Legal

Who we are

Zaivit is a brand of Diversacrest Private Limited, a company registered in India (CIN U46909MH2024PTC420015) with its registered office in Nashik, Maharashtra 422009, India ("Zaivit", "we", "us").

This policy explains how we handle personal data when you visit zaivit.com, contact us, request a quote or a call, subscribe to our guides, or apply for a job. For personal data we handle on behalf of partners and clients while delivering services, see the DPA summary.

For website visitors and enquiries we are the data controller (the "data fiduciary" under India’s Digital Personal Data Protection Act, 2023).

Data we collect

We collect only what you give us and what is needed to run the site:

We do not knowingly collect sensitive personal data (such as health or financial account details) through the website. Please don’t include it in messages.

How we use it, and our legal basis

Under India’s DPDP Act we process the data you voluntarily give us for the purpose you gave it, and with your consent where required. We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell or rent personal data or share it for cross-context behavioural advertising.

Who we share it with

We share personal data only with service providers that help us run the website and our business, and only for the purposes shown:

• FormSubmit: delivers website form submissions to our inbox
• Zoho Corporation: hosts our business email ([email protected])
• Cloudflare, Inc.: hosts and serves the website, keeps standard server logs and, through Cloudflare Turnstile, checks that form submissions come from a person rather than a bot (using browser and device signals and your IP address)
• Umami Cloud: cookieless website usage statistics (pages viewed, referring site, device type). It sets no cookies and stores no IP addresses
• Google (Google Analytics 4): website usage statistics, only if you accept analytics cookies. We turn off Google signals and advertising features, and Google Analytics 4 does not store full IP addresses
• Professional advisers (lawyers, accountants) and authorities where the law requires it

Links to LinkedIn and WhatsApp open those services; if you use them, their own privacy policies apply. We will update this list if we add providers, for example scheduling.

International transfers

We are based in India, and our service providers may process data in other countries, including the United States. When we transfer personal data from the UK, EU/EEA or other regions with transfer rules, we rely on appropriate safeguards where the provider offers them: the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, which Cloudflare, Zoho and Google include in their data processing terms, or an adequacy decision where one applies. FormSubmit, which relays form submissions to our inbox, does not publish where it processes data or offer such clauses; we are reviewing it and will replace it if it cannot provide adequate safeguards.

For Australian personal information, we take reasonable steps to ensure overseas recipients handle it consistently with the Australian Privacy Principles. You can ask us for more information about the safeguards we use.

How long we keep it

• Enquiries, quotes and call requests: up to 24 months after our last contact, unless you become a client
• Client and partner business contacts: for the contract term, then up to 24 months
• Subscriber emails: until you unsubscribe
• Job applications: up to 12 months, unless you join us
• Invoices and accounting records: as long as Indian law requires (generally 8 years)
• Settings stored in your browser: see the cookie policy

After these periods we delete or anonymise the data.

How we protect it

Access to our systems uses multi-factor authentication and least-privilege accounts on company-managed, encrypted devices. Our staff are bound by confidentiality agreements and trained in security every quarter. The website uses HTTPS and sends no data to third parties other than the providers listed above. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authorities as the law requires.

Your rights

Depending on where you live, you can ask us to:

• confirm whether we hold your personal data and give you a copy
• correct or complete it
• delete it
• restrict or object to how we use it, including for direct marketing
• give it to you or another provider in a portable format
• withdraw consent at any time (this doesn’t affect use before you withdrew)
• nominate someone to exercise your rights if you die or become incapacitated (India)

Email [email protected] with the subject "Privacy request". We may need to confirm your identity, and we will reply within 30 days. Exercising your rights is free and will not affect how we treat you.

If you’re unhappy with our answer you can complain to a regulator: in India, the Data Protection Board of India; in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, your local data protection authority; in Australia, the Office of the Australian Information Commissioner (oaic.gov.au). We’d appreciate the chance to resolve it first.

Children

Our website and services are for businesses. They are not directed at anyone under 18, and we do not knowingly collect children’s personal data.

Contact and grievance officer

Grievance officer and privacy contact: Darshan Savkar, Founder
Email: [email protected]
Post: Diversacrest Private Limited, Nashik, Maharashtra 422009, India

We may update this policy as our services or the law change. The "Last updated" date above shows the latest version; significant changes will be highlighted on this page.

About these terms

These terms apply to your use of zaivit.com, operated by Diversacrest Private Limited (CIN U46909MH2024PTC420015), Nashik, Maharashtra 422009, India. By using the site you accept them. Services we provide are governed by the signed agreement for those services, which takes priority over these terms.

