CuroPark CuroZapp CuroVMS and CuroNext
Pentaminds Technologies (P) Ltd.
Version 1.6 | Updated 15 October 2026
Effective date: 01 October 2026
This Policy is issued by Pentaminds Technologies (P) Ltd. (Pentaminds, we, us or our). It explains personal-data handling in CuroPark, CuroZapp (CuroVMS) and CuroNext and their related support. Unrelated corporate website browsing, recruitment and sales enquiries require the relevant separate notice.
Radius Infotech (P) Ltd. (Radius) supplies and supports the solutions under customer arrangements. Pentaminds, a group/sister concern associated with Radius, develops and hosts the platforms, administers databases and provides authorised production support. The two companies are separate legal entities. Each is separately responsible where it determines purposes for its own support or business records.
For commercial buildings, the property developer engages the service arrangement and commonly appoints a facility management company to operate the building. Orders and payments are usually routed through that facility management company. Tenant companies have tenancy arrangements with the developer; Radius and Pentaminds do not ordinarily have direct commercial service contracts with those tenants. The actual order and authorised customer instructions govern each deployment.
The developer, facility management company, society or association, and tenant employer may each determine purposes and means for different activities, alone or together. Their status as Data Fiduciary or processor depends on those activities, not simply on who pays, holds an administrator account or enters a record. The responsible entity for each purpose must be identified in the deployment notice. References to the Facility Organisation mean the relevant responsible building, employer or society entity for that activity.
For customer-directed hosting, administration and support, the service entities process records on behalf of the relevant responsible organisation through the applicable contract chain. A tenant employer may separately determine employee-processing purposes. Society and facility administrators act for their respective organisations; an administrator title alone does not identify the Data Fiduciary. No direct enterprise contract with every individual is required for that person to raise a privacy concern.
Routine operational records are entered and maintained by customer-appointed administrators, tenant companies, authorised operators and users. Radius and Pentaminds do not ordinarily originate or manually enter those records. They may assist with data entry or imports on an authorised customer request. Hosting, storage, retrieval, automated collection and support still involve processing; the absence of routine manual data entry does not remove applicable contractual or legal responsibilities.
Commercial buildings: we establish the initial building administrator account. That administrator creates company accounts; tenant companies enter employee details. Company administrators issue employee mobile-app credentials and handle onboarding and offboarding.
CuroNext: we establish the initial society administrator account. The society administrator creates other administrators and operators with role-based permissions, creates flat records and enters basic resident details. Flat owners maintain remaining details. Building or facility administrators enter and maintain security-personnel, service-staff and AMC-vendor records.
Information may also be supplied directly by visitors and users, or generated automatically through product use, such as parking or visit events and applicable device information. These sources are distinct from manual entry by Radius or Pentaminds.
CuroNext handles flat records, residents’ basic details and subsequent details entered by flat owners, administrator/operator account and role information, and records of security personnel, service staff and AMC vendors. These support the society-management activities configured for that deployment. Vendor company information is personal data where it identifies an individual contact or proprietor.
Visibility follows the permissions assigned to administrators and operators. Flat-owner entry of another person’s details does not itself provide that person’s consent or give unrestricted access to other residents’ information.
Depending on the modules the society enables, CuroNext handles the following categories:
Mandatory fields are marked on the relevant screen; other fields are optional. The mobile number is used for sign-in and service notifications. Residents see only information relating to their own flat and any society-wide information the society chooses to publish; administrators and operators see only what their assigned role permits. Mobile numbers and email addresses are displayed in masked form.
Facial photographs are retained for society records and identification. Where the society requires automated facial matching and compatible matching hardware is available and installed at the site, facial data is automatically matched for the configured identity or access-verification purpose. Where such hardware is not installed, captured facial data is used for record purposes without automated matching. Before matching begins, the society must explain its use, the data processed (including any biometric templates generated), the recipients and applicable retention, and obtain any required consent. Installation of hardware or acceptance of Terms alone is not consent to biometric processing. If photographs or identity-document uploads are enabled for residents, staff or vendors, the society’s notice must state the purpose and access is limited to authorised roles. The mobile-app device information in Section 7 and the hosting and retention provisions in Sections 11 and 12 also apply to CuroNext.
