India-only operations — under DPDP Act 2023, IT Act 2000 + SPDI Rules 2011, and CERT-In Directions 2022.
We do not operate under foreign data-protection regimes. This page describes how to raise a grievance with us, with the Data Protection Board of India, or with CERT-In.
As required by Rule 5(9), Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.
Name
Biplav Nayak · Founder, BartLabs Technologies Pvt Ltd
Service-level
Acknowledged within 24 hours · resolved within 30 days
When to write to the Grievance Officer
- You believe Zuro is mishandling your personal or sensitive personal data.
- Your DPDP § 11 access / correction / erasure request is not actioned within the published SLA.
- You spotted an unauthorised disclosure or suspect a breach.
- You want to escalate before approaching the Data Protection Board of India.
Voluntarily appointed under DPDP Act 2023 § 10 (mandatory once Zuro is notified as a Significant Data Fiduciary).
Name
Biplav Nayak (interim) · Founder, BartLabs Technologies Pvt Ltd
Remit
DPDP Act 2023 compliance, Data Principal rights requests, breach response
Required by Direction (iv) of the CERT-In Directions, 28 April 2022.
Name
Biplav Nayak (interim) · Founder, BartLabs Technologies Pvt Ltd
Remit
6-hour incident reports to incident@cert-in.org.in under CERT-In Directions 2022
Verified cyber-incidents are reported by Zuro to incident@cert-in.org.in within 6 hours of detection, in line with Direction (ii) of the 2022 directions.
Write to our Grievance Officer
Escalate to our DPO
Approach the Data Protection Board of India
Sectoral regulators
- National Medical Commission (doctor-conduct issues): nmc.org.in
- National Health Authority (ABDM / ABHA): abdm.gov.in
- Reserve Bank of India (payment grievances): rbi.org.in (Razorpay handles PA escalation directly)
For each grievance we receive, Zuro will: log the request in the support tracker, write a row to audit_logs for the regulator-readable trail, investigate, respond with a decision within 30 days, and offer the right of appeal.
For verified breaches we will additionally notify CERT-In within 6 hours and the Data Protection Board within 72 hours, alongside any affected Data Principals — see our Data Protection page for the full incident-response timetable.