Privacy Policy

1. Definitions

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act and applicable Indian law.
• "Sensitive Personal Data or Information" or "SPDI" includes passwords, financial information, biometric data, health data, and other categories specified under the SPDI Rules, where applicable.
• "Data Principal" means the individual to whom personal data relates.
• "Data Fiduciary" means SkillCrunch Private Limited in respect of data we determine the purpose and means of processing for the Platform.
• "Authorised User" means an individual authorised by a subscribing firm (organisation admin, account manager, or client user) to access the Platform.
• "Client Data" means documents, communications, payment records, and other information uploaded or generated by or on behalf of a firm's clients through the Platform.
• "Processing" includes collection, storage, use, disclosure, transfer, and deletion of personal data.

2. Roles and Responsibilities

SkillCrunch acts as a Data Fiduciary for personal data collected directly from Website visitors, prospective customers, and Authorised Users who register for or administer LegalAck accounts.

For Client Data uploaded by compliance firms about their clients, the subscribing firm is primarily responsible for determining the lawful basis for processing and for complying with its obligations as a data fiduciary or data processor (as applicable) under Indian law. SkillCrunch processes such data on the firm's instructions to provide the Services, implement security controls, and maintain the Platform.

Firms using LegalAck must ensure they have appropriate authority, notices, and consents from their clients and staff before uploading personal data to the Platform.

3. Categories of Data We Collect

4. Purposes of Processing

• To provide, operate, maintain, secure, and improve the Platform and Website.
• To create and manage user accounts, organisation workspaces, and role-based access.
• To enable document collection, review, approval, rejection, re-upload, and status tracking.
• To send automated email notifications and service communications.
• To process subscription fees, generate invoices, and facilitate payments through integrated gateways or manual verification flows.
• To provide onboarding, customer support, and technical assistance.
• To detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms.
• To comply with legal obligations, lawful requests from authorities, and enforce our agreements.
• To send product updates and marketing communications where permitted by law and your preferences.
• To conduct analytics, benchmarking, and product development using aggregated or de-identified data.

5. Legal Basis for Processing

Under the DPDP Act and applicable law, we rely on one or more of the following grounds:

• Consent — where you voluntarily provide data, accept cookies, or opt in to marketing.
• Performance of a contract — to deliver the Services you or your organisation subscribed to.
• Legitimate uses permitted under the DPDP Act — including certain employment, contractual, and security-related processing.
• Legal obligation — to comply with tax, regulatory, accounting, or court orders.
• Vital interests or public interest — only where strictly required by applicable law.

6. Sensitive Personal Data

The Platform may process SPDI including financial information contained in uploaded documents, payment-related data, and authentication credentials. We implement reasonable security practices as required under the SPDI Rules. Firms must not upload data they are not legally authorised to share and must classify sensitive uploads appropriately within their internal policies.

We do not intentionally collect personal data from children under 18 years of age. If you believe a minor's data has been submitted without appropriate authority, contact us immediately at hello@legalack.com.

7. Data Sharing and Disclosure

We may share personal data with:

• Cloud infrastructure, hosting, email delivery, analytics, and security vendors who process data under contractual confidentiality and security obligations.
• Payment processors including Razorpay and Cashfree, and banking partners, solely to complete transactions you initiate.
• Professional advisers (lawyers, auditors, insurers) under confidentiality obligations.
• Law enforcement, regulators, courts, or government authorities when required by applicable law or to protect rights, safety, and security.
• Successors in the event of merger, acquisition, reorganisation, or sale of assets, subject to this Policy.
• Authorised users within your organisation and, where configured by your firm, client portal users with role-based access.
• We do not sell personal data. We do not share Client Data with third parties for their independent marketing without the firm's instruction or lawful basis.

8. International Data Transfers

Our primary data processing is intended to occur within India. If we or our subprocessors transfer personal data outside India, we will do so in compliance with applicable Indian law, including any restrictions or conditions under the DPDP Act and RBI guidelines, and implement appropriate contractual safeguards.

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements.

Account data is generally retained for the duration of the subscription and for a reasonable period thereafter (typically up to seven (7) years for financial and tax-related records, unless a longer period is required by law).

Upon termination, firms may export data during any agreed transition period. Thereafter, we may delete or anonymise data in accordance with our retention schedule and backup policies, except where retention is legally required.

10. Security Measures

We implement reasonable technical and organisational measures including access controls, encryption in transit (TLS/SSL), role-based permissions, audit logging, secure development practices, and periodic security reviews, consistent with the SPDI Rules and industry standards for SaaS platforms.

No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your login credentials and promptly notifying us of any suspected unauthorised access.

11. Your Rights

Subject to applicable Indian law, Data Principals may have the following rights:

• Right to access information about personal data processed and sharing practices.
• Right to correction and updating of inaccurate or incomplete data.
• Right to erasure/deletion, subject to legal retention requirements and contractual obligations.
• Right to grievance redressal and nomination of a representative in certain circumstances under the DPDP Act.
• Right to withdraw consent where processing is consent-based, without affecting prior lawful processing.
• Authorised Users should contact their organisation administrator for Client Data held on behalf of a firm. Direct requests may be submitted to hello@legalack.com. We will verify identity and respond within timelines prescribed under applicable law.

12. Cookies and Tracking Technologies

We use essential cookies for authentication, security, and session management, and may use analytics cookies to understand Website usage. You can control non-essential cookies through browser settings. Disabling certain cookies may affect Platform functionality.

13. Marketing Communications

We may send service-related communications that are necessary for account operation. Promotional emails may be sent where permitted; you may opt out using the unsubscribe link or by emailing hello@legalack.com.

14. Grievance Redressal

In accordance with the IT Act, SPDI Rules, and DPDP Act, the Grievance Officer for LegalAck is:

Grievance Officer, SkillCrunch Private Limited SkillCrunch Private Limited CIN: U58200PN2024PTC229087 Registered Office: 106 Main Road, Chandekasare, Kopargaon, Maharashtra, India - 423601 Product: LegalAck Email: hello@legalack.com Grievance: hello@legalack.com Phone: +91 9657179282 Website: https://legalack.com

We will acknowledge grievances promptly and endeavour to resolve them within thirty (30) days, or within the timeline prescribed under applicable law, whichever is earlier. If unsatisfied, you may escalate to the Data Protection Board of India or other competent authority once operational under the DPDP Act.

15. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via the Website, email, or in-app notice. Continued use after the effective date constitutes acceptance of the updated Policy.

16. Contact Us

SkillCrunch Private Limited CIN: U58200PN2024PTC229087 Registered Office: 106 Main Road, Chandekasare, Kopargaon, Maharashtra, India - 423601 Product: LegalAck Email: hello@legalack.com Grievance: hello@legalack.com Phone: +91 9657179282 Website: https://legalack.com