Privacy Policy

2. What we collect and why

We collect only what we need to respond to you, run the programme and meet our legal obligations:

3. What we do not do

We do not sell your data, we do not share it for anyone else’s marketing, and we never store your full card or bank details ourselves. We ask only for what we need, and we do not collect sensitive personal data unless you choose to give it to us for a stated purpose.

4. Cookies

The website uses only the cookies and similar storage needed for it to function and stay secure. Optional analytics are off unless you consent, and we do not use advertising cookies or third-party tracking. You choose when you first visit, and can change your choice any time. Full detail is in our Cookie Policy.

5. Payments

Payments are processed by our authorised payment gateway partner. When you pay, your card or bank details are collected and handled by the gateway under its own security standards and privacy terms; we receive only a record of the transaction. See our Terms & Conditions and Refunds & Cancellations for the commercial terms.

6. Who we share data with

• •Our payment gateway, which processes payments. We do not see or store your card details.
• •Email and cloud/hosting providers that run the systems your data sits in.
• •Our accountants and auditors, for tax and audit purposes.
• •Legal advisers, and any authority where we are required by law to disclose.

7. Where your data is held

Your data is held on systems operated by us and by our cloud providers. Some providers store data outside India. Where that happens, we rely on the provider’s contractual protections and apply the same standards we would apply here.

8. How long we keep it

We keep personal data only as long as we need it for the purpose it was collected, and for as long as the law requires (for example, tax and accounting records). When we no longer need it, we delete or anonymise it. The programme privacy notice sets out specific retention periods for applicants and participants.

9. How we protect it

We restrict access on a need-to-know basis with individual credentials, log and review access, and revoke it when it is no longer needed. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

10. Your rights

You can:

• •Ask what we hold about you and get a copy (access).
• •Ask us to correct anything inaccurate or incomplete (rectification).
• •Ask us to delete data we no longer need (erasure), subject to records we must keep by law.
• •Ask us to restrict, or object to, certain uses of your data.
• •Ask for a copy of the data you gave us in a portable, machine-readable format, where that right applies.
• •Withdraw consent for anything you consented to separately, including optional cookies. This does not affect what we did before you withdrew it.
• •Nominate someone to exercise these rights on your behalf.

To exercise any of these, email legal@zrooth.com. We respond within thirty days, free of charge in normal cases. If you are not satisfied, you may complain to the appropriate data-protection authority: for the EU/EEA, your local supervisory authority; for the UK, the Information Commissioner’s Office (ICO); and in India, the Data Protection Board once it is operational.

11. Our legal bases, and international visitors

Where the GDPR applies, we rely on these lawful bases: consent (for example optional analytics cookies and the waitlist); performance of a contract (running the programme you enrolled in); legal obligation (tax and accounting records); and our legitimate interests in running, securing and improving the site, balanced against your rights. Under India’s DPDP Act we process personal data on the basis of your consent or for the legitimate uses the Act allows.

We are based in India and do not have an establishment in the EU, EEA or UK. Where we process the personal data of people in those regions, we apply the GDPR’s standards and honour the rights above regardless of where you are. International transfers are covered in section 7; we rely on appropriate safeguards such as our providers’ contractual protections. If a representative or Data Protection Officer is required for your region, we will name one; until then, contact us at legal@zrooth.com.

12. The programme

If you apply to or join the AI Entrepreneur Programme, a fuller participant privacy notice applies in addition to this policy, with the specific data, purposes and retention periods for the programme.

13. Legal framework and changes

We process personal data in accordance with applicable data-protection and privacy law. In India, that is the Digital Personal Data Protection Act, 2023 and the rules made under it, to the extent and as and when they come into force; where provisions are not yet in force, we apply the standards in this policy as a matter of policy. For visitors in the EU/EEA and the UK, we apply the EU General Data Protection Regulation (GDPR), the UK GDPR and the ePrivacy rules on cookies. If we change this policy, we will publish the new version here with an updated date.

14. Contact

Questions about your privacy? Write to legal@zrooth.com or to Zrooth Private Limited at the registered office above. For anything else, use our contact page.