Privacy Policy — India

Privacy Addendum for India

This addendum supplements the ZhiYin global privacy policy with requirements specific to India. Where this addendum conflicts with the global policy, this addendum takes precedence for users located in India.

Regulatory Authority

Data Protection Board of India

Applicable legislation: Digital Personal Data Protection Act 2023 (DPDP Act)

Data Residency

Government may notify certain categories of data that must be processed within India.

Breach Notification

The DPDP Act requires notifying each affected individual and the Data Protection Board of India without delay, with detailed information to the Board within 72 hours of becoming aware of the breach.

ZhiYin aligns its incident-response process with these requirements and will notify the relevant regulatory authority and affected individuals within the timeframe required by applicable law.

Data Retention

Data must be erased when consent is withdrawn or when the specified purpose is met, unless retention is required by law.

Your Rights in India

In addition to the rights outlined in our global privacy policy, users in India have the following specific rights under local law:

• Right to access personal data and obtain a summary
• Right to correction and erasure of inaccurate data
• Right to grievance redressal
• Right to nominate a representative