Legal Pages

This Grievance and Data Rights Policy explains how individuals may submit privacy and data-related requests to Kritexa Labs, how Kritexa Labs processes those requests, and how unresolved grievances can be escalated. This is an operational policy — it tells you exactly what to do and what to expect.

For background on the personal information Kritexa Labs collects and how it is used, please see our Privacy Policy. For the detailed Indian data-protection legal framework, including your statutory rights under the DPDP Act, please see our Data Protection / DPDP Policy.

1. Purpose

This policy has three purposes:

• Enable data rights requests: To provide a clear, practical mechanism for individuals to exercise their rights in relation to personal data held by Kritexa Labs — including rights to access, correct, erase, and withdraw consent.
• Enable grievance submission: To provide a clear, practical mechanism for individuals to raise complaints or concerns about how Kritexa Labs has handled their personal data or complied with applicable data-protection law.
• Ensure fair and transparent resolution: To set out how Kritexa Labs handles requests and grievances, including timelines, verification requirements, grounds for refusal, and escalation paths.

2. Who Can Submit a Request

Any of the following individuals may submit a data rights request or grievance to Kritexa Labs:

• Individuals whose personal data Kritexa Labs holds or processes — including website visitors, enquiry submitters, clients, platform users, and job applicants
• Authorised representatives acting on behalf of an individual (see Section 12)
• Legal guardians or parents acting on behalf of a child whose personal data has been processed (see Section 12)
• Nominees appointed by a Data Principal under the DPDP Act, 2023, to exercise rights on that person's behalf in the event of their death or incapacity (once the relevant DPDP Act provisions come into force)

Where Kritexa Labs processes personal data as a Data Processor on behalf of a client (for example, where Kritexa Labs manages a client's CRM system or chatbot), requests relating to that data should typically be directed to the client (the Data Fiduciary), not to Kritexa Labs. Kritexa Labs will direct such requests to the appropriate client where they are received.

3. Types of Requests

The following categories of request can be submitted to Kritexa Labs:

• Access request: A request to receive information about the personal data Kritexa Labs holds about you and how it is processed
• Correction request: A request to have inaccurate, incomplete, or outdated personal data corrected or updated
• Erasure request: A request to have personal data deleted, where the purpose for which it was collected has been fulfilled and no legal obligation requires its continued retention
• Consent withdrawal: A request to withdraw consent previously given for a specific processing purpose
• Marketing opt-out: A request to stop receiving marketing communications from Kritexa Labs
• Privacy grievance: A formal complaint about how Kritexa Labs has collected, used, shared, secured, or retained your personal data, or about an alleged breach of applicable data-protection law
• General data enquiry: A query about Kritexa Labs' data practices that does not fall into the above categories

4. Access and Information Requests

You may request the following information from Kritexa Labs in relation to your personal data:

• A summary of the categories of personal data that Kritexa Labs holds about you
• A description of the purposes for which your personal data is being processed
• Information about any other entities with whom your personal data has been shared, along with a description of the data shared
• Information about the source from which Kritexa Labs obtained your personal data, if it was not collected directly from you

Kritexa Labs will respond to a valid access request by providing the information it holds that is relevant to your request, subject to applicable legal exceptions (including where disclosure would infringe the rights of another person, or where a legal exemption applies).

Where a large volume of personal data is held, Kritexa Labs may ask you to clarify the scope of your request to enable an effective and proportionate response.

