Privacy Policy

Zenith Youth Summit (“Zenith”, “ZYS”, “we”, “us”) is a student-led youth initiative based in Raipur, Chhattisgarh, India. It runs Model UN chapters and related programmes, including Zenith: Foundry. Zenith operates under the Zafirenzo umbrella.

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Zenith Youth Summit acts as the Data Fiduciary in respect of the personal data described in this policy. You are the Data Principal.

This policy applies to personal data we collect through our website at zysmun.com (and its alternate addresses), through our application and registration forms, through our newsletter sign-up, and in the course of running our events.

It does not apply to third-party websites we link to, to social media platforms where you may interact with us (those platforms have their own policies and their own controllers), or to information you choose to publish yourself.

We collect only what a specific process actually needs. Different application tracks collect different fields; the table below is the complete inventory across all of them.

Each purpose below is the only reason the associated data is used.

• Assessing your application. Application content, eligibility details, and proof of work are read by the relevant review team (the Secretariat, or for Foundry the Intake & Curation team) to decide whether to extend an invitation.
• Communicating with you. Your email address and phone number are used to acknowledge your submission, tell you the outcome, and send logistical information about an event you have been accepted to.
• Verifying who you are. Identity documents are checked at review or at on-the-day check-in to confirm that the person attending is the person who applied, and that age-related safeguards are applied correctly.
• Confirming payment. Payment evidence is checked against our records to confirm a seat.
• Obtaining guardian consent. Guardian contact details are used solely to obtain and verify parental consent for participants under 18, and to reach a responsible adult in connection with the event.
• Running the event. Allocations, committee and portfolio assignments, certificates, and attendance records.
• Sending the newsletter — only to those who signed up, and only until they unsubscribe.
• Keeping the site working and secure — aggregate analytics and security logging.

We will not use your personal data for a new purpose that is incompatible with the one it was collected for without asking you first.

Under the DPDP Act we process your personal data on the basis of the consent you give when you submit a form, having been shown this notice. That consent is free, specific, informed, unconditional, and unambiguous, and it is given by a clear affirmative action — ticking the consent box and submitting the form.

Our events are open to school and university students, so we knowingly receive applications from people under 18. The DPDP Act treats anyone under 18 as a child and imposes stricter obligations, which we follow.

• Verifiable parental consent. Where an applicant's date of birth shows they are under 18, our forms require the name, email address, and phone number of a parent or legal guardian, and we obtain that guardian's consent before the child participates. We may contact the guardian directly to confirm.
• No tracking or profiling of children. We do not undertake behavioural monitoring or tracking of children, and we do not serve targeted advertising to children. We do not serve targeted advertising to anyone.
• No detrimental processing. We do not process children's personal data in any way likely to cause a detrimental effect on their well-being.
• Minimised publication.Where a participant is under 18, we default to the most protective archive and publicity setting, and we will not publish a child's photograph or identifying details without specific guardian consent.
• Guardian rights.A parent or legal guardian may exercise every right in section 12 on the child's behalf.

The same protections apply to any person with a disability who has a lawfully appointed guardian.

We do not sell personal data. We do not rent, trade, or otherwise make it available for anyone else's marketing. Access is limited to:

• Authorised Zenith reviewers. Named members of the Secretariat and Intake & Curation team, on a need-to-know basis. Access is technically enforced — our database refuses to return another applicant's record to anyone who is not on the administrator list.
• Service providers listed in section 8, acting on our instructions as Data Processors.
• Venues and partners, where an event venue requires an attendee list for access or safety. This is limited to the names of confirmed attendees.
• Legal authorities, where we are required by law, a court order, or a lawful government request.

Sponsors and partners never receive applicant data. Where the Foundry documentation refers to partners receiving contact details, that happens only for participants who have specifically opted in.

Each provider is bound by its own contractual terms to process data only as instructed and to maintain appropriate security. We do not authorise any of them to use your data for their own purposes.