Use of the site

• Use the site lawfully and only for legitimate business purposes.
• Don’t try to break, overload, scrape at scale, probe for vulnerabilities in, or gain unauthorised access to the site or the systems behind it. If you believe you’ve found a security issue, please report it to [email protected].
• Don’t send spam, malware or unlawful content through our forms.
• Information you submit must be accurate and yours to share.

Information on the site

Content is general information about our services, not professional advice for your situation. Prices, availability, coverage hours and service descriptions shown on the site are indicative and may change; the price and scope that apply to you are those in your written quote or agreement. We aim to keep the site accurate and available, but we don’t guarantee it is error-free or uninterrupted.

Intellectual property

The site’s content, design, text, graphics and the Zaivit name and logo belong to Diversacrest Private Limited or its licensors. You may view and share pages for your own business purposes, but you may not copy, republish or create derivative works from substantial parts of the site without our written permission. Third-party names and trademarks mentioned (for example Microsoft or Siemens) belong to their owners and do not imply endorsement.

Third-party links

The site links to third-party services such as LinkedIn and WhatsApp, and to client websites in our case studies. We don’t control them and aren’t responsible for their content or privacy practices.

Limitation of liability

To the extent permitted by law, we are not liable for any indirect or consequential loss, or for loss of profit, revenue, data or goodwill, arising from your use of the website, and our total liability for any claim relating to the website is limited to INR 10,000. Nothing in these terms limits liability that cannot be limited by law, including for fraud, death or personal injury caused by negligence, or rights you have under consumer protection laws (such as the Australian Consumer Law).

Governing law

These terms are governed by the laws of India, and the courts at Nashik, Maharashtra have exclusive jurisdiction, except that you keep any right to bring proceedings where you live if the law of your country gives you that right.

We may update these terms; the version on this page applies from its "Last updated" date. Questions: [email protected].

Our approach

This website uses no advertising or marketing cookies. It uses Google Analytics cookies only if you accept them in the cookie banner; if you reject or ignore it, none are set. It also stores a few small settings in your browser’s local storage ("similar technologies") to provide features you use or to protect the site. Those are strictly necessary, so they don’t require consent.

What we store on your device

Nothing in this storage is shared with anyone; it stays in your browser.

Our forms also use Cloudflare Turnstile to check that a person, not a bot, is sending them. It runs in a small frame from Cloudflare and may keep a short-lived security token. It is strictly necessary to protect our forms, so it doesn’t require consent, and it isn’t used for advertising or tracking across sites.

Analytics cookies

With your consent we use Google Analytics 4 to understand which pages are useful. Advertising features and Google signals are turned off.

Managing your choices

You can accept or reject analytics cookies in the banner, change your mind any time with "Cookie preferences" below (rejecting deletes the Google Analytics cookies), or clear everything through your browser’s settings ("clear site data"). Blocking local storage won’t stop the site working; it just won’t remember your settings.

Scope and roles

When we deliver services to partners and clients (for example white-label help desk work in a partner’s tools), we process personal data on their behalf: the partner is the controller (or a processor for its own clients) and Zaivit is the processor (or sub-processor). Before we handle any personal data for a partner, we both sign a Data Processing Agreement (DPA) alongside the services agreement. This page summarises its main commitments; the signed DPA governs.

Processing on instructions

We process personal data only on the partner’s documented instructions and only to deliver the agreed services, unless the law requires otherwise (in which case we tell the partner first where allowed). Our staff who handle partner data are bound by confidentiality obligations.

Security measures

• Access to partner systems only through logged, secured virtual desktops, with no downloads
• Multi-factor authentication and least-privilege access on every system; access removed the day someone leaves
• Company-managed, encrypted laptops with endpoint protection; no personal devices
• Client data stays in the partner’s systems; we keep no copies on our devices
• NDAs and quarterly security training for all staff; access limited to the named lead and backup

Sub-processors

We use only sub-processors that are bound by written data protection terms at least as protective as the DPA, and we remain responsible for them. The current list is published on our sub-processor page. We give partners advance notice of new sub-processors and the chance to object.

Breach notification

We tell the partner within 24 hours of becoming aware of any suspected incident affecting their data, and give the information and help they need to meet their own notification duties (for example the 72-hour deadline under GDPR).

Assistance and audits

We help partners respond to data subject requests and with security reviews, impact assessments and regulator enquiries. We complete security questionnaires and provide our security pack, and allow audits on reasonable notice as set out in the DPA.

Transfers and deletion

Where personal data is transferred from the UK, EU/EEA or Australia, the DPA includes the appropriate safeguards (the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and Australian Privacy Principle commitments). When services end, we remove all access the same day and return documentation within 5 business days; because client data stays in the partner’s systems, no copies remain with us.