Privacy Policy
How The Zariya Collective collects, uses and protects personal data, written to the standard of India’s DPDP Act, 2023 and DPDP Rules, 2025.
Also read our Terms and Conditions.
Who we are
This Privacy Policy explains how The Zariya Collective (“we”, “us”), a venture of The Zariya Collective, Nazirabad, Kolkata, West Bengal, India, collects and uses personal data. Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the Data Fiduciary for the data described here.
The DPDP Rules, 2025 were notified in November 2025 and their obligations take effect in phases. We follow them from now, and we also follow the Information Technology Act, 2000 and the Reasonable Security Practices and Procedures Rules, 2011 while they apply. Contact: [email protected].
Effective 16 October 2026. This version replaces any earlier privacy note on this site.
Notice at a glance
The short version. The sections below give the detail.
| What | Why | Basis | Kept for |
|---|---|---|---|
| Contact details and what you tell us | To reply, quote, schedule and deliver what you asked for | Your consent, or you gave it to us voluntarily for that purpose | See “How long we keep data” |
| Newsletter email | To send articles and updates you asked for | Your consent. Withdraw any time | Until you unsubscribe |
| Account data (when accounts are available) | To let you sign in and use features | Your consent and the service you request | While the account is active, plus up to 1 year of security logs |
| Records we must keep | To meet tax, accounting and legal duties | Legal obligation | As the law requires |
We do not sell personal data. We do not run advertising or build advertising profiles. You can withdraw consent, ask for your data, correct it or delete it by writing to [email protected].
What we collect and how
We collect only what we need.
What you give us
- Messages you send us: your name, contact details and the contents of your email or WhatsApp message.
- Newsletter and updates: your email and optional name, if you subscribe.
What your browser sends automatically
When you visit, our hosting provider receives standard technical data such as your IP address, browser type, pages requested and time. This is used to deliver the site and keep it secure. We do not use it to identify you or profile you. We do not currently use analytics.
What we ask you not to send
Please do not send Aadhaar, PAN, passport, bank or card details, or passwords, by form, email or WhatsApp. We do not need them to answer an enquiry.
This page has no forms that collect more than an email address for the newsletter. The reading list links to other sites, which have their own policies.
Why we use your data and our basis
- To respond and provide what you asked for: replying to enquiries, quoting, scheduling, delivering work or training.
- To send updates you asked for: newsletters and announcements, only after you tick the consent box.
- To run and secure the service: keeping the site working, preventing abuse and fixing faults.
- To meet legal duties: tax, accounting and responding to lawful requests.
Our lawful basis is your consent (section 6 of the DPDP Act) or the “certain legitimate uses” in section 7, such as data you voluntarily gave us for a stated purpose, and compliance with law. Where we rely on consent, we ask for it separately and in plain language, and you can withdraw it as easily as you gave it.
Cookies and similar technologies
This site sets no advertising or tracking cookies. It may use your browser’s session storage for small convenience features, for example remembering that you dismissed an announcement. This holds no personal data.
When we add sign-in, we will set a strictly necessary session cookie to keep you signed in and protect your account. If we ever add analytics or any non-essential cookie, we will ask for your consent first and update this page.
Who we share data with
We share data only with service providers who help us run the site, and only as needed:
- Cloudflare, Inc. (hosting, content delivery, security, and the database behind our sign-up, enquiry and announcement system). Servers are in multiple countries.
- Resend (email delivery for confirmation and newsletter emails, United States).
- Meta Platforms (WhatsApp) when you choose to message us. WhatsApp’s own terms and privacy policy apply to that conversation.
- Google for email (Gmail) and web fonts. Loading fonts sends your IP address and browser details to Google.
- Professional advisers such as accountants and lawyers, under confidentiality.
- Authorities when the law requires it.
We do not sell, rent or trade personal data.
Transfers outside India
Some of our providers store or process data outside India. The DPDP Act allows this unless the Government restricts a country by notification. We choose providers that apply recognised security standards and we will stop transfers to any restricted country.
How long we keep data
| Data | Kept for |
|---|---|
| Messages and enquiries | 12 months after the last contact, then deleted |
| Newsletter subscribers | Until you unsubscribe or ask for deletion. After you unsubscribe we keep only your email on a suppression list so that we never email you again |
| Website server logs held by our hosting provider | As set by the provider, typically days to weeks |
| Account data (when accounts are available) | While the account is active. Accounts unused for 24 months are deleted after notice to you |
| Security and access logs | 1 year, to detect and investigate breaches, then deleted |
When the period ends or you withdraw consent, we delete the data or anonymise it, unless the law requires us to keep it. Backups are overwritten within a short period.
How we protect data
We use HTTPS, restrict administrative access with secret tokens, give staff and providers only the access they need, and keep personal data out of public pages. When accounts launch, passwords will be stored only as salted one-way hashes, and we will support stronger sign-in checks.
If a personal data breach occurs, we will tell the Data Protection Board of India and affected people as the DPDP Rules require, without delay, and tell you what happened, the likely effect and what you can do.
Children
Our services are for adults. We do not knowingly collect personal data of anyone under 18 without the verifiable consent of a parent or lawful guardian. We do not track or profile children or direct advertising at them. If you think a child has given us data, write to us and we will delete it.
Your rights and how to use them
- Access: ask for a summary of the personal data we hold about you and how we use it, and who we share it with.
- Correction and updating: ask us to correct or complete data.
- Erasure: ask us to delete data we no longer need.
- Withdraw consent: at any time. Withdrawal does not affect what we did before. Some services may stop if we cannot process the data they need.
- Grievance redressal: raise a complaint with us first (below).
- Nominate: name another person to exercise your rights if you die or become unable to.
Write to [email protected] or message +91 74396 51029 on WhatsApp from the number we hold for you. We may ask for details to confirm it is you. We aim to act within 30 days.
Accounts and sign-in
When we offer accounts, we will collect the details you give at sign-up (such as name, email and optionally phone), a password hash, and activity data needed to run the features you use (for example saved results or course progress). We will record sign-in events and device data for security. You can ask us to delete your account at any time.
We will ask for your consent in the sign-up flow, separately from our terms, and show this policy before you submit.
Email and marketing
We send marketing email only with your consent, and we use double opt-in: after you sign up we email you a confirmation link and add you to the list only once you click it. Every email has an unsubscribe link and supports one-click unsubscribe. We keep a record of when and how you consented. If you unsubscribe, we keep only your email address on a suppression list so that we do not email you again.
Links to other sites
Our pages link to other sites, including the reading list. They have their own privacy practices. We are not responsible for them.
Changes to this policy
We will update this policy when our practices or the law change. The date at the top shows the latest version. We will tell you about material changes, and where the law requires it, ask for your consent again.
Grievance redressal and complaints
Grievance Officer: The Grievance Officer, The Zariya Collective, Nazirabad, Kolkata, West Bengal, India. Email [email protected]. WhatsApp +91 74396 51029.
We acknowledge complaints within 3 working days and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India after you have used our grievance process.