Legal Pages

This Data Protection and DPDP Policy describes the data-protection legal framework applicable to Kritexa Labs and explains how Kritexa Labs approaches its obligations as a Data Fiduciary under Indian data-protection law. This document should be read alongside our Privacy Policy (which explains our specific privacy practices) and our Grievance & Data Rights Policy (which explains how to exercise rights and submit complaints).

1. Applicable Indian Data Protection Framework

The handling of personal data by Kritexa Labs is governed by a framework of Indian legislation and regulatory instruments. The principal applicable instruments are:

1.1 Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) received Presidential assent on 11 August 2023 and was published in the Official Gazette of India. It establishes the principal legal framework for the protection of digital personal data in India, recognising both the right of individuals to the protection of their personal data and the need to process personal data for lawful purposes.

1.2 Digital Personal Data Protection Rules, 2025

The Digital Personal Data Protection Rules, 2025 (DPDP Rules) were notified by the Ministry of Electronics and Information Technology (MeitY) in 2025. The Rules provide the operational and procedural framework for implementing the obligations set out in the DPDP Act, covering matters including notice and consent mechanisms, exercise of Data Principal rights, grievance redressal, processing of children's data, cross-border transfer restrictions, and the Data Protection Board of India.

1.3 Information Technology Act, 2000

The Information Technology Act, 2000 (IT Act) and rules made thereunder — particularly the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) — continue to apply to the extent that they have not been superseded by or are inconsistent with the DPDP Act. During the transition period, Kritexa Labs is guided by the applicable provisions of both frameworks.

1.4 CERT-In Directions

The Indian Computer Emergency Response Team (CERT-In), constituted under Section 70B of the IT Act, issues mandatory directions relating to cybersecurity practices, incident reporting, and information security. Kritexa Labs' information security obligations include compliance with applicable CERT-In directions as notified from time to time.

2. Digital Personal Data Protection Act, 2023

The DPDP Act is the primary legal instrument governing the protection of digital personal data in India. Its key features include:

• Territorial scope: The Act applies to the processing of digital personal data within the territory of India, and also to processing of personal data outside India if such processing is in connection with any activity related to offering of goods or services to Data Principals within India.
• Personal data definition: "Personal data" under the Act means any data about an individual who is identifiable by or in relation to such data.
• Data Fiduciary obligations: Entities (individuals and organisations) that determine the purpose and means of processing personal data are "Data Fiduciaries" and bear the primary obligations under the Act.
• Consent-based processing: Personal data may generally be processed only with the consent of the Data Principal, except where processing constitutes a "legitimate use" as specified in the Act.
• Data Principal rights: Data Principals are accorded specific rights including the right to information, correction, erasure, grievance redressal, and nomination.
• Children's data: Processing of personal data of children requires verifiable parental consent and is subject to specific restrictions.
• Data Protection Board: The Act establishes the Data Protection Board of India to adjudicate complaints and impose penalties for non-compliance.
• Significant Data Fiduciaries: The Central Government may notify certain Data Fiduciaries as Significant Data Fiduciaries based on the volume and sensitivity of data processed, with enhanced obligations applying to those entities.
• Cross-border transfers: Transfer of personal data outside India may be restricted to specified countries or territories as notified by the Central Government.

3. Digital Personal Data Protection Rules, 2025

The DPDP Rules, 2025 operationalise the DPDP Act and provide detailed procedural requirements. Key areas addressed by the Rules include:

Notice Requirements

The Rules prescribe the manner and form in which a Data Fiduciary must provide notice to Data Principals at or before the time of seeking consent for processing. Notice must be clear, plain, and in a standardised format, informing the Data Principal of the personal data to be processed and the purposes of processing.

Consent Management

The Rules specify requirements relating to Consent Managers — entities registered with the Data Protection Board that facilitate the giving, managing, reviewing, and withdrawing of consent by Data Principals. Data Fiduciaries must honour consent withdrawal requests received through Consent Managers or directly from Data Principals.

Exercise of Data Principal Rights

The Rules specify the manner in which Data Principals may exercise their rights under the Act, including the procedures for submitting access, correction, erasure, and nomination requests, the timelines within which Data Fiduciaries must respond, and the circumstances in which requests may be refused.

Grievance Redressal

The Rules specify the procedure for grievance redressal by Data Fiduciaries, including requirements relating to response timelines and escalation to the Data Protection Board.

