements relevant to your likely interests”
Our summary shares preferences for marketing and promotional activity and shows advertisements relevant to your likely interests.
-
Follows you onto other websites and apps
Their tracking carries on after you leave, through pixels and SDKs embedded elsewhere.
What this costs you. You get recognised on sites that have nothing to do with them. Closing the app does not close the file.
Show me where they say that
Zomato (Eternal Limited)’s own policy says “We, and third parties with whom we partner, may use cookies, pixel tags, web beacons, mobile device IDs, "flash cookies" and other similar files or technologies to collect and store information in respect to your use of the Services and third party websites.”
Our summary it and partners use cookies, pixel tags, web beacons, mobile device IDs and similar technologies across its services and third-party websites.
-
Keeps your records long-term
Held on after you stop using the service.
What this costs you. Years after you delete the app, the record is still sitting there — and every year it sits there is another year it can leak.
Show me where they say that
Zomato (Eternal Limited)’s own policy says “Copies and backups of your personal information may continue to remain in our backup storage used for recovery in case of contingencies, as well as for enforcing our legal rights and fraud / risk mitigation purposes.”
Our summary copies and backups may remain in backup storage after deletion, for contingencies, legal rights and fraud/risk mitigation.
What the policy does not mention
These are uses Zomato (Eternal Limited)’s policy is silent on. Silence is not a promise — it means the document does not say, and we do not infer either way.
- Processes your face or other biometrics
- Trains AI models on your content
Who to write to at Zomato
Zomato’s privacy policy names a Data Protection Officer and stops there. The statutory Grievance and Nodal officers are published in a different document — the Terms of Service — which is why most guides never print them. Both are below. Note also that the company is now Eternal Limited: a notice addressed to “Zomato Limited” is addressed to a name that no longer exists.
- Grievance Officer
- Swati Chauhan Grievance Officer, Eternal Limited (formerly Zomato Limited)
- grievance@zomato.com
- Phone
- 011 41171443 Monday to Friday, 9:00 am to 6:00 pm
- Nodal Officer
- Ashwat Kumar — nodal@zomato.com
- Data Protection Officer
- privacy@zomato.com The address the privacy policy gives for questions about how your data is used.
- Post
- Pioneer Square, Ground Floor, Golf Course Extension, Gurugram, Haryana – 122102, India
- They ask you to escalate in this order
- app chat → order@zomato.com → 011 41171852 → the Grievance Officer
Show me where they publish that
Zomato’s terms of service say“Swati Chauhan Grievance Officer, Eternal Limited (formerly known as Zomato Limited) Pioneer Square, Ground Floor, Golf Course Extension, Gurugram, Haryana – 122102, India Email address: grievance@zomato.com Phone: 011 41171443”
Source zomato.com/policies/terms-of-service, read on 12 August 2026.
What you can withdraw, and what will outlive the request
Zomato’s policy is unusually explicit that deleting is not erasing. Worth knowing before you send anything, so the reply does not surprise you.
You can stop this now
- Marketing and promotional email and notifications, through the unsubscribe control.
- Commercial calls and SMS from registered senders — the 1909 / DND route under TRAI’s TCCCPR, which works today.
- Account deletion, requested through Contact Us.
This will survive it
- Backups. The policy says copies “may continue to remain” for contingencies, legal rights and fraud or risk purposes.
- Administrative, service and legal correspondence — the policy states you cannot opt out of those.
- Order and payment records, kept for contract, tax and accounting.
- Anything anonymised. The policy places de-identified data outside its scope entirely, so a withdrawal does not reach it.
One thing we will not overstate. Zomato’s policy discloses AI tools that process and analyse personal data to identify patterns and make recommendations. It does not use the word “train”, so we do not say it trains models on your content.
The legal position, stated straight. The DPDP Act’s consent-withdrawal right in section 6(4) is not in force today — sections 3 to 17 are on a staged commencement running to 14 May 2027. A request sent now asks for voluntary compliance and puts the date on record, which is what any later escalation rests on. There is no 90-day statutory erasure deadline, and the ₹250 crore figure is the penalty for failing to secure data against a breach — not for ignoring your request.
Zomato is one app. How many are on your phone?
Most people carry twenty to forty. Add yours and see the total in one screen — how many share your data, profile you for ads, or follow you across the web. Then take it back from all of them at once.
Manage my data with Saaph.in →Free to check · no account needed · built in India for the DPDP Act
Questions
What does Zomato (Eternal Limited) do with my personal data?
According to Zomato (Eternal Limited)'s own privacy policy, read on 2026-08-12, it discloses 4 of the six uses we track: shares your data with partners, builds an advertising profile of you, follows you onto other websites and apps, keeps your records long-term.
Can I withdraw my consent from Zomato (Eternal Limited)?
Section 6(4) of India's Digital Personal Data Protection Act 2023 gives you the right to withdraw consent for processing you agreed to. The Act's substantive provisions commence in stages up to May 2027, so a request made now asks for voluntary compliance and puts the date on record. Processing a company carries out under a legal obligation — such as KYC records the RBI requires — cannot be withdrawn.
Does Zomato (Eternal Limited) track me for advertising?
Yes — Zomato (Eternal Limited)'s published policy discloses this. The exact sentence it is based on is quoted on this page, with the date we read it and a link to the source.
Who is Zomato's grievance officer?
Swati Chauhan, Grievance Officer at Eternal Limited (formerly Zomato Limited), grievance@zomato.com, phone 011 41171443, Monday to Friday 9am to 6pm. The address is published in Zomato's terms of service rather than its privacy policy, which is why it is easy to miss. The Data Protection Officer is a separate address, privacy@zomato.com, and the Nodal Officer is Ashwat Kumar at nodal@zomato.com.
Every use above is one Zomato (Eternal Limited) declared in its own published privacy policy, which we
read on 2026-08-12. Quotes are verbatim; the summary beside each one is ours
and is labelled as ours. Nothing here is inferred.
Saaph.in is a DPDP consent and request management platform operated by Ronin Works
Private Limited. It is a communication facilitator, not your legal or authorised
representative. The DPDP Act 2023 commences in stages up to May 2027, so a request
made today asks for voluntary compliance and records the date you asked.
Our privacy policy