5. Correction and Update Requests

You may request that Kritexa Labs corrects or updates personal data about you that is inaccurate, incomplete, or out of date. When submitting a correction request:

• Please specify clearly what information you believe to be inaccurate or incomplete and what the correct information is
• Where possible, provide supporting evidence for the correction (for example, a document confirming a change of name or address)

Kritexa Labs will review your correction request and:

• Make the requested correction or update where it can be verified as accurate
• Explain why a correction cannot be made if there are grounds for not doing so (for example, if the information is held for a legal or regulatory purpose that requires it to be retained in its original form)
• Notify any third parties to whom the relevant data was shared of the correction, where practicable and required by applicable law

6. Deletion and Erasure Requests

You may request that Kritexa Labs deletes personal data about you in the following circumstances:

• The purpose for which the personal data was collected has been fulfilled and there is no longer a legitimate reason to retain it
• You have withdrawn consent that was the basis for processing, and there is no other legal ground for continued processing
• The personal data is no longer necessary for any legitimate purpose of Kritexa Labs

Erasure requests are subject to the following:

• Legal retention obligations: Kritexa Labs may be required to retain certain data by applicable law — for example, financial records under the Companies Act or GST law, system logs under CERT-In directions, or records relevant to ongoing legal proceedings. Where a legal obligation requires retention, erasure cannot be completed during the relevant retention period.
• Active service relationships: Where data is necessary for the ongoing delivery of services under an active service agreement, erasure may not be possible while the service is active.
• Dispute resolution: Data relevant to an active dispute or legal claim may be retained until that matter is resolved.

Where Kritexa Labs cannot fulfil an erasure request in full, it will inform you of the specific ground for continued retention and the expected period during which the data will be retained before deletion.

7. Consent Withdrawal

Where Kritexa Labs processes your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent is processed as follows:

How to Withdraw Consent

• For marketing communications specifically: use the unsubscribe link in any marketing email, or email enquiry@kritexalabs.com with the subject "Marketing Opt-Out"
• For other consent-based processing: email enquiry@kritexalabs.com with the subject "Consent Withdrawal" specifying the processing activity and purpose for which you wish to withdraw consent

Effect of Withdrawal

• Kritexa Labs will cease the relevant processing activity upon receipt and verification of a valid consent withdrawal request
• Withdrawal does not affect the lawfulness of processing carried out before the withdrawal
• Where withdrawal of consent affects Kritexa Labs' ability to deliver a service or fulfil a contractual obligation, Kritexa Labs will inform you of the consequences at the time of or before processing the withdrawal

Ease of Withdrawal

Under the DPDP Act, 2023, withdrawal of consent must be as easy as giving consent. Kritexa Labs endeavours to make consent withdrawal straightforward and accessible through the contact methods described in Section 21.

8. Marketing Opt-Out

You may opt out of receiving marketing communications from Kritexa Labs at any time. To opt out:

• By email: Email enquiry@kritexalabs.com with the subject line "Marketing Opt-Out" and your name and the email address or phone number from which you wish to be removed
• Via an email you receive: Follow the unsubscribe link or instructions included in any marketing email from Kritexa Labs

Kritexa Labs will process your marketing opt-out request promptly. Please note that:

• Opt-out from marketing communications does not prevent Kritexa Labs from sending you transactional or service-related messages that are necessary for the administration of an active service relationship (such as invoices, service updates, or security notifications)
• Processing may take a short period to take effect in all communication channels, particularly where Kritexa Labs uses different platforms for different types of communications

9. Grievance Submission

A privacy grievance is a formal complaint about how Kritexa Labs has handled your personal data, including but not limited to:

• A concern that Kritexa Labs has collected or processed your personal data without a valid legal basis
• A concern that personal data is being retained longer than necessary
• A concern about the security or confidentiality of your personal data
• A concern that personal data has been shared with a third party without your knowledge or authorisation
• A failure by Kritexa Labs to respond adequately to a previous data rights request
• A personal data breach that has or may have affected your personal data
• Any other act or omission by Kritexa Labs that you believe constitutes a breach of applicable data-protection law

How to Submit a Grievance

Please submit your grievance in writing to Kritexa Labs at:

• Email: enquiry@kritexalabs.com
• Subject line: "Privacy Grievance" or "Data Rights Grievance"

For the fastest and most effective response, please provide the information specified in Section 10 when submitting your grievance.

