Zak Trade Fairs & Exhibitions

Version 1 · last updated 18 October 2026

Privacy policy

This policy explains how Zak Trade Fairs & Exhibitions Pvt. Ltd. ("we", "us") handles personal data in Zak Expo Hub, the sales and bookings system at https://expohub.zakgroup.com that we use to run our trade shows: Zak Glass Technology, Zak Doors & Windows, Zak Aluminium Extrusions and Zak Fenestration India.

We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, "DPDP"). For people in the European Union or the United Kingdom we are the controller under the GDPR (see the section near the end).

Who we are and how to reach us

• Company: Zak Trade Fairs & Exhibitions Pvt. Ltd., trading as Zak Trade Fairs & Exhibitions
• Registered office: To be confirmed
• CIN: To be confirmed · GSTIN: To be confirmed
• Grievance Officer: To be confirmed, To be confirmed
• Privacy questions and requests: To be confirmed

Whose data this covers

• Exhibitors, sponsors, agents and their staff: the people at companies that exhibit with us or might.
• People who enquire: through the forms on our show websites (zakglasstech.com, zakdoorsandwindows.com, zakaluminiumextrusions.com, fenestrationindia.com), the chat on those websites, or LinkedIn lead forms for our shows.
• People who book a call or visit through a salesperson's booking link, or open a stand proposal we send.
• People we email or message on WhatsApp about our shows.
• People who comment on, mention or message our show accounts on Facebook, Instagram, X, YouTube or LinkedIn.
• Our staff who sign in to Zak Expo Hub.

What we collect

About you as a business contact

• Name, job title, company, work email, phone and WhatsApp number, city, state and country.
• What you are interested in: the show, stand size and type, sponsorships, products you make, and the answers you give on our forms.
• Our dealings with you: enquiries, notes our staff write, calls and meetings, deals, stand proposals and holds, booking forms, invoices, receipts and payment status.
• Emails and WhatsApp messages between you and our sales team, with their attachments.
• Your company's GSTIN and PAN, which we check against the official registers through a lookup provider. For a sole proprietor the PAN may be personal.
• A photo of your visiting card if you gave it to one of our staff. We keep the photo for 90 days; what was read from it stays on your record.

When you use our public pages

• Web forms and the chat: what you type, the page you came from, the time, and campaign tags in the link (for example utm_source).
• Booking links: your name, company, email, phone and the time you chose.
• Stand proposals: when the proposal link was opened, the network it was opened from (the first three parts of the IP address only) and the type of browser.
• Spam protection: forms may use Cloudflare Turnstile, which checks that a person, not a program, is sending them.

On our social media accounts When you comment on our posts, mention one of our show accounts or (where we have switched it on) send it a message, the network gives us your public name or username, what you wrote, when, and a link to it. Our staff may answer you there, link you to a contact we already hold, or add an enquiry from what you wrote. We don't receive your email or phone number this way, and we don't treat a comment as consent to email, call or WhatsApp you. Links in our posts carry campaign tags (for example utm_source=instagram and utm_medium=social), so we can tell which post brought an enquiry.

Email read receipts and link tracking When our sales team sends you an email from Zak Expo Hub, it may contain a tiny image and links that pass through our server. That tells us when the email was opened, which links were clicked, and from what kind of device, so the salesperson can follow up at a sensible time. We store a scrambled (hashed) form of the IP address, not the address itself. If the email is opened on a new device or from a different place than before, the salesperson may see "opened on another device or by someone else", and if someone new from your company joins the conversation, they may see that it was forwarded to them.

You can avoid this by not loading images in your email app; links still work. Apple Mail Privacy Protection and some security scanners open every email automatically: we mark those as "maybe" and don't count them. Our campaign emails (newsletters and show updates) are sent through SendGrid, which records opens, clicks, bounces and unsubscribes in the same way.

About our staff Name, work email, phone and WhatsApp number for notifications, photo, role and shows, the work done in the system, an audit log of changes, sign-ins with the device, browser, IP address and approximate place (looked up with ipapi.co), passkeys (we hold only the public key) and two-factor settings.

Things we don't collect We don't collect card numbers or bank details: online payments go through Razorpay. We don't build advertising profiles, sell personal data or use advertising cookies.

Why we use it and on what basis

We don't use your data for any purpose you wouldn't reasonably expect from a trade show organiser.