The confirmed CuroPark data categories are employee name, company name, mobile number, email address, vehicle registration number, RFID tag details and vehicle entry/exit logs. They support parking enrolment, identification, authorised parking access and operational records.
The standard CuroPark views and reports described for the current deployment display only employee name, company name and vehicle number. Other PII remains encrypted/protected and is not displayed in those views/reports. Authorised technical personnel may access production systems and databases as needed for administration, maintenance, troubleshooting and support. This display statement concerns the operational fields listed above; it does not describe mobile-device data or override a deployment’s specifically notified configuration.
Visitors. When a visitor checks in on the CuroTerminal tablet at reception, or on their own phone by scanning the QR code shown on the terminal, CuroZapp/CuroVMS collects:
Employees and hosts. For employees who use the CuroZapp Employee App, we handle name, company, mobile number, email address, visitor approval and rejection decisions, pre-appointment invitations they create (including the invitee’s name, mobile number and visit details) and, where the employee uses it, entry records generated by the app’s dynamic QR code.
Facial photograph and identity document. The photograph is retained as part of the visit record, appears on the digital and printed pass, and supports visual verification by the approving host and security staff. Uploading an identity-document image is optional. Where the Facility Organisation requires an identity check, its collection notice must distinguish presenting a document for inspection from uploading and retaining a copy, and explain the available verification process without an upload.
Automated facial matching. Where the site requires facial matching and compatible hardware is available and installed, captured facial data is automatically matched for identity or access verification. Without that hardware, the photograph is retained for record and visual-verification purposes without automated matching. The Facility Organisation must explain the matching process, any biometric templates generated, relevant recipients and retention before use, and obtain any required consent separately from Terms acceptance. Its notice must explain the effect of declining or withdrawing consent and any available alternative verification route. Access to facial records and any matching data is restricted to authorised roles for the stated purpose.
If you choose to upload an identity document, please use a masked Aadhaar (showing only the last four digits) or another government-issued photo identity document such as a driving licence, passport or voter ID. Identity-document images are not shown in standard reports and can be viewed only by administrators or security personnel whose role requires it.
Reports. Reports and authorised views display visitor name, mobile number (masked), visiting host name, and date and time of visit. Where permitted by role-based access, authorised personnel may view a visitor’s full details for official purposes connected with the visit. Every such access is recorded in the system.
Passes. After approval, the pass link is sent by SMS, and the pass can also be printed at reception on a printer connected to the tablet by Bluetooth. A printed pass may show the visitor’s name, photograph, host and visit date, so please return it at exit or dispose of it securely.
For CuroPark, CuroZapp and CuroNext mobile-app users, the applications collect the following device and software details to make the apps work reliably on your device and to keep your account secure:
These fields describe the device and software environment used to access the applications. A device name or device-related identifier may identify a person or become personal data when linked to an account or activity record. Such data is not treated as anonymous merely because it is technical information.
In plain terms: Device Unique Name is the name given to the device by its owner, which may include the owner’s name; System Name and OS Name identify the operating system (Android or iOS); Device Type, Brand Name, Manufacturer and Model Number identify the hardware; OS Version identifies the software version; and Resolution X and Y are the screen dimensions.
These details are collected when you sign in and when the app starts, and are linked to your user account. We use them to display screens correctly on your device, to maintain compatibility with your operating-system version, to diagnose and fix errors you report, and to detect unusual sign-in activity on your account. They are accessible only to authorised Pentaminds and Radius support personnel. They are not used for advertising, profiling or cross-app tracking, and are not sold.
These fields are needed for the apps to work reliably and cannot be switched off individually. If you do not want them collected, ask your Facility Organisation about the building’s non-app alternative. Pentaminds determines the purpose of this processing and is responsible for it. Device information is kept for six months from the date the user account is deactivated, subject to Section 12.
Any use beyond the stated mobile-app purpose must be separately explained and supported by an appropriate lawful basis. General acceptance of Terms does not authorise unrelated advertising, profiling or tracking. The responsible organisation must provide the applicable notice and any required choice before collection.
Information may come from you, your employer, the Facility Organisation, an authorised host or administrator, or configured entry/exit and RFID systems. A host’s submission of visitor details does not by itself establish that the visitor has received the required notice or given consent.