Children's Data

The Rules specify the mechanisms for obtaining verifiable parental consent before processing children's personal data and set out obligations relating to the protection of children in digital environments.

Security Safeguards

The Rules specify the security safeguards that Data Fiduciaries must implement to protect personal data, including technical and organisational measures proportionate to the volume and sensitivity of data processed.

Data Protection Board Procedures

The Rules set out procedures for the operation of the Data Protection Board of India, including the process for filing and adjudicating complaints and appeals.

4. Commencement and Phased Implementation

While the DPDP Act received Presidential assent on 11 August 2023, the Act provides that its provisions shall come into force on such date as the Central Government may, by notification, appoint. Different dates may be appointed for different provisions. Similarly, the DPDP Rules, 2025 are subject to phased commencement.

During the period before full commencement, the following instruments continue to apply to the extent not superseded:

• The Information Technology Act, 2000
• The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• CERT-In directions under Section 70B of the IT Act
• Any other applicable Central Government or regulatory notifications

5. Key Definitions

The following key terms are used in this policy in accordance with the DPDP Act, 2023 and applicable rules:

• Personal data: Any data about an individual who is identifiable by or in relation to such data (DPDP Act, Section 2(t)).
• Processing: A wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination, restriction, erasure or destruction (DPDP Act, Section 2(x)).
• Data Fiduciary: Any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data (DPDP Act, Section 2(i)).
• Data Principal: The individual to whom the personal data relates, and where such individual is a child, includes the parent or lawful guardian of such a child (DPDP Act, Section 2(j)).
• Consent Manager: A person registered with the Data Protection Board who acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform (DPDP Act, Section 2(f)).
• Data Processor: Any person who processes personal data on behalf of a Data Fiduciary (DPDP Act, Section 2(k)).
• Significant Data Fiduciary: A Data Fiduciary notified by the Central Government as such, based on specified criteria including volume and sensitivity of personal data processed (DPDP Act, Section 10).
• Personal data breach: Any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data that compromises the confidentiality, integrity, or availability of personal data (DPDP Act, Section 2(u)).

6. Data Principal

A Data Principal is the individual to whom the personal data being processed relates. In the context of Kritexa Labs' operations, Data Principals include:

• Website visitors whose browsing data is collected through technical means
• Individuals who submit enquiries, project briefs, or contact forms
• Clients and their authorised representatives
• Users of platforms, tools, or digital services operated by Kritexa Labs
• Job applicants and candidates
• Other individuals whose personal data Kritexa Labs processes in the course of its operations

Under the DPDP Act, Data Principals have specific rights and also have duties — including the duty not to provide false or misleading information, not to impersonate another person, and not to suppress material information. Data Principals are responsible for the accuracy of information they provide to Kritexa Labs.

7. Data Fiduciary

Kritexa Labs acts as the Data Fiduciary for personal data it collects and processes in the course of its own operations — that is, data collected through its website, during enquiry handling, in the delivery of services to its own clients, in recruitment, and in other standard business activities.

Where Kritexa Labs processes personal data on behalf of a client — for example, where it manages a client's CRM system, chatbot, or digital marketing platform — Kritexa Labs may act as a Data Processor for that client's data. In those circumstances, the client is the Data Fiduciary and Kritexa Labs processes data under the client's instructions and pursuant to a data-processing or service agreement.

The distinction between Data Fiduciary and Data Processor roles is important: where Kritexa Labs is the Data Processor, the Data Principals' rights under the DPDP Act are primarily exercisable against the client (the Data Fiduciary), though Kritexa Labs will cooperate with its clients to assist in responding to Data Principal requests as required under applicable agreements.

8. Personal Data

The DPDP Act defines "personal data" broadly as any data about an individual who is identifiable by or in relation to such data. This definition encompasses both data that directly identifies an individual (such as name, phone number, or email address) and data that indirectly identifies an individual when combined with other information (such as an IP address, device identifier, or account number).

The DPDP Act does not separately define or create a distinct category of "sensitive personal data" in the way the IT (SPDI) Rules, 2011 do. However, the Act provides for the Central Government to notify categories of personal data that may attract additional obligations on Data Fiduciaries, and for specific obligations relating to children's personal data. The Central Government may also specify categories of personal data requiring additional safeguards.

