Privacy Policy of Renzue

1. Introduction and Scope

1.1. This Privacy Policy ("Policy") is published by Renzue Media ("we", "us", "our"), the owner and operator of https://www.renzue.com ("Renzue", the "Platform"). It explains what personal information we collect, why we collect it, how we use and share it, how we protect it, and what rights you have over it.

1.2. Renzue is a news and discussion platform publishing editorial articles and hosting user-generated content, including comments, community posts, and discussions. We act as an "intermediary" under Section 2(1)(w) of the Information Technology Act, 2000; as a "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 ("DPDP Act") where that Act applies; as a "Data Controller" under the EU General Data Protection Regulation and the UK GDPR; and as a "business" under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). Our intermediary due-diligence and grievance-redressal duties under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("Intermediary Guidelines") apply alongside this Policy.

1.3. This Policy applies to all visitors, registered users, commenters, contributors, and subscribers who access Renzue by any means ("you"). It covers data collected directly from you, data collected automatically, and data received from third parties that help us operate the Platform. It does not cover anonymous, aggregated, or de-identified data that cannot reasonably be linked to you, nor third-party sites you reach through our links (see Section 13).

1.4. Our use of cookies and similar technologies is summarised here and detailed in our separate Cookie Policy, which forms part of this Policy. By using Renzue you acknowledge this Policy. Where applicable law requires your prior, free, specific, informed, unconditional, and unambiguous consent, we obtain it as described in Section 5 before processing. If you do not agree with this Policy, do not use the Platform.

2. Definitions

2.1. "Personal Data"means data about an identifiable individual, however identified (also called "personal information" in some jurisdictions). It includes your name, email address, account credentials, IP address, device identifiers, approximate location derived from your IP address, your posts and comments, and records of your activity on the Platform.

2.2. "Data Principal"means the individual to whom Personal Data relates under the DPDP Act; broadly equivalent to "data subject" under the GDPR or "consumer" under the CCPA/CPRA.

2.3. "Data Fiduciary"means a person who determines the purpose and means of processing Personal Data under the DPDP Act; broadly equivalent to "Data Controller" under the GDPR.

2.4. "Data Processor" means a person who processes Personal Data on behalf of a Data Fiduciary or Data Controller under a written contract and on documented instructions.

2.5. "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, retrieval, restriction, erasure, and destruction, whether automated or not.

2.6. "Consent" means a free, specific, informed, unconditional, and unambiguous indication of wishes by clear affirmative action, signifying agreement to Processing for a specified purpose. Consent obtained through coercion, deception, pre-ticked boxes, or bundling with unrelated purposes is not valid.

2.7. "Child" means an individual below eighteen years of age under the DPDP Act. Other age thresholds (for example, under the GDPR or US law) are stated expressly where they apply.

2.8. "Personal Data Breach" means any unauthorised processing of, or accidental disclosure, acquisition, sharing, alteration, destruction, or loss of access to, Personal Data that compromises its confidentiality, integrity, or availability.

2.9. "Grievance Officer" means the officer we designate under Rule 3(2) of the Intermediary Guidelines to receive and acknowledge user complaints and grievances.

2.10. "Notice" means the privacy notice we present at or before collection, summarising the data to be collected, the purposes, the lawful basis or Consent relied upon, your rights, and how to contact us or the Grievance Officer.

4. How We Use Data

4.1. We process Personal Data only for the purposes below (or compatible ones) and only on a valid legal basis. Where Consent is required, we obtain it as described in Section 5.

4.2. Providing and operating the Platform. Account data, posted content, device data, and cookies are used to create and administer your account, authenticate you, display your content, enable comments and discussions, remember preferences, and deliver requested pages and features. Basis: performance of our contract with you (Terms of Use); Consent under the DPDP Act.

4.3. Safety, moderation, and integrity. Account data, posted content, device and log data (including IP addresses), and correspondence are used to detect and address fraud, spam, harassment, abuse, and policy violations; to review user-reported or automatically flagged content; to enforce warnings, suspensions, and bans; and to meet intermediary due-diligence duties, including removing unlawful content on actual knowledge through a court order or a notification from an appropriate government authority. Basis: legitimate interests (a safe, trustworthy Platform); legal obligation; Consent where required.

4.4. Personalisation. Reading history, preferences, and interactions are used to recommend articles, surface relevant discussions, and order comment threads. Basis: Consent (via account preferences or cookie choices, withdrawable at any time); legitimate interests where consent is not required and personalisation is a reasonably expected core feature.