Where we get data from

Mostly from you or your company. We also use:

• Public sources: company websites, published exhibitor lists of trade shows, and registers such as the GST and PAN records. We read public company websites with a service called Firecrawl, only at company level (what a company makes and where it is), never to collect people's names, emails or phone numbers.
• LinkedIn: when you fill in a LinkedIn lead form for one of our shows, LinkedIn sends us what you entered and the consent you gave on that form. We use LinkedIn only through its official Marketing APIs and never copy data from LinkedIn pages.
• Social networks: Facebook, Instagram, X, YouTube and LinkedIn send us the comments, mentions and messages on our own show accounts, through their official APIs only. We never copy data from people's profiles.
• Colleagues and agents who pass on your details for a booking.
• Google Meet: after a Google Meet call with our staff, Google tells Zak Expo Hub when the call ran, the names people joined with and when each of them was in the call, and links to the recording and transcript if Google made them (they stay in our Google Workspace). Only for staff who switched it on, Zak Expo Hub also reads the call's transcript to draft notes of the meeting (see "AI"). Google makes transcripts only when someone in the call turns transcription on, and Meet shows this to everyone in the call.
• Google Analytics: our show websites use Google Analytics. Zak Expo Hub reads only aggregate figures from it (daily counts of visits by channel, page, country, city and device), never anything that identifies a visitor such as an ID or IP address, and keeps them for three years.

AI

Some features use Google Gemini: preparing a short brief before a meeting, drafting the notes of a Google Meet call from its transcript (only for staff who switched this on), reading a visiting card photo, and (if switched on) answering staff questions about how to use the system. Names, email addresses and phone numbers are removed from text before it is sent, except a visiting card photo, which is sent as the image itself. We use Gemini's paid service, under which Google says it does not use what we send to improve its products. A person always checks what AI produces before it is used.

Once for each new hall plan, Anthropic's Claude reads the hall's blank grid drawing and the layout brief to propose a stand layout. No exhibitor, booking or personal data is sent, and staff edit the result by hand.

Who we share it with

We share personal data only with the service providers below, who process it for us under contract, and with authorities when the law requires it. We don't sell personal data.

Where data goes outside India, it goes only to countries the Government of India has not restricted under DPDP section 16. For EU and UK data, see the GDPR section.

How long we keep it

When a period ends, the data is deleted or anonymised. Deleted data can stay in encrypted backups until those backups expire.

How we protect it

• Access is by named accounts with strong passwords and two-factor sign-in, a passkey, Google Workspace sign-in, or Zak ONE, the group's single sign-on (which uses Google Workspace).
• Each person sees only what their role allows; salespeople see only the shows they work on.
• Keys for outside services are stored encrypted and are never shown again after they are saved.
• Backups are encrypted (AES-256) before they leave the server.
• Changes are recorded in an audit log, and unusual sign-ins raise alerts.
• If a personal data breach happens, we will tell the Data Protection Board of India and the people affected as DPDP requires.

Cookies and browser storage

Zak Expo Hub uses only the cookies it needs to work: a session cookie, a "remember me" cookie if a staff member chooses it, and a security cookie that protects forms (CSRF). It stores a few preferences in your browser, such as light or dark mode and remembered filters. The chat on our websites keeps an ID in your browser so a conversation can continue. We use no advertising or tracking cookies.

Your rights

Under DPDP you can:

• Access: ask for a summary of the personal data we hold about you and what we do with it.
• Correct and complete: ask us to fix or update it.
• Erase: ask us to delete it, unless the law requires us to keep it (for example invoices).
• Withdraw consent: at any time, as easily as you gave it. Every campaign email has an Unsubscribe link, and you can reply STOP on WhatsApp. Withdrawing doesn't affect what was done before.
• Grievance redressal: complain to our Grievance Officer, who will reply within the time DPDP allows.
• Nominate: name someone to exercise your rights if you die or can't act yourself.

Write to To be confirmed or the Grievance Officer at To be confirmed. We may ask you to confirm who you are. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

People in the EU and the UK

If the GDPR or UK GDPR applies to you:

• Our lawful bases are: taking steps for a contract you asked for and performing it (enquiries and bookings), legal obligation (accounting records), our legitimate interests in running and promoting our shows and keeping the system secure (balanced against your rights; you can object), and consent for marketing.
• Your rights also include restricting processing, objecting (always for marketing), data portability, and complaining to your local data protection authority.
• Transfers: your data is held in India, which has no adequacy decision. We rely on the European Commission's standard contractual clauses (and the UK addendum) with our providers where they are needed.

Children

Zak Expo Hub is for businesses. It is not meant for anyone under 18, and we don't knowingly collect children's data. If you think we have, tell us and we will delete it.

Changes to this policy

When we change this policy we publish a new version here with its date; earlier versions are listed below. If a change matters to how we use your data, we will tell you before it applies.