IT (SPDI) Rules, 2011 — Transitional Applicability

Until specifically superseded, the IT (SPDI) Rules, 2011 continue to apply. Those rules define "sensitive personal data or information" to include:

• Passwords
• Financial information such as bank accounts, credit/debit card details
• Physical, physiological, and mental health conditions
• Sexual orientation
• Medical records and history
• Biometric information

Kritexa Labs does not collect most of these categories through its standard website or service interactions. Where such data becomes relevant to a specific engagement, appropriate safeguards and consent mechanisms are applied.

9. Processing of Personal Data

Under the DPDP Act, processing of personal data is lawful only when it is carried out for a lawful purpose:

• With the consent of the Data Principal: Where consent is the basis, it must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action by the Data Principal.
• For a legitimate use: As specified in Section 7 of the DPDP Act, which includes processing necessary for the performance of any function of the State, compliance with a legal obligation, or other purposes specified by the Central Government by notification.

Processing must at all times adhere to the data-protection principles embedded in the DPDP Act: purpose limitation, data minimisation, accuracy, storage limitation, security, and accountability.

Kritexa Labs processes personal data in the following general categories of activity:

• Receiving and responding to enquiries and service requests
• Delivering contracted technology and digital services to clients
• Operating and improving the Kritexa Labs website
• Managing client accounts and business relationships
• Recruitment and employment administration
• Financial and billing administration
• Legal and regulatory compliance
• Security, fraud prevention, and incident management

10. Notice

The DPDP Act requires Data Fiduciaries to provide clear and plain notice to Data Principals before or at the time of processing their personal data (where consent is the basis for processing). The notice must:

• Describe the personal data proposed to be processed
• Specify the purpose of processing
• Inform the Data Principal of their right to withdraw consent and the consequences of withdrawal
• Inform the Data Principal of their right to make a complaint to the Data Protection Board

The DPDP Rules, 2025 prescribe the form and manner of notice, including requirements for standardised notice formats.

Kritexa Labs provides notice of its data-processing practices through this Data Protection Policy and the Privacy Policy. Where specific processing activities require separate notice — for example, at the point of data collection through a form or account registration — Kritexa Labs will provide that notice at the relevant touchpoint.

Where personal data is collected from sources other than the Data Principal directly, Kritexa Labs will provide notice to the Data Principal to the extent required by the DPDP Act and applicable rules, unless an exception applies.

11. Consent

Under Section 6 of the DPDP Act, consent for processing personal data must be:

• Free: Not induced by coercion, undue influence, or misrepresentation.
• Specific: Relating to a specified purpose — not a general omnibus consent for all possible purposes.
• Informed: Given with the benefit of clear notice about what data is to be processed and why.
• Unconditional: Not conditional on consenting to processing beyond what is reasonably required for the stated purpose.
• Unambiguous: Expressed through a clear affirmative act — consent cannot be inferred from silence, inaction, or pre-ticked boxes.

Consent Manager Framework

The DPDP Act introduces the concept of a Consent Manager — a registered intermediary through which Data Principals may manage their consents across multiple Data Fiduciaries. When Consent Managers are operational and where applicable to Kritexa Labs' processing activities, Kritexa Labs will honour consent given, managed, reviewed, or withdrawn through a registered Consent Manager.

Record of Consent

Where Kritexa Labs processes personal data on the basis of consent, it maintains records of consent in a form that is verifiable. The obligation to demonstrate that valid consent was obtained rests with the Data Fiduciary (Kritexa Labs).

Consequences of Withdrawal

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. However, withdrawal may limit Kritexa Labs' ability to continue providing certain services or to process certain requests that were dependent on that consent. Kritexa Labs will inform the Data Principal of any such consequence at the time of withdrawal.

12. Legitimate Uses

Section 7 of the DPDP Act specifies categories of "legitimate use" for which personal data may be processed without consent. These include:

• Performance of a function of the State: Processing by the State or its instrumentalities for the discharge of their functions or provision of services or benefits to Data Principals.
• Compliance with a legal obligation: Processing necessary to comply with any law for the time being in force, including any judgment or decree of a court.
• Response to a medical emergency: Processing necessary to respond to a medical emergency involving a threat to life or immediate threat to health.
• Disaster and public order: Processing necessary for taking measures to provide medical treatment or health services during an epidemic, outbreak of disease, or any other threat to public health; or during any disaster or breakdown of public order.
• Employment purposes: Processing for employment-related purposes, including recruitment, training, attendance, performance assessment, and similar activities where consent would not reasonably be expected.
• Other purposes specified by the Central Government: Additional legitimate uses as may be notified by the Central Government from time to time.