The DPDP Act requires us to erase personal data once the purpose it was collected for is served. Our schedule:

If you withdraw consent or request erasure, we act on it regardless of the schedule above, subject only to any legal obligation to retain.

We are required to take reasonable security safeguards to prevent a personal data breach. In concrete terms:

• All traffic to the site is encrypted in transit (HTTPS, with HSTS enforced). Data is encrypted at rest by our database provider.
• Access control is enforced at the database layer through row-level security policies, not merely hidden in the interface. An unauthorised request for another person's record is refused by the database itself.
• Uploaded identity documents and payment evidence are held in private storage. They are not reachable by public link. Access requires an authenticated, authorised request and produces a link that expires within minutes.
• Authentication is delegated to Google. We never receive, store, or have any means of learning your password.
• Administrative access is restricted to a small, explicitly listed set of accounts and is verified on the server for every action.
• The site sets a strict Content Security Policy and related protective headers to limit the impact of any injected content.
• Uploads are restricted by file type and size, and are validated both in the browser and at the storage layer.

No system is perfectly secure, and we will not pretend otherwise. What we commit to is applying sensible, current safeguards and fixing problems promptly when we find them.

In the event of a personal data breach, we will notify each affected Data Principal and the Data Protection Board of India in the form and manner required by the DPDP Act and its rules, without undue delay. Our notification will describe, as far as we know it: the nature and extent of the breach, when and how it occurred, the likely consequences, the measures we have taken, and what you can do to protect yourself.

As a Data Principal under the DPDP Act, you have the right to:

• Access — obtain a summary of the personal data we hold about you, how we are processing it, and the identities of anyone we have shared it with.
• Correction — have inaccurate or misleading data corrected, and incomplete data completed.
• Updating — have your data brought up to date.
• Erasure — have your personal data erased, unless retention is required for a specified purpose or by law.
• Withdrawal of consent — at any time, as easily as you gave it.
• Grievance redressal — a readily available means of raising a complaint with us, described in section 14.
• Nomination — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

Email Zenithyouthsummit@gmail.com from the email address associated with your application, with the subject line “Data request”, and tell us which right you wish to exercise.

Using your registered address helps us verify that the request is genuinely yours; if we cannot verify it, we may ask you one or two further questions rather than release data to the wrong person. We aim to respond within 30 days. Exercising these rights costs nothing.

If you are under 18, your parent or legal guardian should make the request on your behalf.

If you are unhappy with how we have handled your personal data or a data request, you may raise a grievance with our Grievance Officer.

We will acknowledge your grievance within 7 days and aim to resolve it within 30 days. If you remain dissatisfied after exhausting this route, you may complain to the Data Protection Board of India.

We use only what the site needs to function. Specifically:

• Authentication cookies set by Supabase to keep you signed in. Without them you would be signed out on every page.
• Aggregate analytics via Vercel Analytics, which reports page views and performance without building a per-visitor profile.

We do not use advertising cookies, third-party marketing trackers, social media pixels, or cross-site tracking of any kind. You can clear or block cookies in your browser; blocking the authentication cookie will prevent you from signing in.

Zenith: Foundry produces a record of each edition — the Foundry Archive and Builder Index. When you apply to Foundry you choose an archive tier, and we honour that choice:

You can change your tier or withdraw from the archive at any time by emailing us, including after the event. Photography and filming may take place at events; we will tell you at the venue, and you may ask not to be photographed. For participants under 18, the Limited tier applies by default and images are published only with specific guardian consent.

Our database and uploaded files are stored in the Asia-Pacific (Tokyo) region. Our hosting, email, and content providers operate globally and may process data outside India. We rely on their contractual commitments to protect it. We do not transfer personal data to any country that the Central Government has restricted under the DPDP Act.

We may update this policy as our processes change or the law develops. The “last updated” date at the top always reflects the current version. Where a change materially affects your rights or introduces a new purpose, we will notify affected applicants by email and, where the law requires it, seek fresh consent.

For anything in this policy — questions, requests, or complaints — write to Zenithyouthsummit@gmail.com. We would rather hear from you directly than have you go unanswered.