Privacy Policy

1. Introduction and Scope

Zeno Ventures Private Limited ("Company", "we", "us", "our"), operating the ReraTracker platform at www.reratracker.com, is committed to protecting the privacy and personal data of its users. This Privacy Policy ("Policy") explains how we collect, process, store, share, and protect your personal data when you access or use our Platform, in compliance with the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and all other applicable Indian data protection laws.

This Policy applies to all users of the Platform including homebuyers, investors, NRI users, broker users, institutional users, and visitors who have not registered. By using the Platform, you ("Data Principal") provide your consent to the collection and processing of your personal data as described in this Policy. Where processing is based on consent, you may withdraw your consent at any time, subject to Section 9 of this Policy.

2. Data Fiduciary Identity

The Data Fiduciary (as defined under the DPDPA) responsible for the processing of your personal data is:

For all data-related queries, requests, or grievances, contact our Data Protection Officer at: [email protected] with the subject line: DATA PRIVACY REQUEST — RERATRACKER.

3. Personal Data We Collect

3.1 Data You Provide Directly

• Registration data: Name, email address, phone number, city of interest, and account preferences provided when you sign up or create a profile.
• Login via third-party authentication: If you sign in via Google, Apple, or other OAuth providers, we receive your name, email address, and profile picture as shared by that provider under your authorisation.
• Communication data: Messages, queries, feedback, and support requests you send us via email, WhatsApp, or the Platform's contact forms.
• Advisory engagement data: Property preferences, budget range, project interests, and other information you share with our advisory team for transaction support.
• Payment data: Transaction identifiers and billing information processed through our payment gateway partners. We do not store full card numbers, CVVs, or banking credentials.
• User Content: Reviews, feedback, property enquiries, or other content you submit through the Platform.
• KYC data: Where applicable for advisory or loan services, identity verification data processed through regulated eKYC providers. This data is processed by the eKYC provider under their own privacy framework and is not retained by the Company beyond the verification transaction.

3.2 Data We Collect Automatically

• Usage data: Pages visited, features accessed, search queries, time spent, click patterns, and session duration on the Platform.
• Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, language preferences, and referring URL.
• Location data: Approximate geographic location derived from IP address. We do not collect precise GPS location without your explicit consent.
• Cookie and tracking data: As described in our Cookie Policy.
• Log data: Server logs recording access times, requests, errors, and system activity.

3.3 Data From Third-Party and Public Sources

• RERA portal data: Project and developer information sourced from HRERA (haryanarera.gov.in) and UPRERA (up-rera.in), which are publicly available government records.
• Sub-registrar transaction data: Property transaction records sourced from government registration departments.
• Developer-submitted data: Information provided directly by developers claiming their profiles on the Platform.
• News and public records: Court orders, regulatory decisions, and media reports sourced from publicly available publications.

4. Purposes of Processing and Legal Basis

We process your personal data for the following purposes, each supported by one or more lawful bases under the DPDPA:

• Platform operation and service delivery: To register your account, authenticate your identity, provide access to features corresponding to your subscription tier, and deliver the Platform's core data and analytics services. (Lawful basis: Contract performance; Consent.)
• Advisory and transaction services: To match your investment preferences with relevant projects, facilitate advisory consultations, support deal execution, and operate our NRI and loan referral desks. (Lawful basis: Contract performance; Consent.)
• Product improvement and personalisation: To analyse usage patterns, improve our data models, develop new features, personalise your dashboard, and improve the relevance of alerts and recommendations. (Lawful basis: Legitimate interests; Consent.)
• Communications: To send you service notifications, subscription updates, payment receipts, security alerts, and product announcements. Where communications are promotional or marketing in nature, they are sent only with your consent and you may opt out at any time. (Lawful basis: Consent; Contract performance.)
• Security and fraud prevention: To detect, investigate, and prevent unauthorised access, scraping, account compromise, fraud, and other prohibited conduct. (Lawful basis: Legitimate interests; Legal obligation.)
• Legal compliance: To comply with applicable Indian laws, respond to lawful requests from government authorities or courts, and enforce our rights under these Terms. (Lawful basis: Legal obligation.)
• Analytics and research: To generate aggregated, anonymised market intelligence and research reports. No individual user is identifiable in such outputs. (Lawful basis: Legitimate interests.)