Kritexa Labs relies on the employment-related legitimate use for processing personal data of job applicants and employees/contractors. It relies on the legal-obligation legitimate use for processing required for compliance with applicable laws, regulations, court orders, and governmental directions. Where processing is not covered by a legitimate use, Kritexa Labs seeks consent.

13. Purpose Limitation

The DPDP Act requires that personal data be processed only for the purposes for which it was collected and for which consent was obtained (or for a legitimate use). Processing for purposes that are not specified or are incompatible with the original purpose is not permissible unless new consent is obtained or a new legitimate use applies.

Kritexa Labs does not use personal data collected for one purpose for a materially different and incompatible purpose without appropriate disclosure and, where required, consent. Internal use of data is restricted to persons who have a genuine need to access it for the relevant purpose.

14. Data Minimisation

Kritexa Labs applies the principle of data minimisation — collecting and processing only such personal data as is necessary and adequate for the specified purpose. Kritexa Labs does not collect personal data in excess of what is genuinely required for the purpose for which it is collected.

In practice, this means:

• Contact forms and enquiry forms request only the information reasonably required to respond to the enquiry
• Client onboarding processes collect information proportionate to the scope of the engagement
• Recruitment applications collect information relevant to the assessment of the candidate's suitability for the role
• Analytics tools are, to the extent practicable, configured to collect aggregated or anonymised data rather than individual-level identifying data

15. Accuracy

The DPDP Act requires Data Fiduciaries to make reasonable efforts to ensure that the personal data processed is accurate and complete, particularly where it is used to make a decision about the Data Principal or is disclosed to another Data Fiduciary.

Kritexa Labs takes reasonable steps to maintain the accuracy of personal data. However, the accuracy of personal data is substantially dependent on the information provided by Data Principals themselves. Data Principals are encouraged to notify Kritexa Labs promptly of any change in their personal information.

Data Principals have the right to request correction and updating of inaccurate or incomplete personal data held by Kritexa Labs. Please refer to our Grievance & Data Rights Policy for the procedure to request correction.

16. Storage and Retention Principles

Under the DPDP Act, personal data must not be retained beyond the period necessary for the purpose for which it was processed, or such period as may be required or permitted by applicable law or contract. After this period, personal data must be erased.

Kritexa Labs applies the following storage-limitation principles:

• Personal data is retained only for as long as the relevant processing purpose subsists
• Where a processing purpose has ceased and no legal obligation requires continued retention, personal data is scheduled for secure deletion or anonymisation
• Retention periods are informed by applicable Indian law, including financial record-keeping obligations under the Companies Act and GST laws, limitation periods under the Limitation Act, and CERT-In log-retention requirements
• Anonymised data — from which all identifying elements have been irreversibly removed — is no longer personal data and is not subject to the DPDP Act's retention restrictions

For information on the specific retention practices applicable to different categories of data collected by Kritexa Labs, please refer to the Data Retention section of our Privacy Policy.

17. Security Safeguards

Section 8(5) of the DPDP Act requires Data Fiduciaries to implement appropriate technical and organisational measures to prevent personal data breaches. The DPDP Rules, 2025 specify the security safeguards to be implemented, which are proportionate to the nature, scope, and sensitivity of the personal data processed.

Kritexa Labs implements information security measures consistent with these requirements. The measures include, as applicable:

• Encrypted transmission of personal data using TLS/HTTPS across all website and platform communications
• Encryption of personal data at rest where appropriate to the sensitivity of the data
• Role-based access controls and least-privilege principles, ensuring personal data is accessible only to those who need it for legitimate purposes
• Multi-factor or two-factor authentication for access to systems containing personal data
• Regular security patching and vulnerability management for all systems that process personal data
• Logging and monitoring of access to systems containing personal data
• Secure backup and recovery procedures
• Vendor and sub-processor security assessments for third-party services that process personal data on Kritexa Labs' behalf
• Internal security policies and staff awareness
• Incident detection, response, and reporting procedures

Where applicable, Kritexa Labs' security practices are informed by the directions issued by CERT-In under Section 70B of the IT Act, including the Cyber Security Directions issued in April 2022 and any subsequent directions, which impose specific incident-reporting and cybersecurity-practice obligations on entities covered by those directions.

18. Personal Data Breaches

A personal data breach is defined under the DPDP Act as any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data that compromises the confidentiality, integrity, or availability of personal data (Section 2(u)).