10. Required Request Information

To enable Kritexa Labs to process your request or grievance effectively, please include the following information:

For All Requests

• Your full name
• The email address at which you are contactable for correspondence regarding the request
• The nature of the request or grievance (for example: access request, correction request, erasure request, consent withdrawal, marketing opt-out, or grievance)
• A clear description of the request or grievance, including the specific data concerned and the circumstances that prompted the request

For Correction Requests — Additional Information

• The specific data that you believe is inaccurate or incomplete
• The correct information and, if available, supporting evidence

For Erasure Requests — Additional Information

• The category or specific piece of data you wish to have erased
• The basis on which you believe erasure is appropriate

For Grievances — Additional Information

• A description of the act or omission by Kritexa Labs that you are complaining about
• The dates or period to which the grievance relates
• Any previous communication with Kritexa Labs about the matter (including any reference numbers or dates)
• The outcome you are seeking (for example: correction, deletion, an apology, an explanation, or a stop to a particular processing activity)

The more specific and detailed your request, the faster and more effectively Kritexa Labs can respond. Vague or incomplete requests may require further clarification before they can be processed.

11. Identity Verification

Before Kritexa Labs processes a data rights request or grievance, it must take reasonable steps to verify that the request is being made by the individual to whom the personal data relates (or their authorised representative).

Identity verification is necessary to:

• Protect against fraudulent requests that seek to access, delete, or modify another person's personal data
• Ensure that personal data is disclosed only to those who have a right to receive it

Verification Process

Kritexa Labs may request one or more of the following to verify your identity:

• Confirmation of the email address associated with your account or previous interactions with Kritexa Labs
• Specific information known to Kritexa Labs in connection with your account or service relationship (such as a project reference or the approximate date of last contact)
• Where the risk level of the request warrants it and where less invasive verification is not possible, a copy of a government-issued identity document (with sensitive elements such as identification numbers redacted where not necessary for verification purposes)

Kritexa Labs will not ask for verification information that is disproportionate to the nature of the request. The extent of verification required will be proportionate to the sensitivity of the data concerned and the potential impact of the request.

Where Identity Cannot Be Verified

Where Kritexa Labs cannot satisfactorily verify the identity of a person submitting a request, it may decline to process the request and will explain why. Kritexa Labs will ask for verification information as a prerequisite to processing only where reasonably necessary, and will not use verification requirements as a mechanism to obstruct the legitimate exercise of data rights.

12. Representative and Authorised Requests

A data rights request or grievance may be submitted by an authorised representative on behalf of the Data Principal in the following circumstances:

Authorised Representatives

An individual may authorise another person (for example, a lawyer or trusted family member) to act on their behalf in submitting a data rights request or grievance. Where a request is submitted by an authorised representative:

• The request must clearly state that it is being made on behalf of the Data Principal and provide the Data Principal's identifying information
• Kritexa Labs will request evidence of the authorisation (for example, a written authorisation from the Data Principal)
• Responses and correspondence will be addressed to the Data Principal (or to the representative if so authorised)

Parents and Legal Guardians

A parent or legal guardian may submit a request relating to the personal data of a child for whom they are responsible. Kritexa Labs will request evidence of the guardianship relationship where it is not readily apparent.

Nominee Requests (DPDP Act)

Once the relevant provisions of the DPDP Act, 2023 come into force, a nominee appointed by a Data Principal will be entitled to exercise the Data Principal's rights in the event of that person's death or incapacity. Where such a nomination is exercised, Kritexa Labs will request appropriate evidence of the nomination and the circumstances that give rise to the exercise of nominated rights.

13. Request Processing

Kritexa Labs will handle data rights requests and grievances in accordance with the following general process:

Acknowledgement

Upon receipt of a request or grievance, Kritexa Labs will send an acknowledgement to the email address provided, confirming that the request has been received. The acknowledgement will be sent within a reasonable period of receipt — typically within 3 business days.

Identity Verification (where required)

Where identity verification is required, Kritexa Labs will contact you to request the necessary verification information. The processing timeline does not begin until adequate verification has been provided.