4.5. Analytics and product improvement. Pseudonymised analytics and device data are used to measure performance, fix bugs, test features, and plan capacity. Basis: legitimate interests; Consent for analytics cookies where required.

4.6. Communications. Contact details are used for service messages necessary to the Platform (verification emails, password resets, security alerts, moderation decisions, responses to requests and grievances, and notices of material policy changes). Newsletters and promotional messages are sent only with your subscription or consent, and each contains an unsubscribe mechanism. Basis: contract performance or legitimate interests (service messages); Consent (marketing); legal obligation (breach notifications, grievance responses).

4.7. Legal compliance. Data is used and retained as needed to comply with laws, regulations, court orders, and lawful authority requests; to establish, exercise, or defend legal claims; to handle Intermediary Guidelines grievances; and to meet tax, accounting, and record-keeping duties. Basis: legal obligation; legitimate interests (defence of claims).

4.8. Marketing and advertising. We do not currently sell advertising involving your Personal Data. If that changes, we will update this Policy first, obtain required consents (we do not target advertising at children), and honour opt-outs including Do Not Sell or Share requests. Basis: Consent; legitimate interests for non-targeted, contextual advertising.

4.9. Automated decision-making. We do not use solely automated decision-making, including profiling, with legal or similarly significant effects. Automation is limited to spam and abuse detection, moderation triage, and recommendation ranking; significant actions such as account suspension involve human review. Article 22 GDPR rights may be exercised via Section 11.

4.10. We will not use your data for a materially different purpose without prior notice and, where the law requires it, fresh consent.

5. Consent

5.1. Where the DPDP Act or other applicable law requires Consent, we obtain it through clear affirmative action: an unchecked box you tick, an "I agree" button clicked after reading a Notice, or a choice in our cookie consent tool. Consent is never inferred from silence, pre-ticked boxes, or inactivity, and is never bundled across unrelated purposes.

5.2. Before or at collection we give you a Notice identifying the data, the specific purpose, the services provided on that basis, how to exercise your rights (including withdrawal), and how to reach us, the Grievance Officer, or the Data Protection Board of India. The Notice is in clear, plain language.

5.3. You may withdraw Consent at any time, as easily as you gave it: through account settings, the cookie consent tool, the unsubscribe link in marketing emails, or by writing to privacy@renzue.com identifying the processing concerned. We act on withdrawals promptly and within applicable statutory timelines.

5.4. Withdrawal is prospective: it does not affect the lawfulness of earlier processing. After withdrawal we stop processing for that purpose and delete or anonymise the data unless another lawful basis requires retention (for example, a legal record-keeping duty or defence of claims), in which case we will tell you which basis and why. If withdrawal makes a requested service impossible (withdrawing consent for account data ends your account), we explain that consequence before you confirm; we never penalise you beyond the loss of the affected service.

5.5. Where processing rests on another basis (contract, legal obligation, legitimate interests), withdrawal does not apply, but objection, restriction, or erasure rights under Section 11 may.

6. Children's Data

6.1. Renzue is a general-audience platform not directed at children. Under the DPDP Act a "Child" is under eighteen, and we do not knowingly process a child's Personal Data without verifiable consent of a parent or lawful guardian, obtained through reasonable verification steps.

6.2. We do not track or behaviourally monitor children and do not direct targeted advertising at them. Where our checks indicate a user is a Child, processing is limited to what is strictly necessary to provide the requested service with parental consent, under heightened safeguards.

6.3. In the EEA we apply the applicable Member State's digital-consent age (no lower than thirteen), requiring holder-of-parental-responsibility consent below it. In the United States we do not knowingly collect personal information from children under thirteen, consistent with the Children's Online Privacy Protection Act (COPPA).

6.4. A parent or guardian who believes a child provided data without required consent should contact privacy@renzue.com with enough detail to identify the account or data. We investigate promptly and delete data collected without required parental consent, confirming deletion to the requester. Parents or guardians may exercise the child's data rights on the child's behalf, subject to verification of the relationship.

7. How We Share Data

7.1. We do not sell your Personal Data. We share it only as described here, and only as necessary for the stated purpose. Service providers and Data Processors act under written contracts limiting them to our instructions and purposes, with appropriate security measures.