Notification Obligations under the DPDP Act

Section 8(6) of the DPDP Act requires Data Fiduciaries to notify the Data Protection Board of India and each affected Data Principal in the event of a personal data breach, in the manner as may be prescribed. The DPDP Rules specify the form and manner of such notification.

CERT-In Incident Reporting

Independent of the DPDP Act notification obligation, Kritexa Labs is subject to applicable CERT-In directions under the IT Act, which require the reporting of certain cybersecurity incidents to CERT-In within the timelines specified in those directions. Kritexa Labs maintains internal procedures to ensure compliance with CERT-In reporting obligations.

Internal Response Procedures

Kritexa Labs maintains internal incident-response procedures for detecting, containing, assessing, and remediating personal data breaches. These procedures include:

• Mechanisms for detecting and escalating potential personal data breaches
• An initial assessment to determine the nature, scope, and likely impact of the breach
• Containment and remediation steps to limit ongoing harm
• Assessment of notification obligations under the DPDP Act, CERT-In directions, and other applicable law
• Documentation of the breach and the response
• Post-incident review and corrective action

19. Data Principal Rights

The DPDP Act accords Data Principals a number of rights in relation to their personal data. These rights are subject to the commencement of the relevant provisions and to applicable exceptions.

Right to Information (Section 11)

A Data Principal has the right to obtain from the Data Fiduciary, upon request:

• A summary of the personal data being processed and the processing activities undertaken in respect of that personal data by the Data Fiduciary
• The identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared, along with a description of the personal data shared
• Any other information related to the personal data and its processing as may be prescribed

Right to Correction and Erasure (Section 12)

A Data Principal has the right to request the Data Fiduciary to:

• Correct inaccurate or misleading personal data
• Complete incomplete personal data
• Update personal data that is out of date
• Erase personal data which is no longer necessary for the purpose for which it was collected, unless retention is required under applicable law or for the purpose of establishing, exercising, or defending legal rights

Erasure is subject to applicable legal obligations that may require retention. Where Kritexa Labs cannot erase data due to a legal obligation, it will inform the Data Principal of the basis for continued retention.

Right to Grievance Redressal (Section 13)

A Data Principal has the right to raise a grievance with the Data Fiduciary regarding any act or omission in respect of the performance of the obligations of the Data Fiduciary under the DPDP Act. The Data Fiduciary must respond to the grievance within the period prescribed by the Rules. Where the grievance is not resolved to the satisfaction of the Data Principal, the Data Principal may file a complaint with the Data Protection Board of India.

Right to Nominate (Section 14)

A Data Principal has the right to nominate, in the prescribed manner, any other individual who shall, in the event of the death or incapacity of the Data Principal, exercise the rights of the Data Principal under the DPDP Act.

Limitations on Rights

Data Principal rights under the DPDP Act are subject to lawful exceptions. Kritexa Labs may decline a rights request or limit the scope of its response where:

• The requested erasure or restriction would prevent Kritexa Labs from complying with a legal obligation
• The request is frivolous, vexatious, or repetitive
• Compliance with the request would reveal personal data of another person
• Verification of the Data Principal's identity cannot be satisfactorily established
• Any other exception specified under the DPDP Act or Rules applies

To exercise any of these rights, please follow the procedure described in our Grievance & Data Rights Policy.

20. Consent Withdrawal

Section 6(4) of the DPDP Act provides that a Data Principal may withdraw consent at any time, with the ease comparable to the ease with which consent was given. The Data Fiduciary must enable such withdrawal and cease processing upon receipt of a valid withdrawal request.

In practice for Kritexa Labs:

• A Data Principal who has given consent for marketing communications may withdraw that consent at any time by following the opt-out mechanism provided in the communication or by contacting us directly.
• A Data Principal who has given consent for other categories of processing may withdraw that consent by submitting a written request to enquiry@kritexalabs.com.
• Kritexa Labs will acknowledge and act on valid consent withdrawal requests promptly.
• Where withdrawal of consent affects Kritexa Labs' ability to deliver a service or fulfil a request, we will inform the Data Principal of this consequence at the time of withdrawal.
• Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

21. Grievance Redressal Framework

The DPDP Act requires Data Fiduciaries to establish and make available a mechanism for the redressal of grievances raised by Data Principals. The DPDP Rules prescribe the timelines and manner in which grievances must be addressed.

