GDPR & DPDP Compliance

This page explains how ZetrikCloud handles personal data in line with two distinct legal frameworks: the EU General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act). It supplements, and should be read alongside, our main Privacy Policy.

As an Indian hosting provider, the DPDP Act applies to the personal data of all our customers by default. The GDPR additionally applies where we process personal data belonging to individuals in the EU/EEA, for example when an EU-based customer purchases hosting from us.

The GDPR and DPDP Act use slightly different terminology for the same underlying roles:

Under GDPR, we rely on the following legal bases to process your personal data:

• Performance of a contract — to deliver the hosting services you've purchased
• Legal obligation — to comply with tax, accounting, and law enforcement requirements
• Legitimate interest — for fraud prevention, security, and service improvement
• Consent — for optional marketing communications and non-essential cookies

Under the DPDP Act, processing is generally based on your explicit consent at the time of sign-up, or on "legitimate uses" recognized by the Act, such as fulfilling a contract, complying with law, or responding to a medical emergency.

If GDPR applies to you, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request erasure ("right to be forgotten"), subject to our legal retention obligations
• Restrict or object to certain processing activities
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local Data Protection Authority

As a Data Principal under India's DPDP Act, you have the right to:

• Obtain a summary of the personal data we process about you and the processing activities involved
• Request correction, completion, and updating of your personal data
• Request erasure of personal data that is no longer necessary, subject to legal retention requirements
• Nominate another individual to exercise your rights on your behalf in the event of death or incapacity
• Withdraw consent at any time, as easily as it was given
• File a grievance with our Grievance Officer, and subsequently with the Data Protection Board of India if unresolved

Customer data, including KYC documents, is primarily stored on infrastructure located within India. Where data is transferred outside India, including to EU-based customers or third-party service providers, we take steps to ensure an equivalent level of protection through contractual safeguards.

The DPDP Act permits transfer of personal data outside India except to countries specifically restricted by the Government of India. We do not transfer personal data to any such restricted jurisdictions.

In accordance with the DPDP Act, we have appointed a Grievance Officer to address data protection queries and complaints from Data Principals. EU data subjects may also use this contact for GDPR-related requests.

We aim to acknowledge grievances within 7 days and resolve them within 30 days, in line with DPDP Act timelines.

In the event of a personal data breach, ZetrikCloud will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act, and, where GDPR applies, the relevant EU supervisory authority within 72 hours of becoming aware of the breach, along with directly affected individuals where the breach poses a significant risk to their rights.

KYC documents collected under Indian hosting regulations (Aadhaar, PAN, Passport, Driving License, or GST documents) are treated as personal data under both GDPR and the DPDP Act, and are processed and retained in line with our Privacy Policy's Data Retention Policy.

Erasure requests under either framework remain subject to our legal obligation to retain certain records, including KYC documents and billing data, for a minimum period as set out in our Privacy Policy.