Privacy Policy

Last updated: 24 May 2026

Zestbio Solutions Private Limited ("Zestbio", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (zestbiosolutions.com) or use our mobile application ("Collection Center App").

This policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 (IT Act), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Data Fiduciary Information

Entity: Zestbio Solutions Private Limited
Registered Address: [Your registered address]
Contact: privacy@zestbiosolutions.com
Grievance Officer: [Name], reachable at privacy@zestbiosolutions.com

2. Information We Collect

We collect the following categories of personal data:

• Account Information: Name, email address, phone number, role (for collection center incharges and admins)
• Farmer Information: Full name, phone number, village, address, land area
• Transaction Data: Residue type, weight, pricing, transaction dates, collection center details
• Contact Form Data: Name, email, phone, message content (from website visitors)
• Device Information: Device type, operating system, app version (mobile app only)
• Log Data: IP address, request timestamps, API endpoints accessed

3. Purpose of Data Collection

We process your personal data for the following purposes:

• Operating and managing biomass collection centers
• Recording and tracking residue collection transactions
• Managing farmer registrations and payments
• Communicating with you regarding our services
• Generating carbon credit documentation and verification
• Complying with legal and regulatory obligations
• Improving our services and user experience

4. Legal Basis for Processing

Under the DPDP Act 2023, we process your data based on:

• Consent: Explicit consent obtained at the time of data collection
• Legitimate Use: Performance of contractual obligations, compliance with law, and employer-employee relationships

5. Data Storage and Security

• Data is stored on secure cloud infrastructure (MongoDB Atlas, Vercel)
• All data transmission is encrypted using TLS/HTTPS
• Passwords are hashed using bcrypt with sufficient rounds
• Access to personal data is restricted to authorized personnel only
• We implement reasonable security practices as required under Section 43A of the IT Act

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Transaction records are retained for a minimum of 8 years for tax and audit compliance. You may request deletion of your data subject to legal retention requirements.

7. Data Sharing and Disclosure

We do not sell your personal data. We may share data with:

• Service Providers: Cloud hosting (Vercel, MongoDB Atlas), email services (Resend) — bound by data processing agreements
• Carbon Credit Registries: Anonymized/aggregated data for carbon credit verification
• Legal Authorities: When required by law, court order, or government regulation

8. Your Rights (Data Principal Rights)

Under the DPDP Act 2023, you have the right to:

• Access: Request a summary of your personal data and processing activities
• Correction: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Withdraw Consent: Withdraw previously given consent at any time
• Grievance Redressal: File a complaint with our Grievance Officer or the Data Protection Board of India
• Nominate: Nominate another person to exercise your rights in case of death or incapacity

9. Children's Data

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without verifiable parental consent, we will delete it promptly.

10. Cookies and Tracking

Our website uses essential cookies for authentication and session management. We use Vercel Web Analytics which collects only aggregated, non-personally-identifiable data. No third-party tracking cookies are used.

11. Cross-Border Data Transfer

Your data may be processed on servers located outside India (cloud infrastructure). Such transfers are conducted in compliance with the DPDP Act and applicable regulations, with appropriate safeguards in place.

12. Data Breach Notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected individuals without unreasonable delay, as required under the DPDP Act.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our services after changes constitutes acceptance of the revised policy.

14. Contact Us

For privacy-related queries, data access requests, or complaints:
Email: privacy@zestbiosolutions.com
Grievance Officer: [Name]
Address: [Registered office address]

If you are unsatisfied with our response, you may file a complaint with the Data Protection Board of India as established under the DPDP Act, 2023.