Kritexa Labs' Grievance Officer

Kritexa Labs designates a point of contact for receiving and addressing privacy grievances and data rights requests. Contact details are provided in Section 30 of this policy and in the Grievance & Data Rights Policy.

Internal Resolution Process

Data Principals who raise a grievance with Kritexa Labs can expect:

• Acknowledgement of the grievance within a reasonable time
• Assessment and investigation of the grievance
• A written response addressing the grievance and any action taken
• Notification of the outcome and, where applicable, the right to escalate to the Data Protection Board

For the complete procedure, including timelines and escalation steps, please refer to the Grievance & Data Rights Policy.

Data Protection Board Escalation

Where a Data Principal's grievance is not resolved to their satisfaction by Kritexa Labs, they may file a complaint with the Data Protection Board of India, once the Board is established and operational. The Board has jurisdiction to investigate complaints, call for records, and impose penalties as provided under the DPDP Act.

22. Children's Personal Data

Section 9 of the DPDP Act provides specific protections for children's personal data. For the purposes of the Act, a "child" means a person who has not completed the age of eighteen years.

Verifiable Parental Consent

A Data Fiduciary must obtain verifiable consent from the parent or lawful guardian of a child before processing the personal data of a child. The DPDP Rules specify the mechanism for obtaining verifiable parental consent, which may include age verification and parent/guardian verification.

Prohibitions

The DPDP Act prohibits Data Fiduciaries from:

• Processing personal data of a child in a manner that is likely to cause detrimental effect on the well-being of the child
• Tracking or behavioural monitoring of children
• Targeted advertising directed at children

Kritexa Labs' Position

Kritexa Labs' website and services are directed at adult users and businesses. Kritexa Labs does not knowingly or intentionally process personal data of children. Our digital properties are not designed to attract or engage minors, and we do not implement age-verification or parental-consent workflows because our services are not directed at individuals below 18 years of age.

If Kritexa Labs becomes aware that personal data of a child has been inadvertently collected without appropriate parental consent, it will take prompt steps to delete that data and to notify the parent or guardian where possible. If you believe a child's data has been submitted to Kritexa Labs without consent, please contact us immediately at enquiry@kritexalabs.com.

23. Significant Data Fiduciary

Section 10 of the DPDP Act empowers the Central Government to notify certain Data Fiduciaries as Significant Data Fiduciaries based on an assessment of factors including:

• The volume and sensitivity of personal data processed
• The risk to the rights of Data Principals
• The potential impact on the sovereignty and integrity of India
• The risk to electoral democracy
• The security of the State
• Public order

Significant Data Fiduciaries are subject to enhanced obligations, including:

• Appointment of a Data Protection Officer (DPO) based in India
• Appointment of an independent Data Auditor to evaluate compliance
• Undertaking periodic Data Protection Impact Assessments
• Other measures as may be notified

24. Cross-Border Processing and Transfers

Section 16 of the DPDP Act addresses the transfer of personal data outside India. The provision empowers the Central Government to restrict the transfer of personal data by a Data Fiduciary for processing to such countries or territories outside India as may be specified.

Until such restrictions are notified by the Central Government, transfers of personal data outside India are generally permitted under the DPDP Act framework, subject to any applicable restrictions that may be notified.

Kritexa Labs' cross-border processing arises principally from the use of third-party service providers — such as cloud hosting, analytics, AI platform, and productivity tool providers — whose infrastructure may be located outside India. Kritexa Labs takes reasonable contractual and technical steps to ensure that such processing is conducted with appropriate safeguards.

As and when the Central Government issues notifications specifying countries or restrictions on cross-border transfers, Kritexa Labs will review its service-provider arrangements and take appropriate action to comply with those restrictions.

25. Data Protection Board of India

The DPDP Act establishes the Data Protection Board of India as an independent body with the following principal functions:

• Adjudicating complaints filed by Data Principals against Data Fiduciaries for alleged violation of rights under the DPDP Act
• Directing Data Fiduciaries to take corrective action
• Imposing financial penalties on Data Fiduciaries and Data Processors for non-compliance
• Receiving and investigating reports of personal data breaches

Data Principals whose grievances are not resolved by Kritexa Labs may file a complaint with the Data Protection Board once it is operational. The Board's decisions are subject to appeal before the Appellate Tribunal.

The DPDP Act prescribes significant financial penalties for non-compliance, including penalties for breaches of obligations relating to children's data, failure to implement security safeguards, and failure to notify personal data breaches.