Assessment and Investigation

Kritexa Labs will assess the request or grievance and investigate the relevant facts, data holdings, and processing activities. For grievances, this may include a review of records, communications, and processing logs.

Response

Kritexa Labs will provide a substantive written response to the request or grievance. The response will:

• Address the substance of the request or grievance
• Describe any action taken or proposed
• Explain any decision to refuse or limit the scope of the response, including the specific legal or factual grounds for refusal
• Inform you of your right to escalate to the Data Protection Board of India if you are not satisfied with the response (once the Board is operational)

Response Timelines

Kritexa Labs will endeavour to respond to data rights requests and grievances within the timelines prescribed by applicable law. Under the DPDP Rules, 2025 (subject to commencement), Data Fiduciaries are required to respond to Data Principal requests within specified time periods. Kritexa Labs will act in accordance with those timelines as and when they come into force.

As a general practice (and before formal commencement of the relevant provisions), Kritexa Labs aims to provide an initial response to requests within 30 days and to resolve straightforward requests within that period. Complex requests or grievances may require additional time; where this is the case, Kritexa Labs will notify you and provide a revised expected response date.

14. Clarification Requests

Where a data rights request or grievance is unclear, incomplete, or so broadly stated that Kritexa Labs cannot reasonably process it without further information, Kritexa Labs may contact you to request clarification.

Where clarification is sought:

• Kritexa Labs will contact you at the email address provided in the request
• The processing timeline will pause pending receipt of the requested clarification
• Kritexa Labs will specify what additional information is required and why

You are not obliged to respond to a clarification request. However, where sufficient information is not provided to enable Kritexa Labs to identify and locate the relevant data or assess the request, Kritexa Labs may be unable to process the request and will explain why.

15. Grounds for Refusal

Kritexa Labs may decline to process a request in whole or in part on the following grounds, to the extent permitted by applicable law:

• Identity verification failure: Where Kritexa Labs cannot satisfactorily verify the identity of the requester
• Legal retention obligation: Where the requested deletion cannot be carried out because a legal or regulatory obligation requires continued retention of the data
• Third-party rights: Where complying with the request would require disclosure of personal data relating to another individual
• Manifest unfoundedness or excessive repetition: Where a request is manifestly unfounded, frivolous, or repetitive (for example, where the same request has been recently processed without any change in circumstances)
• Active legal proceedings: Where the requested action could prejudice ongoing legal proceedings, a regulatory investigation, or Kritexa Labs' ability to defend a legal claim
• Professional secrecy: Where disclosure would breach applicable professional obligations of confidentiality
• Statutory exemption: Where any other statutory exemption or exception under the DPDP Act or applicable Indian law applies

Where Kritexa Labs declines a request, it will inform you of the specific ground for refusal and, where possible, the extent to which any part of the request can be accommodated notwithstanding the partial refusal. You retain the right to escalate any refused request to the Data Protection Board of India once it is operational.

16. Data Retention During Disputes

Where you have submitted an erasure request and Kritexa Labs has declined it on grounds of a legal obligation or legitimate interest, the relevant data will be retained only for as long as that obligation or interest subsists. Once the relevant period has passed and no other legal basis for retention applies, the data will be scheduled for secure deletion.

Where you have raised a grievance that is under investigation or that has been referred to the Data Protection Board, Kritexa Labs will retain the data relevant to the grievance until the matter has been fully resolved and any applicable appeal period has elapsed.

Where data is retained on the basis of an active dispute or potential legal claim, Kritexa Labs will cease that retention as soon as the dispute or claim is resolved and the applicable limitation period has expired.

17. Escalation Process

Where you are not satisfied with Kritexa Labs' response to a data rights request or grievance, you may escalate the matter through the following steps:

Step 1 — Internal Re-review

If you believe that your request or grievance has not been adequately addressed, you may write to Kritexa Labs requesting a re-review of the matter, explaining why you are not satisfied with the initial response. Please send your re-review request to enquiry@kritexalabs.com with the subject line "Grievance Re-review" and include the reference number or date of your original request.

