Privacy Policy

This Privacy Policy explains how eR4u Technologies Pvt. Ltd. ("Zotaki", "we", "us" or "our") collects, uses, shares and protects personal data when you visit www.zotaki.com (the "Website"), contact us, or use the Zotaki hotel management and restaurant software and related services (the "Services").

We handle personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Capitalised terms not defined here have the meaning given in our Terms and Conditions.

Contents

1. Our role
2. Personal data we collect
3. How we use personal data
4. How we share personal data
5. Guest data processed for our customers
6. Cookies and third-party content
7. Storage, security and breaches
8. How long we keep data
9. Your rights
10. Marketing communications
11. Children
12. Links to other websites
13. Changes to this policy
14. Grievance Officer and contact

1. Our role

We play two different roles, depending on whose data it is:

• As a data fiduciary, we decide how and why we process the personal data of Website visitors, people who enquire about or request a demo of Zotaki, and the account holders and Users of our customers. This policy describes that processing.
• As a data processor, we process personal data that our customers (hotels, restaurants and other properties) enter into the Services about their own guests, staff and suppliers. For that data, the property is the data fiduciary and decides how it is used. See section 5.

2. Personal data we collect

Information you give us

• Enquiries and demo requests: your name, property name, email address, mobile number, number of rooms, property type and any message you send.
• Account and billing: names, email addresses and phone numbers of account holders and Users; business name, billing address and GSTIN; and records of the Plan, invoices and payments. Card, UPI and bank details are handled by our payment partners; we do not store full card numbers.
• Communications: the content of calls, emails, WhatsApp messages and support requests you exchange with us.

Information collected automatically

• Website: technical information sent by your browser, such as IP address, browser and device type, pages visited and the date and time of your visit, recorded in our server logs.
• Services: login records, audit logs of actions taken in your account, and technical information about the devices and browsers used to access the Services, which we need for security, support and troubleshooting.

3. How we use personal data

We use personal data only for the following purposes:

• to respond to your enquiry, arrange and conduct a demo, and send you the information you asked for;
• to set up, provide, maintain and support the Services, including onboarding and training;
• to issue invoices, collect payments and keep accounting and tax records;
• to send service messages, such as renewal reminders, security notices and changes to our terms;
• to keep the Website and the Services secure, prevent fraud and misuse, and investigate incidents;
• to understand how the Services are used, in aggregated form, so that we can improve them;
• to send you information about Zotaki products and offers, where you have agreed to receive it (see section 10); and
• to comply with applicable law, and with lawful requests from government and regulatory authorities.

We process personal data on the basis of your consent, or for the specified purpose for which you voluntarily gave it to us, or as otherwise permitted by applicable law. Where we rely on consent, you can withdraw it at any time; this does not affect processing already carried out.

4. How we share personal data

We do not sell personal data. We share it only as follows:

• Service providers who help us run our business, such as cloud hosting, email, SMS and WhatsApp messaging, website form handling, payment processing and customer-support tools. They may use the data only to provide their services to us and must keep it confidential and secure.
• Integrations you enable, such as online travel agencies, channel-manager connectivity, payment gateways, WhatsApp messaging providers, food aggregators and accounting software. Data is shared with them on your instruction, and their use of it is governed by their own policies.
• Legal and safety reasons, where we are required by law, court order or a lawful request from a government authority, or where disclosure is necessary to protect the rights, property or safety of Zotaki, our customers or others.
• Business transfers, in connection with a merger, acquisition or sale of all or part of our business, subject to equivalent protection of your data.

5. Guest data processed for our customers

Properties use Zotaki to record reservations, guest details, identity documents, invoices and similar information about their guests. For this data:

• The property is responsible for collecting it lawfully, telling guests how it is used and obtaining any consent required. If you are a guest, please contact the property directly with any request about your data.
• We process it only to provide the Services to that property and in line with its instructions and our Terms and Conditions. We do not use it to market to guests and we do not sell it.
• Features such as role-based access, masking of Aadhaar numbers and configurable retention help properties limit who can see sensitive information and how long it is kept.
• We will assist properties, where reasonably required, in responding to requests from their guests and in meeting their obligations under applicable law.

6. Cookies and third-party content

The Website uses a small number of cookies and similar technologies that are needed for it to work and to remember basic preferences. The Services use cookies to keep you signed in and to protect your account. You can block or delete cookies in your browser settings, but parts of the Website or the Services may then not work properly.

Some pages include content from third parties: fonts served by Google Fonts, and demo videos from YouTube, which load only when you choose to play them. These providers may receive your IP address and set their own cookies under their own privacy policies. Links to WhatsApp open WhatsApp's service, which is governed by its own policy.

If we introduce analytics or advertising tools on the Website, we will update this policy before doing so.

7. Storage, security and breaches

Personal data is hosted on secure cloud infrastructure operated by reputable providers. Where data is stored or processed outside India, we do so only as permitted under applicable Indian law.

We use reasonable security practices and procedures to protect personal data, including encryption of data in transit, access controls and role-based permissions, regular backups, monitoring, and confidentiality obligations on our staff and service providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If a personal data breach occurs, we will take prompt steps to contain it and will notify affected customers, individuals and the relevant authorities as required by law.

8. How long we keep data

• Enquiry and demo data is kept while we are in discussion with you and for a reasonable period afterwards, unless you ask us to delete it sooner.
• Account and billing records are kept for the duration of the subscription and afterwards for as long as required by tax, company and other applicable laws.
• Customer Data in the Services is kept for the duration of the subscription and handled at the end of it as set out in our Terms and Conditions.

When personal data is no longer needed, we delete or anonymise it, unless we are required by law to retain it.

9. Your rights

Subject to applicable law, you have the right to:

• obtain a summary of the personal data we hold about you and how it is processed;
• request correction, completion or updating of inaccurate or incomplete personal data;
• request erasure of personal data that is no longer needed for the purpose it was collected, unless we must retain it by law;
• withdraw consent you have given, at any time;
• nominate another person to exercise your rights in the event of your death or incapacity; and
• have your grievances addressed by us, and, if you are not satisfied with our response, to complain to the Data Protection Board of India.

To exercise these rights, contact our Grievance Officer (see section 14). We may need to verify your identity before acting on a request. If your request concerns guest data held by a property, please contact that property, which is responsible for it.

10. Marketing communications

With your consent, we may contact you by email, phone, SMS or WhatsApp about Zotaki products, offers and updates. You can opt out at any time by using the unsubscribe option in the message, replying "STOP", or writing to sales@zotaki.com. We will still send service messages that relate to your account.

11. Children

The Website and Services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

12. Links to other websites

The Website may link to websites and services we do not operate. We are not responsible for their content or privacy practices, and we encourage you to read their privacy policies.

13. Changes to this policy

We may update this Privacy Policy from time to time. The updated policy will be posted on this page with a new effective date, and we will notify customers of material changes by email or within the Services.

14. Grievance Officer and contact

If you have a question, request or complaint about this policy or about how we handle personal data, please contact our Grievance Officer:

Grievance Officer, eR4u Technologies Pvt. Ltd.
451 & 452, 4th Floor, Pacific Business Center, Above D Mart, Hoshangabad Road, Bhopal, Madhya Pradesh — 462026, India
Email: sales@zotaki.com · Phone: +91-9893095791

We will acknowledge your grievance promptly and aim to resolve it within one month of receiving it.