PRIVACY NOTICE & POLICY
Last Updated: May 29, 2026
Digital Personal Data Protection (DPDP) Act, 2023 — Compliant Notice
Notice to Data Principals (Users):
This document serves as a notice under Section 5 of the Digital Personal Data Protection (DPDP) Act, 2023 of India. It describes what personal data we collect, the purpose of processing, how long we retain it, and the rights available to you as a Data Principal.
By providing your personal data on this website, you consent to the processing of such data by EKAM RAGA TECHNOLOGIES PRIVATE LIMITED (operating under the brand ZAPKEYZ) for the specific and limited purposes detailed below. You may withdraw this consent at any time.
1. Data Fiduciary
The Data Fiduciary responsible for the collection and processing of your personal data is:
Legal Entity: EKAM RAGA TECHNOLOGIES PRIVATE LIMITED
Brand: ZAPKEYZ
Registered Office: Bangalore, Karnataka, India
Contact: support@zapkeyz.com
2. Personal Data We Collect
We collect only the personal data that you explicitly and voluntarily provide when interacting with our checkout and shipping pipeline:
| Data Item | Purpose of Collection |
|---|---|
| Email Address | Primary account identifier, order confirmation, and transactional communication. |
| Phone Number | Coordinating package delivery, courier notifications, and delivery-day communication. |
| Pincode | Logistics feasibility, estimated delivery date calculation, and carrier route assignment. |
| Street Address / Flat Details | Physical shipment fulfillment and last-mile delivery of your keyboard. |
| Payment Information | Processed by Razorpay (our payment gateway). We do not store card numbers, UPI IDs, or bank credentials on our servers. |
We do not collect sensitive personal data such as biometric data, health records, sexual orientation, political opinions, or religious beliefs.
3. Purpose of Processing
Your personal data is processed exclusively for the following lawful purposes under Section 4 of the DPDP Act (based on your consent):
- Order Fulfillment: Preparing, routing, and delivering your custom split keyboard hardware.
- Abandoned Cart Recovery: If you begin the checkout process but do not complete it, we may save your partially entered data and contact you via email to assist in completing the order. You may opt out at any time.
- Delivery Estimation: Calculating expected shipping dates using pincode-based regional logistics mapping.
- Transactional Communication: Sending order confirmations, shipping updates, and delivery notifications via email or SMS.
- Customer Support: Responding to your inquiries and resolving order-related issues.
We do not use your personal data for profiling, targeted advertising, or sale to third parties.
4. Data Processors & Third-Party Sharing
In accordance with Section 8(8) of the DPDP Act, the following third-party Data Processors may process your personal data on our behalf and strictly for the purposes stated above:
| Processor | Purpose | Data Shared |
|---|---|---|
| Razorpay | Payment processing | Email, phone, payment details (handled on their servers) |
| Logistics Partners (e.g., Delhivery, BlueDart) | Shipment delivery | Name, phone, full shipping address, pincode |
| Google Workspace (Sheets) | Order telemetry storage | Email, phone, pincode, address |
| Amazon Web Services (AWS) | Cloud infrastructure hosting | All data processed through our application |
Each Data Processor is contractually bound to process your data only as instructed by us and to maintain appropriate security safeguards.
5. Cross-Border Data Transfer
In accordance with Section 16 of the DPDP Act, your personal data may be transferred to and processed on servers located outside India, including but not limited to the United States and other regions where our cloud infrastructure providers (AWS, Google Cloud) operate data centres.
Such transfers are made only to countries or territories not restricted by the Central Government under Section 16(1) of the DPDP Act. We ensure that equivalent data protection safeguards are maintained regardless of where your data is processed.
6. Data Retention & Erasure
As required by Section 8(7) of the DPDP Act, we retain your personal data only for as long as necessary to fulfil the purpose for which it was collected:
- Order Data: Retained for 3 years from the date of delivery for warranty, returns, and statutory compliance.
