Privacy Notice

1. Who we are & scope

This Privacy Notice explains how Zimorta Pvt Ltd (“Zimorta”, “we”, “us”, “our”), a company incorporated in India with its registered office at [registered office address] (CIN: [CIN]), handles the personal data of people who visit www.zimorta.com (the “Website”), join our waitlist, or use the Zimorta rights-management platform (together, the “Services”).

For the personal data processed through the Services, Zimorta is a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the applicable rules under the Information Technology Act, 2000. By using the Services, you acknowledge that you have read this notice. Where the law requires consent, we will ask for it separately and clearly.

2. Personal data we collect

We collect the following categories of personal data.

(a) Information you provide directly.

• Waitlist and enquiry details — when you join the waitlist, book a demo or contact us: your name, email address, phone/WhatsApp number, organisation, the category you identify with (e.g. talent, agency, brand), any social handle you share, and the contents of your message.
• Account details — if you become a member: your name, email, a securely hashed password, phone number, organisation, category and profile information you choose to add.
• Rights-registration data — the identity attributes and works you choose to register, which may include your facial likeness, voice recordings, name, signature, images, video and other creative works. These are core to the service you are asking us to provide.
• Preferences and commercial data — your AI-usage preferences (allow / ask / deny settings), rate cards, deal requests, licences, and creative files you upload to the Creative Studio.
• Support and correspondence — records of your communications with us.

(b) Information collected automatically. When you use the Website we may collect your IP address, device and browser type, pages viewed, referring URLs, approximate location derived from your IP, and interactions with the Services, through cookies and similar technologies (see section 5). We also process IP addresses transiently to protect the Services against abuse.

(c) Information from third parties. Where you complete a payment, our payment partner confirms the transaction status to us. Where you choose to connect or reference a public profile, we may receive the information you make available.

3. How we use your data

We use personal data to:

• operate the waitlist, review invite requests, and onboard members;
• provide the Services — maintain the rights registry, run consent checks, price usage, generate licences, detect misuse, and process payments and payouts;
• communicate with you about your account, requests, deals and service updates;
• secure the Services, prevent fraud and abuse, and enforce our terms;
• understand and improve how the Website and platform are used, using analytics;
• comply with applicable law and respond to lawful requests.

We do not sell your personal data, and we do not use your registered likeness or voice for any purpose other than delivering the Services you request.

4. Legal basis & consent (DPDP Act, 2023)

We process personal data on the basis of your consent, which under the DPDP Act must be free, specific, informed, unconditional and unambiguous, and which you may withdraw at any time (see section 10). Where permitted, we may also process data for certain legitimate uses recognised by the DPDP Act, and as necessary to perform a contract with you or to comply with law. Withdrawing consent does not affect processing already carried out, and may mean we can no longer provide part or all of the Services.

5. Cookies & tracking technologies

We use a small number of cookies and similar technologies:

• Strictly necessary — a signed session cookie that keeps you logged in and protects form submissions. The Services will not work correctly without it.
• Analytics — where enabled, Google Analytics 4 helps us understand aggregate usage.
• Marketing — where enabled, a Meta (Facebook) Pixel measures the effectiveness of campaigns.

You can control non-essential cookies through your browser settings and, where offered, opt-out tools provided by the analytics and advertising providers named above.

6. How we share data

We share personal data only as described here:

• Service providers (Data Processors) who help us run the Services under contract, including cloud hosting, email delivery, payment processing (Razorpay), analytics, deepfake-detection and AI-scanning providers you or we enable, and messaging (WhatsApp Business). They may process your data only on our instructions.
• Deal counterparties — where you enter a licensing deal, the information needed to execute it is shared with the other party to that deal.
• Legal and regulatory — where required by law, court order, or to protect rights, safety and the integrity of the Services.
• Corporate transactions — in connection with a merger, acquisition or financing, subject to this notice continuing to apply.

7. International transfers

Some of our service providers may store or process personal data on infrastructure located outside India. Where that happens, we take reasonable steps so that the data continues to be protected in a manner consistent with this notice and applicable law, including any restrictions the Central Government notifies under the DPDP Act.

8. Data retention

We keep personal data only for as long as needed for the purposes described here. Rights-registration records are retained while your account is active because they form your timestamped evidence trail; waitlist and enquiry data is retained while we evaluate and stay in touch with you. We delete or anonymise data when it is no longer required, when you ask us to (subject to legal retention obligations), or when consent is withdrawn and no other lawful basis applies.

9. How we protect your data

We use reasonable security safeguards appropriate to the sensitivity of the data, including encryption of traffic in transit, hashing of passwords, provenance watermarking of registered assets, access controls on a least-privilege basis, and monitoring for abuse. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security; we will notify you and the Data Protection Board of a personal-data breach as required by the DPDP Act.

10. Your rights

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you and how we process it;
• Correction, completion and updating of inaccurate or incomplete data;
• Erasure of your personal data where it is no longer needed;
• Withdraw consent at any time, as easily as you gave it;
• Grievance redressal from us before approaching the Data Protection Board; and
• Nominate another person to exercise your rights in the event of death or incapacity.

To exercise any of these, contact our Grievance Officer (section 14). We may need to verify your identity before acting on a request.

11. Likeness, voice & registering others

Because Zimorta exists to protect identity, we treat likeness and voice data with particular care and process it solely to deliver the registry, pricing, licensing and detection features you use. You must only register attributes and works that are your own or that you are lawfully authorised to manage; if you register or upload data relating to another identifiable person, you confirm you have the necessary rights and consents to do so, and you remain responsible for those consents.

12. Children’s data

The Services are intended for adults and are not directed at children. We do not knowingly process the personal data of a person under 18 without verifiable consent of a parent or lawful guardian as required by the DPDP Act. If you believe a child’s data has been shared with us, contact us and we will delete it.

13. Changes to this notice

We may update this notice from time to time. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Services after an update means you have read the current version.

14. Grievance Officer & contact

For any question, request or complaint about your personal data, contact our Grievance Officer:

Grievance Officer: [Name]
Zimorta Pvt Ltd
Email: privacy@zimorta.com
Registered office: [registered office address]

We aim to acknowledge grievances promptly and resolve them within the timelines prescribed under the DPDP Act and the IT Rules. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.