26. Government and Regulatory Requirements

Kritexa Labs is subject to a range of government and regulatory requirements in addition to the DPDP Act framework. These include:

Ministry of Electronics and Information Technology (MeitY)

MeitY is the nodal ministry for implementing the DPDP Act and DPDP Rules. MeitY may issue guidance, notifications, and orders relevant to data-protection obligations, and Kritexa Labs monitors MeitY publications to stay informed of applicable requirements.

CERT-In

CERT-In is designated as the national agency for responding to cybersecurity incidents under Section 70B of the IT Act. The CERT-In Cyber Security Directions issued in April 2022, as subsequently amended, impose obligations on entities covered by those directions to:

• Report specified cybersecurity incidents to CERT-In within six hours of becoming aware of the incident
• Maintain logs of specified ICT activities for a period of 180 days
• Synchronise ICT system clocks with the NTP server of the National Informatics Centre (NIC) or NPLT
• Furnish information requested by CERT-In for the purposes of cyber incident response

Kritexa Labs takes reasonable steps to comply with applicable CERT-In directions. Whether specific CERT-In directions apply to Kritexa Labs depends on its classification under those directions, which is assessed on an ongoing basis as our infrastructure and services evolve.

Other Applicable Law

Kritexa Labs' handling of personal data is also subject to other applicable Indian law, including the Companies Act, 2013 (to the extent applicable to business records), the Income Tax Act (for financial record-keeping), and applicable GST legislation. Records maintained for these purposes are handled in accordance with both the relevant financial/tax legislation and the applicable data-protection framework.

27. Kritexa Labs' Data Protection Governance

Kritexa Labs approaches data protection as an organisational matter, not merely a legal compliance exercise. Our data protection governance framework includes:

Internal Accountability

Responsibility for data protection compliance rests at the organisational level. Those involved in activities that involve the collection, processing, or handling of personal data are expected to be aware of and comply with applicable data-protection obligations.

Privacy by Design

Where practicable, Kritexa Labs applies privacy-by-design principles when building or deploying products and services — considering data minimisation, access controls, and purpose limitation from the outset of system development rather than as an afterthought.

Third-Party Management

Kritexa Labs takes reasonable steps to ensure that third-party service providers who process personal data on our behalf maintain appropriate data-protection standards. Where practicable, appropriate contractual terms are put in place with data processors.

Policy Review

This Data Protection Policy is reviewed periodically and updated to reflect changes in applicable law, including the phased commencement of DPDP Act provisions, and changes to Kritexa Labs' business operations and data flows.

28. Compliance Approach

Kritexa Labs is committed to complying with applicable Indian data-protection law. The following points describe our current compliance posture:

Active Obligations (Currently Applicable)

• Maintaining and publishing a Privacy Policy and Data Protection Policy describing our data practices
• Implementing reasonable security safeguards under the IT (SPDI) Rules, 2011 and applicable CERT-In directions
• Providing a grievance mechanism for privacy-related complaints
• Not collecting or processing personal data beyond what is reasonably necessary
• Not retaining personal data longer than required
• Not selling personal data to third parties
• Not processing children's data through services directed at minors

Obligations Subject to DPDP Act Commencement

• Formal DPDP-compliant consent mechanisms in the prescribed format
• Formal Data Principal rights response procedures in the manner prescribed by the DPDP Rules
• Notification of personal data breaches to the Data Protection Board in the prescribed manner
• Compliance with cross-border transfer restrictions as and when notified by the Central Government
• Enhanced obligations if notified as a Significant Data Fiduciary

29. Changes to This Policy

Kritexa Labs will update this Data Protection and DPDP Policy as required to reflect:

• New notifications issued by the Central Government commencing DPDP Act provisions
• New DPDP Rules, amendments, or regulatory guidance issued by MeitY
• New CERT-In directions or amendments to existing directions
• Changes to Kritexa Labs' business operations, data flows, or service-provider arrangements
• Decisions or guidance issued by the Data Protection Board of India once operational

The "Last Updated" date at the top of this page will be revised when the policy is updated. Significant changes will be communicated through appropriate channels.

30. Contact

For questions or concerns about this Data Protection and DPDP Policy, or to exercise your rights as a Data Principal, please contact Kritexa Labs:

Please use the subject line "Data Protection Enquiry" or "Data Principal Rights Request" in your email. For the detailed procedure for submitting rights requests and grievances, including identity verification requirements, please refer to our Grievance & Data Rights Policy.