DPDPA-specific Notice.

Effective: 24 May 2026. This Notice may be updated by VB Group at any time at its sole discretion. This Notice supplements and is read together with our Privacy Notice and Cookie Policy.

1. Data fiduciary

VB Group (the "Company", "we", "us", "our") is the data fiduciary for personal data processed in connection with thezentry.com, the Zentry platform and all VB Group communication channels. References in this Notice to "you" or "data principal" mean the individual whose personal data we process.

2. Statutory scope

This Notice describes our compliance with the Digital Personal Data Protection Act, 2023 (the "Act") and the rules made thereunder, as amended from time to time. Where this Notice or any other communication grants you rights, those rights are co-extensive with and not greater than the rights conferred by the Act and applicable rules. Nothing in this Notice creates contractual or other rights beyond those statutorily conferred.

3. Lawful bases

We process personal data on the lawful bases recognised by the Act, including: (a) your consent (where consent is the applicable basis); (b) certain legitimate uses recognised by the Act and the rules; and (c) any other basis recognised by applicable law from time to time. We rely on the lawful basis most appropriate for the specific processing activity and may rely on multiple bases simultaneously.

4. Consent

Where we rely on your consent, we will provide notice of the purposes for processing and obtain your consent in the manner required by the Act. Consent obtained for one purpose extends to all reasonable and ancillary processing necessary to fulfil that purpose. By interacting with us (including by submitting a form, sending email, initiating chat, or downloading a resource), you confirm your consent for us to process the personal data you provide for the purposes set out in our Privacy Notice and at the point of collection.

5. Statutory rights of the data principal

Subject to the conditions and exemptions in the Act and applicable rules, you have: (a) the right to access certain information about the processing of your personal data; (b) the right to correction and erasure of your personal data in the circumstances permitted by the Act; (c) the right to grievance redressal through the mechanism established under the Act; and (d) the right of nomination as recognised by the Act. These rights are not absolute and are subject to the exemptions, restrictions and conditions set out in the Act. We may decline requests that are manifestly unfounded, repetitive, excessive, or that conflict with our legal or legitimate business obligations, to the extent permitted by law.

6. How to exercise statutory rights

Submit verified rights requests to connect@groupvb.com with subject line "DPDPA rights request". We require sufficient information to verify your identity and the legitimacy of the request. We may extend response timelines where additional information or verification is required, to the extent permitted by the Act. We do not undertake to fulfil rights requests beyond what the Act requires.

7. Data residency and cross-border transfers

Personal data is primarily processed and stored in India. Where the operation of the Company, our service providers or our affiliates requires processing outside India, we will undertake such transfers in accordance with applicable law. You consent to such transfers as a condition of your engagement with us.

8. Withdrawal of consent

You may withdraw consent to the extent permitted by the Act. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal and does not relieve you of obligations or liabilities that arose during the period when consent was in force. We may continue to process your personal data after withdrawal of consent where we rely on a lawful basis other than consent (including legitimate uses recognised by the Act, contractual necessity, legal obligation, or our legitimate business interests).

9. Children

We do not knowingly process personal data of children except where permitted by the Act and applicable rules. If you believe a child's data has been provided to us, contact us so we may take appropriate action under the Act.

10. Security and breach

We implement reasonable safeguards consistent with the Act. In the event of a personal data breach affecting you, we will notify the Data Protection Board and affected data principals to the extent and within the timelines required by the Act and rules. We do not warrant absolute security and disclaim liability for unauthorised access, loss or alteration of data to the maximum extent permitted by law.

11. Data Protection Officer and grievance officer

VB Group's appointed Data Protection Officer and grievance officer for the purposes of the Act is contactable at connect@groupvb.com. Grievance redressal is provided in the manner required by the Act. If you remain unsatisfied with our response, you may approach the Data Protection Board through the mechanism established under the Act.

12. Retention

We retain personal data for as long as we determine, in our sole discretion, is necessary to fulfil the purposes of processing, to comply with our legal or contractual obligations, to resolve disputes, to enforce agreements, or to maintain business records, and for such further period as is permitted by law.

13. Changes

VB Group may update this Notice at any time at its sole discretion. The current version is the version posted at this URL. Your continued engagement with us after a change constitutes your acceptance of the updated Notice.

14. Read together

This Notice is read together with our Privacy Notice, Terms of Use, and Cookie Policy. In the event of an apparent inconsistency, the document most favourable to VB Group's compliance position prevails. The disclaimers, limitations of liability, indemnification, governing law and jurisdiction provisions of our Terms of Use apply with equal force to this Notice.