ZipZy® Compliance Statement

The ZipZy® Services are designed and operated with regard to applicable Indian legislation and internationally recognised privacy and security practices.

• Digital Personal Data Protection Act, 2023 and applicable Rules.
• Information Technology Act, 2000.
• SPDI Rules, 2011.
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
• Consumer Protection Act, 2019 and related E-Commerce Rules, where applicable.
• Central Goods and Services Tax legislation.
• Indian Contract Act, 1872.
• TRAI commercial communication and DLT requirements for Messaging Services.

For Customers operating internationally, our contractual framework is structured to support compliance with the GDPR and UK GDPR through the Data Processing Addendum.

Our privacy programme has been designed to operate consistently with the Digital Personal Data Protection Act, 2023.

3.1 Data Roles. We act as Data Fiduciary for information relating to our own Customers and prospective Customers, and as Data Processor for Personal Data processed on behalf of Customers.

3.2 Notice and Transparency. We provide privacy notices explaining the categories of Personal Data collected, purposes of processing, applicable retention periods, available rights, and contact details for our Privacy Team and Grievance Officer.

3.3 Consent. Consent is obtained through clear affirmative action, recorded, and may be withdrawn using mechanisms that are substantially as easy as those used to provide consent.

3.4 Legitimate Uses. Where processing occurs without fresh consent, we rely only upon legitimate uses expressly recognised under applicable law and document the legal basis.

3.5 Data Fiduciary Obligations. We implement reasonable security safeguards, maintain grievance procedures, publish required contact details, notify Personal Data Breaches where required, and erase Personal Data when no longer necessary for the stated purpose.

3.6 Children's Data. The Services are intended for persons aged 18 years or older. We do not knowingly process children's Personal Data or undertake behavioural monitoring directed at children.

3.7 Significant Data Fiduciary. If designated as a Significant Data Fiduciary, we will comply with all additional statutory obligations, including independent audits and Data Protection Impact Assessments where required.

3.8 Individual Rights. We support access, correction, completion, erasure, nomination, and grievance redressal through self-service features and direct support channels.

3.9 International Transfers. Cross-border transfers occur only where appropriate contractual safeguards are in place and applicable legal requirements are satisfied.

3.10 Breach Notification. Where required by law, we notify affected individuals and relevant authorities without undue delay following confirmation of a qualifying Personal Data Breach.

3.11 Consent Managers. We support requests received through authorised Consent Managers where applicable under the DPDP framework.

Our operational and security controls are designed to satisfy the obligations imposed under the Information Technology Act, 2000 and related subordinate legislation.

4.1 Reasonable Security Practices. We maintain documented security controls, privacy practices, and administrative safeguards proportionate to the sensitivity of the information processed.

4.2 Intermediary Obligations. We maintain published policies, an appointed Grievance Officer, defined complaint handling procedures, and content handling processes intended to preserve applicable statutory protections.

4.3 Grievance Redressal. Customers may contact our Grievance Officer using the procedures described in the Privacy Policy and other applicable legal policies.

Although Pranava Company Group is not established within the European Economic Area, our contractual framework and operational controls are structured to support Customers that are subject to the GDPR and UK GDPR.

5.1 European Representative. We do not currently appoint an Article 27 representative. Customers requiring additional contractual arrangements should contact privacy@zipzy.in.

Current Status: Aligned, not certified.

Our Information Security Management practices are structured using the ISO/IEC 27001:2022 framework. We do not currently claim ISO/IEC 27001 certification.

6.1 Certification. Achieving certification requires completion of an accredited external audit, a fully operational Information Security Management System, documented management review processes, and internal audit activities. We will publicly state certification only after it has been formally achieved.

Current Status: Readiness in progress. No SOC 2 report is currently available.

We are preparing for a future SOC 2 Type II examination covering selected Trust Services Criteria.

7.1 Remaining Work. Formal readiness assessment, auditor selection, evidence collection, and the required observation period remain in progress.

7.2 Current Position. We do not represent ourselves as SOC 2 compliant or certified until an independent audit has been completed and a report has been issued.