7.2. Service providers and Data Processors. We use reputable providers for: (a) cloud hosting, databases, and backups; (b) content delivery networks; (c) analytics; (d) email and notification delivery; (e) support and ticketing tools; (f) security services including bot-mitigation, fraud detection, and DDoS protection; and (g) payment processing, if paid features are ever introduced. Providers are vetted, contractually bound to security standards, and prohibited from using your data for their own purposes.

7.3. Content you make public. Information you publish in public areas (comments, posts, replies, public profile fields) is visible to other users by your choice and may be indexed by search engines or shared by others. You control what you publish and may edit or delete your own public content, subject to Section 9.

7.4. Legal disclosures. We may disclose Personal Data where we in good faith believe it necessary to: comply with law, regulation, legal process, or an enforceable government request (including court orders and notifications from an appropriate government authority under the Information Technology Act, 2000); enforce our Terms of Use; detect or address fraud, security, or technical issues; or protect the rights, property, or safety of Renzue, users, or the public, as permitted by law. Where legally permitted we notify you before disclosure in response to a third-party request so you may seek relief, unless prohibited or an emergency involving danger of death or serious injury applies.

7.5. Business transfers. In a merger, acquisition, reorganisation, asset sale, or insolvency, your Personal Data may transfer as part of the transaction. We will give notice (for example, by email or prominent Platform notice) and ensure the recipient honours this Policy or obtains your consent before materially different practices, as required by law.

7.6. With your consent. We share data for purposes not described here only with your clear, specific consent, withdrawable under Section 5.

7.7. No sale or sharing for behavioural advertising.We do not sell Personal Data or share it for cross-context behavioural advertising under the CCPA/CPRA. Our "Do Not Sell or Share My Personal Information" page confirms this and explains how to contact us if you believe otherwise. If practices change, we will update this Policy and that page first and will honour opt-outs, including Global Privacy Control signals, within 15 business days.

8. International Transfers

8.1. Renzue is operated from India, where our primary infrastructure and records sit. Because we serve a global audience and use providers in different countries, your data may be transferred to, stored in, or processed in other countries with differing data protection laws.

8.2. EEA and UK: transfers outside the EEA or UK rely on Chapter V GDPR (and UK GDPR) safeguards: an adequacy decision for the destination country, approved standard contractual clauses (supplemented where needed by additional measures), or another recognised mechanism. You may request the relevant safeguard documentation from privacy@renzue.com, subject to redaction of confidential commercial information.

8.3. India: transfers outside India comply with the DPDP Act, including any Central Government notifications restricting transfers to particular countries, which we monitor and implement.

8.4. Regardless of destination, recipients are contractually required to protect your data to a standard consistent with this Policy, including encryption in transit and at rest where appropriate.

9. Retention

9.1. We keep Personal Data only as long as necessary for the purposes in Section 4, and thereafter only on another legal basis, such as a legal obligation, dispute resolution, agreement enforcement, or defence of claims. We do not retain data indefinitely and we review retention periodically.

9.2. Retention decisions weigh: the purpose and whether it is ongoing; whether your account or relationship is active; legal, tax, and accounting duties; limitation periods for claims; your consent status; and whether data can be anonymised or aggregated.

9.3. Typical retention periods (legal duties or case-specific circumstances may require otherwise, and we will tell you if a different period applies):

• (a) Account data: life of the account, plus up to 24 months after closure or deletion for reactivation requests, disputes, and fraud prevention, then deleted or anonymised.
• (b) Public content (comments, posts, replies): as long as the thread or page exists, since removing one participant's contributions can render discussions incoherent. On account deletion, public content is disassociated from your identity (attributed to a generic "deleted user") unless you ask us to delete the content itself, which we do except where law requires retention or a legal hold applies.
• (c) Device and log data: server and security logs up to 12 months, then deleted or aggregated; longer where a security investigation is ongoing.
• (d) Cookie and analytics data: up to 13 months in identifiable form, then only aggregated or anonymised, per our Cookie Policy.
• (e) Support and grievance correspondence: up to 36 months after closure, to evidence grievance-redressal compliance and defend claims.
• (f) Consent records: for the duration of processing plus up to 36 months, as evidence of valid Consent.
• (g) Newsletter data: until you unsubscribe, plus up to 12 months as a suppression record to avoid re-emailing you by mistake.
• (h) Payment records (if paid features are introduced): as required by tax and financial law, typically up to 8 years.

