Privacy Policy

Zenith HR Solutions Private Limited (“Zenith,” “Company,” “we,” or “us”) is the Data Fiduciary as defined under Section 2(i) of the Digital Personal Data Protection Act, 2023 (“DPDP Act”). We determine the purpose and means of processing your personal data in connection with our website and leadership advisory services.

This Privacy Policy applies to:

• All visitors to www.zenithhr.co.in and any associated subdomains.
• Candidates and professionals who submit personal data through our contact, careers, or inquiry forms.
• Corporate clients, hiring organisations, and their representatives.
• Any third party whose Personal Data Zenith receives in connection with providing its leadership advisory services.

Under Rule 3 of the DPDP Rules 2025, notice must itemise the categories of data collected. Zenith collects the following personal data, limited to what is necessary for each purpose:

In accordance with GDPR-standard transparency and DPDP Act Section 6, we process personal data only for specified, explicit purposes on a documented lawful basis:

Under Rule 3 of the DPDP Rules 2025, Zenith provides this itemised notice at or before the point of personal data collection. Consent is obtained separately and in an unambiguous, freely given manner.

• Consent is obtained at or before the time of data collection via explicit opt-in checkboxes on all forms.
• Where processing relies on legitimate interest, a Legitimate Interests Assessment (LIA) is conducted and documented.
• You may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.
• Zenith will work with registered Consent Managers (where applicable under the First Schedule of DPDP Rules 2025) to facilitate consent withdrawal.

Under Chapter III of the DPDP Act 2023, you hold the following rights as a Data Principal. To exercise any right, contact us at Updates Soon.

Zenith does not sell personal data. Data may be disclosed only in the following strictly controlled circumstances:

• To prospective hiring organisations or clients, solely in connection with a specific live search mandate and with the candidate's awareness.
• To affiliated business partners for employment-related search purposes under matching confidentiality obligations.
• To judicial, governmental, or regulatory authorities when legally mandated.
• To acquirers or successors in the event of a merger, acquisition, or sale of business assets — each bound by equivalent data protection terms.
• To third-party service providers (e.g. CRM, analytics, IT vendors) under data processing agreements that contractually require adequate protection.

Where Zenith transfers personal data outside India — for instance, to international clients, global executive search partners, or cloud service providers — such transfers are conducted:

• Only to countries or entities notified as permissible by the Central Government under Rule 15 of the DPDP Rules 2025.
• Subject to contractual data protection obligations at least equivalent to those under the DPDP Act.
• With your prior consent where the transfer relates to your personal profile or candidacy.

Personal data is retained only for the period necessary for its purpose or as mandated by law:

Upon expiry, personal data is securely deleted, anonymised, or archived in accordance with the Third Schedule of the DPDP Rules 2025.

Zenith implements the following specific technical and organisational safeguards, as required under Rule 6 of the DPDP Rules 2025:

• Encryption of personal data at rest (AES-256) and in transit (TLS 1.2+).
• Role-based access controls (RBAC) limiting personal data access to authorised staff only.
• Structured audit logging of all access to personal data records.
• Regular automated and manual security testing of web infrastructure.
• Secure offsite and cloud backups with versioned recovery capability.
• Annual staff awareness training on data protection responsibilities.

This website and Zenith's services are intended for users aged 18 years and above.

• If you are under 18, you must obtain verifiable consent from a parent or lawful guardian before submitting any personal data, in accordance with Rules 10–12 of the DPDP Rules 2025.
• Zenith does not knowingly collect personal data from minors. If we become aware that data has been collected from a person under 18 without appropriate guardian consent, it will be promptly deleted.
• For persons with disabilities, a lawful guardian may exercise Data Principal rights on their behalf. Supporting documentation may be required.

You may raise a grievance regarding this Policy by contacting our designated Grievance Officer. We will acknowledge your grievance within 48 hours and resolve it within 30 days.

This Policy may be updated periodically to reflect changes in law, our services, or processing practices. Material changes will be communicated via email or a prominent notice on the website.

Last Updated:July 2026  · Version:2.0  · Effective Date: July 2026