The Security Policy remains the authoritative description of our security programme. Key practices include:

• Encryption of data in transit and at rest using modern cryptographic standards.
• Multi-factor authentication support together with role-based access controls.
• Least-privilege access management and periodic access reviews.
• Network protection, monitoring, web application firewall, and DDoS mitigation.
• Secure software development lifecycle including code review and dependency scanning.
• Centralised logging, monitoring, and security event investigation.
• Data Backups together with documented business continuity and disaster recovery procedures.
• Documented incident response processes and vulnerability management.
• A published Vulnerability Disclosure Policy supporting responsible security research.

We are committed to maintaining appropriate control over where Customer Personal Data is stored and processed.

9.1 Primary Storage. Customer Personal Data is primarily stored on infrastructure located within India.

9.2 Backups. Data Backups copies are maintained within the AWS Asia Pacific (Mumbai) Region as part of our business continuity programme.

9.3 Limited International Processing. Certain processing activities, including network protection, monitoring, customer support tooling, and AI-powered features, may involve approved subprocessors operating outside India. Such processing occurs only with appropriate contractual and legal safeguards.

9.4 Enterprise Commitments. Enterprise Customers requiring contractual data residency commitments may contact privacy@zipzy.in to discuss available arrangements.

Our financial operations are conducted in accordance with applicable Indian taxation and accounting requirements.

• GST-compliant invoices are issued in accordance with applicable Indian tax legislation.
• Payments are processed through authorised third-party payment providers.
• Pranava Company Group does not store full payment card numbers, CVV values, or banking credentials.
• Recurring payments follow applicable RBI requirements where relevant.
• Financial records are retained in accordance with applicable statutory retention obligations.

Additional information is available in the Billing Policy.

Certain ZipZy® products may be used in regulated industries. Customers remain responsible for ensuring that their own regulatory obligations are satisfied.

11.1 HRMS Module. Customers using the HRMS platform remain responsible for employment, payroll, labour, and workplace compliance applicable to their organisation.

11.2 Messaging Module. Customers are responsible for obtaining valid consent, complying with DLT registration requirements, sender ID obligations, TRAI regulations, and similar telecommunications requirements in applicable jurisdictions.

11.3 Regulated Industries. The Services are general-purpose business software and are not currently certified for specialised healthcare, payment card, or government cloud compliance frameworks. Customers should independently assess suitability before processing regulated information.

11.4 High-Risk Activities. The Services are not designed for life-critical, safety-critical, or other high-risk operational environments as described in the Acceptable Use Policy.

Our compliance programme is supported through documented governance processes, assigned responsibilities, and periodic review.

• The Privacy Team oversees the privacy programme, data protection obligations, and rights requests.
• Engineering leadership is responsible for information security governance and operational security controls.
• Suppliers with access to Personal Data undergo security assessment before onboarding and periodic review thereafter.
• Personnel receive security and privacy awareness training during onboarding and at regular intervals.
• Policies and compliance documentation are reviewed periodically and updated following material legal, regulatory, or operational changes.

Subject to appropriate confidentiality obligations where necessary, we may provide Customers with additional compliance documentation upon request.

• Security whitepapers and control summaries.
• Completed security questionnaire responses.
• Penetration testing summary reports.
• Executed Data Processing Addendum and transfer documentation.
• Current Subprocessor List.
• Data flow and residency documentation.
• Business continuity and disaster recovery summaries.
• Incident response programme overview.
• Relevant records of processing activities.
• Deletion confirmation following account closure where applicable.

Documentation requests may be submitted to security@zipzy.in or privacy@zipzy.in.

The table below summarises the current compliance and certification status of the ZipZy® Services as of the publication date of this Statement.

This Compliance Statement is reviewed periodically and updated whenever our legal obligations, security programme, certification status, or operational practices change materially.

Certification claims are added only after the relevant certification has been formally awarded. Alignment with a framework should not be interpreted as certification unless expressly stated.

Privacy Team
Prince Tyagi
privacy@zipzy.in

Registered Office
Pranava Company Group (ZipZy®)
62, Mandola, Loni
Ghaziabad, Uttar Pradesh 201102
Bharat (India)

Related Policies: Security Policy • Privacy Policy • Data Processing Addendum • Subprocessor List Policy • Data Retention Policy • Vulnerability Disclosure Policy.

We remain committed to transparency regarding our compliance programme. Where we claim compliance, alignment, readiness, or certification, those statements accurately reflect our status as of the publication date of this Statement.