For CuroPark and CuroZapp, facility records are used to enrol authorised users and vehicles, coordinate visits, check permissions, record entry and exit and support the facility’s stated security and operational requirements. Relevant information is also used to resolve support requests, maintain the application, investigate misuse and comply with applicable law. Processing is limited to the purposes notified for the deployment and authorised under the relevant arrangements.
Pentaminds and Radius do not use facility personal data for independent marketing or unrelated purposes. Any new optional use must be separately explained and supported by an appropriate lawful basis before it begins.
In addition to the information described above, the Services handle:
The following service providers receive only the information they need to perform their function:
The Services do not currently use WhatsApp messaging, third-party advertising or marketing analytics, and do not process payments. If a deployment enables any such integration, it will be disclosed in that deployment’s notice before it is used.
The Facility Organisation’s collection notice must identify the organisation responsible, the data requested, the purposes, the relevant recipients and the route for privacy requests. Read that notice together with this Policy. If a field is unclear, ask the facility contact before providing it.
Where consent is the basis for processing, it will be requested through a specific affirmative choice for the stated purpose. Accepting Terms of Use, reading this Policy, receiving an OTP or simply continuing to use an interface is not treated as consent to every possible use of your data. An OTP alone verifies control of a contact channel; it is not a general consent record.
You may decline optional information or withdraw consent for consent-based processing through email to satyendra@pentaminds.com or telephone on +91-9873262630. Withdrawal should be as straightforward as giving consent. It does not undo processing already lawfully completed. If essential information can no longer be processed, a corresponding digital access feature may stop; the Facility Organisation will explain the impact and any available alternative.
Where applicable law permits processing without consent, the responsible organisation must identify the applicable basis and purpose. This Policy does not treat every employee or visitor record as automatically exempt from consent requirements.
Operational access follows the assigned roles of building/society administrators, company administrators, hosts, security personnel, operators and flat owners for the relevant deployment. Customer organisations must define and communicate permitted access. Authorised Radius personnel may access records for contracted support; authorised Pentaminds personnel may access production systems and databases for hosting, administration and support. Group-company association does not authorise unrelated reuse.
Amazon Web Services (AWS) provides the cloud infrastructure for CuroPark, CuroZapp (CuroVMS) and CuroNext. Other service providers may handle only the information necessary for an integration disclosed in the deployment notice. Appropriate instructions, confidentiality, access restrictions and contractual safeguards are required for service providers. Records may also be disclosed where legally required to competent authorities or to address a specific legal claim, limited to what is necessary and lawful.
The current hosting architecture for CuroPark, CuroZapp (CuroVMS) and CuroNext uses AWS Mumbai, India, for the primary environment and AWS Hyderabad, India, for backup/disaster recovery. This statement describes the application hosting and backup locations; it does not by itself establish the processing locations of every optional external integration.
Authorised access controls, protection/encryption of applicable personal data and restricted production/database access are used to safeguard the Services. CuroPark’s standard display limitations are described in the CuroPark section above. No system can guarantee absolute security. If an incident affects personal data, Pentaminds will take appropriate response action and coordinate with the responsible organisations so that required notifications and remedies are provided in accordance with applicable law.
Any material change to hosting, overseas access or provider processing will be assessed against applicable law and contractual requirements and disclosed through an updated notice where required. This Policy is not advance blanket consent for unrestricted international transfers.
The current operational retention policy for CuroPark, CuroZapp (CuroVMS) and CuroNext is six months. This does not promise erasure of every record at six months: legally required retention takes precedence. Account deactivation and record deletion are separate actions.
Unless a longer period is required by law, a court or regulatory order, or an open investigation, dispute or legal claim, the following periods apply:
Legal minimum retention. Applicable statutory retention overrides shorter operational periods. When Rules 6(1)(e) and 8(3) of the DPDP Rules apply, the relevant personal data and logs must be retained for the required period, including the minimum one-year period measured from processing under Rule 8(3). Required records must remain protected and retrievable for the permitted legal purposes and be erased when retention is no longer justified. Backup expiry alone does not determine the statutory retention period.
