Legit Saathi Private Limited | Version 1.0 | Effective Date: [Insert Date]
Legit Saathi Private Limited ("Legit Saathi", "Company", "we", "our", or "us") is committed to protecting the personal data of its users in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
This Privacy Policy explains how we collect, use, store, process, disclose, and protect your personal data when you access or use our website, mobile application, software, products, and services (collectively, the "Platform").
Legit Saathi acts as a Data Fiduciary as defined under the DPDPA in respect of personal data processed through the Platform. Where third-party service providers process data on our behalf, they act as Data Processors and are bound by appropriate contractual obligations.
By accessing or using the Platform, you provide your free, specific, informed, unconditional, and unambiguous consent to the collection and processing of your personal data as described in this Privacy Policy. You may withdraw consent at any time, subject to the provisions of Section 9.
A. Personal Data Provided by Users
We collect personal data voluntarily provided by you, including:
B. Sensitive Personal Data or Information (SPDI)
The following categories of data are treated as Sensitive Personal Data or Information under the SPDI Rules and are subject to heightened protection:
We collect SPDI only with your explicit consent and use it solely for the purposes for which it was provided.
C. Identity Verification Information
Where identity verification is enabled, we may collect:
Aadhaar numbers are not stored by the Company unless specifically required by law or through a user-authorised verification process conducted via UIDAI-approved KYC User Agencies (KUAs). Any Aadhaar-related data is handled in strict compliance with the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and UIDAI regulations.
D. Automatically Collected Information
When you access the Platform, we may automatically collect:
Under the DPDPA, 2023, we process your personal data on the following lawful bases:
The specific lawful basis applicable to each processing activity is set out in Section 4 below.
Service Delivery (Basis: Contract / Consent)
Identity Verification and Fraud Prevention (Basis: Legitimate Use / Legal Obligation)
Legal and Regulatory Compliance (Basis: Legal Obligation)
Platform Improvement (Basis: Legitimate Use / Consent)
Customer Support (Basis: Contract / Consent)
We commit to processing your data only for the purposes stated above (purpose limitation) and to collecting only the minimum data necessary for each purpose (data minimisation).
Legit Saathi does not sell, rent, or trade personal data to third parties. Personal data may be shared only in the following circumstances:
Data Processors / Service Providers: With technology partners, cloud service providers, OTP providers, eSign providers, and infrastructure vendors engaged to operate the Platform. All such processors are bound by data processing agreements requiring them to process data only on our instructions and to maintain appropriate security standards.
Legal and Regulatory Disclosure: Where required or permitted by law, we may disclose personal data to courts, government authorities, law enforcement agencies, or regulatory bodies. We will, where legally permissible, notify you before such disclosure.
Business Transfers: In connection with mergers, acquisitions, restructuring, or transfer of business assets, personal data may be transferred to a successor entity, subject to equivalent privacy protections.
User-Authorised Sharing: Where you explicitly authorise disclosure of your information to a third party (e.g., a counterparty to an agreement), we may share your data accordingly.
In all cases of third-party sharing, we take reasonable steps to ensure the recipient maintains appropriate confidentiality and security obligations.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. After the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.
Legit Saathi implements commercially reasonable technical and organisational safeguards in accordance with the SPDI Rules, including:
Data Breach Response: In the event of a personal data breach that is likely to result in harm to you, we will notify the Data Protection Board of India as required under the DPDPA within the prescribed timeframe, notify affected users without undue delay, and maintain an internal record of all breaches for a minimum period of 5 years.
Despite reasonable security efforts, no digital transmission or storage system can be guaranteed to be completely secure. Please notify us immediately at grievance@legitsaathi.in if you suspect any unauthorised access to your data.
Under the DPDPA, 2023, you have the following rights as a Data Principal:
To exercise any of the above rights, submit a written request to grievance@legitsaathi.in with the subject line "Data Rights Request". We will respond within 15 working days. We may require identity verification before processing your request.
Your consent to this Privacy Policy is obtained at the time of account registration and is recorded with a timestamp and session identifier. You may withdraw consent at any time by:
Upon withdrawal of consent, we will cease processing your data for consent-based purposes. However, data may continue to be retained and processed where required by law or for legitimate business purposes such as fraud prevention or dispute resolution.
The Platform uses the following categories of cookies and similar technologies:
We do not use marketing or advertising cookies. Disabling essential cookies may impact Platform functionality.
The Platform may integrate with third-party service providers including OTP and SMS providers, eSign and digital signature service providers, payment gateways, cloud hosting and infrastructure providers, and analytics providers. Each such provider operates under its own privacy policy. We are not responsible for the privacy practices of third-party services accessed through links on our Platform.
The Platform may use automated processes for fraud detection, document validation, and account risk assessment. Where any automated decision produces a significant effect on you, you have the right to request human review, receive an explanation of the factors considered, and contest the decision through our Grievance Officer. Contact grievance@legitsaathi.in with the subject line "Automated Decision Review".
The Platform is intended only for individuals aged 18 years and above. We do not knowingly collect personal data from minors. If you believe a minor's data has been submitted to our Platform, please notify us at grievance@legitsaathi.in.
Where required for service delivery, personal data may be processed through cloud infrastructure located outside India. In such cases, we ensure transfers are made only to countries or processors that offer equivalent data protection standards, appropriate contractual safeguards are in place, and Sensitive Personal Data is, to the extent practicable, processed and stored on servers located within India.
In accordance with the Information Technology Act, 2000 and the DPDPA, 2023, we have appointed a Grievance Officer:
Grievance Officer
Legit Saathi Private Limited
Email: grievance@legitsaathi.in
Response Time: Within 15 working days of receipt of complaint
If your grievance is not resolved to your satisfaction, you may escalate the matter to the Data Protection Board of India, once constituted and operational under the DPDPA, 2023.
We reserve the right to update this Privacy Policy at any time. Material changes will be notified via email to your registered email address, in-app notification, and prominent notice on our website. Continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Privacy Policy. A change log of prior versions is available upon request by contacting support@legitsaathi.in.
Service-related communications (such as agreement confirmations or payment reminders) form part of the contracted service and may not be opted out of. Where we send promotional or marketing communications, we will do so only with your prior consent. You may opt out at any time by clicking "Unsubscribe" in any marketing email, updating your communication preferences within your account settings, or contacting support@legitsaathi.in.
Legit Saathi Private Limited
Email: support@legitsaathi.in
Website: www.legitsaathi.in
By using the Platform, you acknowledge that you have read, understood, and agreed to this Privacy Policy.