Step 2 — Formal Escalation to Data Protection Board

If, after the internal re-review, you remain unsatisfied with Kritexa Labs' response, you may file a complaint with the Data Protection Board of India once it is operational. See Section 19 for details.

18. Applicable Regulatory Escalation

In addition to the Data Protection Board, the following regulatory authorities may be relevant to specific categories of complaint:

CERT-In (Cybersecurity Incidents)

If you have concerns relating to a cybersecurity incident or data breach, the Indian Computer Emergency Response Team (CERT-In) operates as the national cybersecurity incident response authority under Section 70B of the IT Act, 2000. CERT-In can be contacted through its official website at cert-in.org.in.

Consumer Protection

Where a complaint relates to a commercial service or product and involves a consumer dispute as defined under the Consumer Protection Act, 2019, you may also have recourse to the applicable consumer dispute redressal mechanisms, including Consumer Disputes Redressal Commissions.

Courts of Law

Nothing in this policy prevents you from seeking remedies through the courts of competent jurisdiction in India. The existence of this grievance procedure does not limit your legal rights.

19. Data Protection Board of India

The Data Protection Board of India is established under Section 18 of the DPDP Act, 2023, as an independent adjudicatory body for data-protection complaints in India. Once the Board is established and operational:

• You will be entitled to file a complaint with the Board against Kritexa Labs for alleged breach of its obligations under the DPDP Act
• The Board has the power to investigate complaints, require the production of records, direct corrective action, and impose financial penalties on Data Fiduciaries found to be in breach
• Before filing a complaint with the Board, you must have first raised the matter as a grievance with Kritexa Labs and either: (a) received a response that does not satisfy you, or (b) not received a response within the prescribed period
• Decisions of the Data Protection Board can be appealed to the Appellate Tribunal

Details of how to contact and file a complaint with the Data Protection Board will be made available by MeitY when the Board becomes operational. Kritexa Labs will provide updated information and a link to the Board's contact details in this policy when they are available.

20. Abuse and Fraudulent Requests

Kritexa Labs takes the following steps to prevent abuse of the data rights and grievance mechanism:

• Identity verification is required before any personal data is disclosed or modified in response to a request
• Requests that appear to be manifestly abusive, fraudulent, or intended to obstruct business operations may be declined and, where appropriate, reported to the relevant authorities
• Requests that are excessively repetitive, clearly unfounded, or made for improper purposes (such as to harass Kritexa Labs' staff) may be declined with explanation
• Kritexa Labs reserves the right to charge a reasonable administrative fee for repetitive requests that impose a disproportionate administrative burden, to the extent permitted by applicable law

In all cases, Kritexa Labs will act in good faith and in accordance with applicable law. The right to decline a request is exercised only where there are legitimate legal grounds to do so, and refusals are explained in writing.

21. Contact Details

All data rights requests, consent withdrawals, marketing opt-outs, and privacy grievances should be directed to Kritexa Labs' data contact point:

Recommended Subject Lines

• Access request: "Data Access Request"
• Correction request: "Data Correction Request"
• Erasure request: "Data Erasure Request"
• Consent withdrawal: "Consent Withdrawal"
• Marketing opt-out: "Marketing Opt-Out"
• Grievance: "Privacy Grievance"
• General data enquiry: "Data Enquiry"

Including the relevant subject line will help Kritexa Labs route your request to the right person and process it as quickly as possible. Please include your full name and contact email in the body of your message.

22. Changes to This Policy

Kritexa Labs will update this Grievance and Data Rights Policy as required to reflect:

• Changes in applicable Indian law, including the commencement of DPDP Act provisions and the issuance of DPDP Rules
• The establishment and operationalisation of the Data Protection Board of India
• Changes to Kritexa Labs' internal processes for handling requests and grievances
• Improvements to the clarity and effectiveness of the procedures described

The "Last Updated" date at the top of this page will be revised when the policy is updated. Significant changes will be communicated through appropriate channels. We encourage you to review this policy periodically.