Backups. Database backups are kept for 12 months from the backup date as an archive and then expire. Deleted data may therefore remain in backups for up to 12 months after deletion, with access restricted to authorised personnel.
Deletion requests are assessed against applicable legal retention requirements and specific, documented needs to preserve records. Where retention is required, the reason and applicable period or criteria will be explained, and access and use restricted accordingly. Backup copies are removed through the documented backup lifecycle; restoration must not permanently reintroduce records scheduled for deletion. We do not promise immediate erasure from every backup.
You may contact satyendra@pentaminds.com or the Facility Organisation’s published privacy contact to ask about your information, seek access or a summary, request correction or erasure, withdraw consent, or raise a grievance. Where applicable and in force, you may also exercise statutory nomination rights. Availability and scope depend on the applicable law and processing basis.
Please identify the product, facility and the record or issue concerned. We may ask for proportionate verification to protect your information, without requesting unnecessary identity documents. Where Pentaminds processes records on another organisation’s instructions, we will help route and support the request rather than require you to understand the contractual chain.
Grievances will be addressed promptly. We will acknowledge receipt within 7 days and resolve or redress privacy grievances within 30 days, or any shorter period required by applicable law. Where the SPDI Rules apply, grievances will be redressed within one month of receipt. The DPDP Rules’ maximum grievance-response period of 90 days, when applicable and in force, does not extend this shorter commitment. Our substantive response will explain the action taken, any lawful reason a request cannot be granted in full, and the available escalation route. You retain the right to approach a competent authority; where the DPDP grievance and Board complaint provisions apply and are in force, the applicable prior grievance process must be followed.
The Services are not intended for persons under 18 to independently register or accept a contract. This section covers children’s visits and any resident, family-member or co-resident records entered in CuroNext. The relevant Facility Organisation must use an appropriate parent or lawful-guardian process and obtain any legally required verifiable parental consent before processing a child’s information, unless a specific lawful exception applies. A flat owner or administrator entering a child’s details does not by itself establish parental authority or consent. Photographs and any automated facial matching involving children must follow the applicable child-data safeguards; an ordinary photograph and a biometric template are distinct data categories.
Contact the privacy contact if a child’s information has been collected without the required process. We will coordinate appropriate corrective action. Where an individual has a lawful guardian, verification and representation requirements will be applied as required by law.
The approved current version of this Policy will appear at https://pentaminds.com under ‘CuroPark CuroZapp and CuroNext Privacy Policy’ with its effective date. Material changes will be communicated through an appropriate product or facility notice. A new purpose or materially different collection will be explained before that processing starts, with fresh consent where required. Publishing an updated Policy does not retrospectively authorise new uses.
This Policy is intended to operate alongside applicable Indian privacy and information-technology law. References to rights or obligations under the Digital Personal Data Protection Act, 2023 and its Rules apply according to their commencement and applicability. The DPDP Act and Rules commence in phases in accordance with the applicable Gazette notifications. This Policy does not represent that every DPDP provision is already in force or that publication alone completes compliance.
Pentaminds Technologies (P) Ltd.
Registered office: E-58, Preet Vihar, Delhi – 110092, India
Corporate office: B-418, 4th Floor, I-Thum, Tower-B, Sector 62, Noida – 201301, Uttar Pradesh, India
Website: https://pentaminds.com
Data Protection Officer and privacy/grievance contact: Satyendra Kumar
Email: satyendra@pentaminds.com
Telephone: +91-9873262630
Postal privacy requests may be sent to the company office above, addressed to the Data Protection Officer.
For electronic requests, identify the product and facility or society and briefly describe your concern. Please do not send unnecessary identity-document copies.
Facility Organisation: the legal entity responsible for your building or society, its privacy contact, and its collection notice and retention schedule are provided at the point of collection, for example on the CuroTerminal check-in screen, at the reception desk, or in the society’s communication to residents. If you cannot find them, contact our privacy contact above and we will route your request to the right organisation.
Where Radius supplies the solution, its privacy contact is Atul Kumar Singh, atul.singh@radiusinfotech.in, +91-8130192081. Pentaminds coordinates relevant requests with Radius and the responsible customer/facility entity. Users do not need a direct contract with every party to raise a privacy concern.