- Abandoned Checkout Data: Automatically purged within 90 days if no order is placed.
- Payment Records: Retained by Razorpay as per RBI regulations. We do not store payment credentials.
Once the retention period expires, or upon a valid erasure request from you, your personal data is permanently deleted or irreversibly anonymized.
7. Reasonable Security Safeguards
As mandated by Section 8(4) of the DPDP Act, we implement reasonable security safeguards to protect your personal data from unauthorized access, disclosure, alteration, or destruction:
- All data in transit is encrypted via HTTPS / TLS 1.2+.
- Server-side access is authenticated through service account credentials with scoped permissions.
- Database and storage infrastructure is hosted on hardened cloud environments (AWS) with encryption at rest.
- Access to personal data is restricted to authorized personnel only on a need-to-know basis.
8. Your Rights as a Data Principal
Under Sections 11–14 of the DPDP Act, 2023, you are entitled to the following rights:
- Right to Access Information (Section 11): You may request a summary of the personal data we hold about you and the processing activities associated with it.
- Right to Correction & Erasure (Section 12): You have the right to correct inaccurate or misleading data, complete incomplete data, update outdated data, or request the complete erasure of your personal data from our systems.
- Right to Withdraw Consent (Section 6(4)): You may withdraw your consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing performed prior to such withdrawal. Upon withdrawal, we will cease processing your data and erase it unless retention is required by law.
- Right to Grievance Redressal (Section 13): You have the right to register a grievance with our Grievance Officer. If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India.
- Right to Nominate (Section 14): You have the right to nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
To exercise any of these rights, email us at support@zapkeyz.comwith the subject line “DPDP Rights Request”.
9. Processing of Children's Data (Section 9)
Our products are designed for college students, some of whom may be under 18 years of age. In compliance with Section 9 of the DPDP Act:
- We will process personal data of a child (under 18 years) only with verifiable consent from a parent or lawful guardian.
- We do not undertake any processing that is likely to cause detrimental effect on the well-being of a child.
- We do not engage in tracking, behavioural monitoring, or targeted advertising directed at children.
If you are a parent or guardian and believe your child has provided personal data without your consent, please contact us immediately at support@zapkeyz.com and we will promptly delete such data.
10. Duties of the Data Principal (Section 15)
Under Section 15 of the DPDP Act, as a Data Principal, you have certain duties including:
- Providing only accurate and complete personal data when submitting information through our forms.
- Not impersonating another person or supplying false or misleading information.
- Not filing frivolous or false grievances or complaints with the Data Fiduciary or the Data Protection Board.
11. Data Breach Notification
In the event of a personal data breach, we will notify the Data Protection Board of India and the affected Data Principals as mandated by Section 8(6) of the DPDP Act. Notification will be made in the form and manner prescribed by the Board.
12. Grievance Officer
In accordance with Section 13 of the DPDP Act, 2023, the following person has been designated as the Grievance Officer for addressing your inquiries, rights requests, and grievances:
Name: Akarsh Jain
Designation: Grievance Officer
Entity: EKAM RAGA TECHNOLOGIES PRIVATE LIMITED
Email: support@zapkeyz.com
Response Time: All grievances will be acknowledged within 48 hours and resolved within 7 working days.
If you are unsatisfied with the resolution, you may file a complaint with the Data Protection Board of India as established under Chapter 5 of the DPDP Act, 2023.
13. Changes to This Policy
We may update this Privacy Notice from time to time to reflect changes in our practices or applicable law. Any material changes will be communicated by updating the “Last Updated” date at the top of this page. We encourage you to review this page periodically. Continued use of our services after changes constitutes acceptance of the updated policy.
By continuing to use our website and providing your personal data through the checkout portal, you confirm that you have read and understood this Privacy Notice, and you freely and explicitly consent to the collection, processing, storage, and transfer of your personal data as described herein.
If you are under 18 years of age, you confirm that you have obtained verifiable consent from your parent or lawful guardian before providing your personal data.