9.4. On expiry we delete the data or render it anonymous using methods appropriate to the medium. Backups containing deleted data are overwritten on normal rotation, ordinarily within 90 days.

9.5. You may request earlier deletion under your erasure right (Section 11); we comply unless an exception above or in applicable law requires retention, in which case we explain why.

10. Security Measures

10.1. We implement reasonable technical and organisational measures against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access, consistent with Section 8(4) of the DPDP Act, Rule 6 of the DPDP Rules, 2025, and Article 32 of the GDPR.

10.2. Technical measures: TLS encryption in transit and encryption of sensitive stored data at rest; strong salted hashing for passwords; firewalls, intrusion detection, and DDoS mitigation; regular patching of our application stack, dependencies, and infrastructure; tested backup and restoration procedures; access logging and anomaly monitoring; and pseudonymisation or minimisation of analytics data where feasible.

10.3. Organisational measures: need-to-know access limited to personnel and contractors who require it; confidentiality obligations for all personnel with access; documented data-handling, incident-response, and secure-development policies; security due diligence and contractual requirements for processors; periodic security reviews; and an incident response plan covering containment, assessment, and breach notification (Section 12).

10.4. You share responsibility for security: keep credentials confidential, use a strong unique password, and notify privacy@renzue.com promptly of suspected unauthorised access.

10.5. No internet transmission or electronic storage is completely secure. We work hard to protect your data but cannot guarantee absolute security. If we learn of a breach affecting you, we notify you and the relevant authorities per Section 12.

12. Breach Notification

12.1. On learning of a Personal Data Breach we contain it, assess scope and likely consequences, mitigate harm, preserve evidence, and notify the required parties within statutory timelines under our incident response plan.

12.2. India (DPDP Act s. 8(6); DPDP Rules, 2025, Rule 7):we notify each affected Data Principal without delay, in clear plain language, describing the breach's nature and extent, likely consequences, our mitigation measures, protective steps the individual can take, and follow-up contact details. We inform the Data Protection Board of India without delay with initial details, followed by a detailed report within 72 hours of becoming aware (or longer if the Board permits), covering circumstances and root causes, remedial measures, findings on responsibility, and a summary of principal notifications. CERT-In directions separately require certain cyber incidents, including data breaches, to be reported within six hours; we run both tracks concurrently.

12.3. EEA and UK (GDPR Arts. 33-34):where a breach risks individuals' rights and freedoms, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness. Where the risk to you is high, we notify you without undue delay, describing the breach, likely consequences, and measures taken or proposed, unless an exception applies (for example, the data was appropriately encrypted).

12.4. California and elsewhere: we notify affected individuals and authorities as required by applicable breach-notification laws and timelines.

13. Third-Party Links

13.1. Renzue links to third-party sites, articles, videos, and social pages, and embeds third-party content such as social posts or video players. Those parties operate independently; their data practices are governed by their own privacy policies, not this one.

13.2. We are not responsible for third-party privacy practices, content, or security. Review the privacy policy of any external site before giving it your data; a link does not imply endorsement.

13.3. Where embedded content may set its own cookies or collect interaction data, our Cookie Policy identifies this and, where the law requires, we obtain your consent before it loads.

14. Changes to This Policy

14.1. We may update this Policy to reflect changes in practices, services, or law. For material changes we revise the "Last Updated" date and give additional notice where appropriate, such as a Platform banner or email to registered users, before the changes take effect.

14.2. Where the law requires consent to a material change (for example, a new processing purpose), we obtain it before applying the change to your data. Continued use after the effective date constitutes acknowledgement of the updated Policy, except where consent is required.

14.3. Review this Policy periodically. Prior versions are available on request to privacy@renzue.com.

15. Contact Us

15.1. Questions, concerns, or requests about this Policy or our data handling:

15.2. Grievance Officer (India): Sohail, grievance@renzue.com, Bengaluru, Karnataka, India (acknowledgement within 24 hours; resolution within 15 days under the Intermediary Guidelines).

15.3. Data Protection Officer / Privacy Contact: privacy@renzue.com.

15.4. We aim to respond within a reasonable time and within applicable statutory timelines. If unsatisfied, you may complain to the Data Protection Board of India, your national data protection authority, the UK Information Commissioner's Office, or the California Privacy Protection Agency, as applicable, and you retain any right to a judicial remedy.