Grievance Redressal and Data Rights Procedure

How anyone can complain, ask about their data, or use their rights - and how Indoria must answer

Indoria Technologies Private Limited | Version 1.0 | October 2026

Template - not legal advice. This document was drafted for Indoria Technologies Private Limited to match how the software actually works. Company details are filled in. Until an advocate has reviewed it, treat it as a draft; Document 28 explains the smallest review that is worth paying for, especially the Digital Personal Data Protection Act 2023 sections, the handling of students under 18, and the limitation of liability.

Indoria Technologies Private Limited publishes this procedure so that users and customers know where to complain and what to expect. It supports the Privacy Policy (Document 8) and Terms of Service (Document 9). Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 a data fiduciary must publish how a person can exercise rights and how grievances are handled; the Rules set a reasonable period for responses of not more than 90 days. Indoria's own commitment is shorter, as below. Rules 1, 2 and 17 to 21 apply now; the main fiduciary duties apply from about 13 May 2027 (Document 28).

1. Grievance Officer

2. What you can ask for

• Access: a summary of the personal data Indoria holds about you and who it was shared with. (Signed-in users can download their own data from Account > Your data.)
• Correction and completion: fix or complete wrong or incomplete data. (Name and e-mail can be edited in Account.)
• Erasure: delete data that is no longer needed for its purpose, subject to records the law requires Indoria to keep. (Account > Delete account.)
• Withdraw consent at any time, as easily as it was given. Withdrawal does not undo what was done before.
• Grievance: a complaint about how Indoria handled your data or your account.
• Nominate another person to exercise these rights on your behalf if you die or cannot act.

If your data is in a workspace run by your school, employer or another business, that organisation decides why the data is used. We will pass your request to it, tell you we did, and help it answer.

3. How to ask

1. Write to the Grievance Officer, or use the Account page. State your name, the e-mail on the account and what you want.
2. We may ask for proof that the request is from you, such as replying from the account e-mail. We will not ask for more personal data than is needed.
3. We send an acknowledgement within 24 hours (an automatic e-mail is enough) with a reference number.
4. We answer within 30 days (up to 90 days for a complex case, with a reason and a date).
5. The reply says what we did or why we could not. If you are not satisfied, you may complain to the Data Protection Board of India once the Board is working and after you have used this procedure first, as the Act requires.

4. Complaints about content or conduct

If you think content on the service breaks the law or the Acceptable Use Policy, write to the same address with the link or file name, who owns it if you know, and why. We review it within 24 hours, act as the law and the policy require, and tell you the outcome.

5. Records

The Grievance Officer keeps a register of every request and complaint: date received, reference, what was asked, action taken, date closed. A short monthly summary goes to the directors. Keep the register for at least 3 years.

6. Children

For someone under 18, a parent or guardian makes the request. Indoria does not knowingly open accounts for children on its own; schools or parents arrange the account and give consent (see Privacy Policy section 8).