1. Who We Are

This Privacy Policy explains how Zenora Hub ("Zenora," "we," "us," "our") collects, uses, shares, and protects personal data of visitors to zenorahub.com, participants in our programmes (including the Corporate Sustainability Leadership Programme and Young Changemakers), and users of our tools (including the BRSR Readiness Scanner). Zenora Hub is the Data Fiduciary for the personal data described in this policy under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and its Rules.

2. What We Collect

• Identity and contact data: name, email address, phone/WhatsApp number, organisation, job title, industry, years of experience.
• Programme data: CSLP application details, webinar registration responses, payment and billing information, attendance and assessment records.
• Tool usage data: responses submitted to the BRSR Readiness Scanner, delivered via WhatsApp.
• Technical data: IP address, browser/device type, pages visited, referral source, and cookies (see Section 4).
• Communications: messages sent via WhatsApp, email, or our contact/inquiry forms.

3. Why We Collect It

• To respond to inquiries, process CSLP applications, and administer programme delivery.
• To send programme updates, webinar invitations, and marketing communications you can opt out of at any time.
• To operate, personalise, and improve the website and our advertising.
• To meet legal, tax, and regulatory obligations.

Wherever we ask you to submit personal data through a form, we will make clear at that point what we are collecting it for. We only use it for that stated purpose, and we retain it only as long as reasonably necessary for that purpose or as required by law.

4. Cookies, Remarketing & Advertising Disclosures

This section applies specifically because Zenora runs paid advertising, including through Meta.

• Third-party vendors, including Google & Meta, may show our ads on sites across the internet, using cookies and similar identifiers based on your prior visits to zenorahub.com.
• We use Google Analytics, including its Advertising Features, to understand site usage and to build remarketing audiences.
• You can opt out of personalised advertising via Google Ads Settings, your browser's cookie controls, or the Network Advertising Initiative opt-out.
• We do not upload raw personal identifiers (such as email addresses) to advertising platforms except through privacy-safe, hashed mechanisms (such as Google Customer Match), and only where you have separately consented to marketing communications.

A cookie consent banner allowing you to accept or decline non-essential (advertising/analytics) cookies is presented on your first visit. Essential cookies required for the site to function are not covered by this control.

5. Who We Share Data With

• Delivery partners for CSLP, including TERI-SAS and Firstpost, limited to what is necessary to co-deliver the programme.
• Service providers: hosting (Netlify), email delivery (Zoho Mail), payment processing, WhatsApp Business messaging, and analytics/advertising platforms (Google, Meta, LinkedIn).
• Regulators or authorities, where legally required.

We do not sell personal data.

6. Your Rights

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Request correction, completion, or erasure of your personal data.
• Withdraw consent at any time, as easily as you gave it.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Lodge a grievance with us in the first instance, and with the Data Protection Board of India if unresolved.

7. Children's Data

Where Young Changemakers or any other programme involves participants under 18, we apply additional safeguards described in our Young Changemakers Safeguarding Policy, including verifiable parental/guardian consent before collecting any personal data, and we do not use children's data for behavioural advertising or tracking-based profiling.

8. Data Security & Retention

We apply reasonable technical and organisational safeguards to protect personal data against unauthorised access, alteration, or loss, and access is limited to personnel who need it to perform their role. We retain personal data only for as long as needed for the purpose it was collected, or as required by applicable law, after which it is securely deleted or anonymised.

9. Grievance Officer

We aim to acknowledge all grievances within 7 business days and resolve them within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last revised" date at the top of this page. Continued use of the site after changes take effect constitutes acceptance of the revised policy.