5. Data Sharing and Disclosure

We do not sell your personal data. We do not share your personal data for third-party marketing without your explicit consent. We may share your data in the following circumstances:

• Service providers and data processors: We share data with trusted third-party vendors who process data on our behalf under contractual confidentiality obligations, including cloud infrastructure providers, analytics platforms, payment gateways, email and SMS communication services, and CRM tools. These vendors process data only as instructed by us and for no other purpose.
• Advisory and transaction partners: Where you engage with our advisory services, relevant transactional data (such as project preferences and budget) may be shared with the relevant developer, banking partner, or co-advisory entity, with your consent.
• Regulatory and government authorities: We may disclose personal data to courts, law enforcement agencies, regulators, or other government authorities where required by applicable Indian law, a valid legal order, or to protect our legal rights or the safety of users.
• Business reorganisation: In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the successor entity, subject to equivalent data protection obligations. We will notify you of any such change.
• Aggregated and anonymised data: We may share aggregated, de-identified market data and analytics with media, research institutions, or industry bodies. This data does not identify individual users.

6. International Data Transfers

Our primary data infrastructure is located in India. Where we use third-party service providers whose servers are located outside India, we ensure that adequate data protection safeguards are in place as required under the DPDPA, including contractual mechanisms and compliance with any cross-border data transfer framework notified by the Government of India. We will update this section as the Central Government notifies specific countries or mechanisms for cross-border transfers under the DPDPA.

7. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide you with our services, comply with our legal obligations, resolve disputes, enforce our agreements, and maintain business records. Specifically:

• Account data: Retained for the duration of your account and for 3 years after account closure, or as required by applicable law.
• Transaction and payment records: Retained for a minimum of 8 years as required under Indian financial and tax laws.
• Usage and analytics data: Retained in anonymised or aggregated form indefinitely for product improvement and market research.
• Communication data: Retained for 2 years from the date of the communication, unless required for longer by law or dispute resolution.
• Legal hold data: Where data is subject to a legal hold, regulatory investigation, or dispute, we retain it until the matter is finally resolved.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

8. Data Security

We implement reasonable technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, and destruction, consistent with the requirements of the DPDPA, the IT Act, and the SPDI Rules. These measures include:

• Encryption of data in transit using industry-standard TLS/SSL protocols.
• Access controls and authentication mechanisms limiting internal access to personal data on a need-to-know basis.
• Regular security assessments and vulnerability testing of our Platform infrastructure.
• Contractual security obligations imposed on all third-party data processors.

No system or network can guarantee absolute security. In the event of a personal data breach that is likely to cause harm to you, we will notify the Data Protection Board of India and, where required, affected users, in accordance with the timelines and procedures prescribed under the DPDPA.

9. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data processed by us:

• Right of Access: You may request a summary of the personal data we hold about you and the processing activities we undertake.
• Right to Correction and Completeness: You may request correction of inaccurate or outdated personal data, or completion of incomplete data.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
• Right to Grievance Redressal: You have the right to have your grievance addressed by our Data Protection Officer within a reasonable time and, if not resolved, to escalate to the Data Protection Board of India.
• Right to Nominate: You may nominate another individual to exercise your data protection rights on your behalf in the event of your death or incapacity.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal. Withdrawal may affect your ability to access certain Platform features.
• Right to Opt-Out of Marketing: You may opt out of promotional communications at any time via the unsubscribe link in emails or by contacting [email protected].

To exercise any of these rights, submit a written request to [email protected] with the subject line: DATA RIGHTS REQUEST — RERATRACKER. We will respond within the period prescribed by applicable law.

10. Children's Privacy

The Platform is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we discover that we have inadvertently collected personal data from a person under 18 without verifiable parental or guardian consent, we will delete that data promptly. If you believe a minor has provided us with personal data, please contact [email protected] immediately.

11. Sensitive Personal Data

We do not intentionally collect sensitive personal data as defined under the SPDI Rules (including financial information beyond payment processing, health data, biometric data, or sexual orientation) unless specifically required for a particular service (such as eKYC for loan or advisory engagement). Where sensitive data is collected, it is done with explicit consent and subject to enhanced security controls.

12. Links to Third-Party Services

The Platform may contain links to third-party websites, services, or applications (including government RERA portals, project websites, and media publications). This Policy does not apply to third-party services. We recommend you review the privacy policies of any third-party service you access from the Platform. We are not responsible for the privacy practices or data security of third parties.

13. Cookies

We use cookies and similar tracking technologies as described in our Cookie Policy, which forms part of this Privacy Policy. Please refer to the Cookie Policy for details on types of cookies used, their purposes, and how to manage your preferences.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or Platform features. Material changes will be communicated to registered users via their registered email address at least 14 days before the change takes effect, and a notice will be displayed prominently on the Platform. The "Effective Date" at the top of this Policy will be updated accordingly. Continued use of the Platform after the effective date of the revised Policy constitutes your acceptance of the changes.

15. Grievance Officer

In accordance with the IT Act and SPDI Rules, and in anticipation of the DPDPA framework, our designated Grievance Officer for data protection matters is:

We will acknowledge receipt of your grievance within 48 hours and resolve it within 30 days of receipt, or within such period as prescribed under applicable law.