Legal centre / Grievance Redressal
Grievance Redressal
Who to complain to, what happens when you do, how long it takes, and where to go if we get it wrong.
Drafted against
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — rule 3(2)(a)
- Consumer Protection (E-Commerce) Rules, 2020 — rules 4(1), 4(2) and 4(5)
- Digital Personal Data Protection Act, 2023 — sections 8(9) and 13
- Consumer Protection Act, 2019
- CERT-In Directions dated 28 April 2022
The officers
Three separate contacts, because three different laws require them and they answer different questions. At our size one office holds all three, and a message to any of them reaches a person with the authority to decide it rather than a queue.
| Role | Required by | Handles | Contact |
|---|---|---|---|
| Grievance Officer | Rule 3(2)(a), IT Rules 2021; rule 4(5), Consumer Protection (E-Commerce) Rules 2020 | Any complaint about a product, the service, a charge, content hosted on it, or a breach of our own policies | The Director, Mallah Software Services Private Limited contact@mallahsoftware.com |
| Data protection contact | Sections 8(9) and 13, DPDP Act 2023 | Anything about personal data — access, correction, erasure, nomination, withdrawal of consent, or a suspected breach | The Director, Mallah Software Services Private Limited contact@mallahsoftware.com |
| Nodal contact person | Rule 4(2), Consumer Protection (E-Commerce) Rules 2020; rule 3(7), IT Rules 2021 | Requests from law-enforcement agencies and coordination with government bodies | The Director, Mallah Software Services Private Limited contact@mallahsoftware.com |
Registered office — Plot No. 347, Flat No. 301, Status-2 CHSL, Santacruz (East), Mumbai 400055, Maharashtra, India
Telephone — +91 88281 41371, Monday to Friday, 10:00–19:00 IST
Customer care — contact@mallahsoftware.com
Rule 3(2)(a) asks for the officer’s name. We publish the office instead of an individual’s name, and we would rather say that openly than pretend the rule says something else. If you need to address a legal notice to a named person, ask and we will give you one.
What we commit to
Two sets of rules apply to us and they set different clocks. Rule 3(2)(a) of the IT Rules, 2021 requires acknowledgement within 24 hours and disposal within 15 days. Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020 allows 48 hours and one month. We apply the shorter of the two to every complaint, whichever route it arrives by.
| Stage | Our commitment |
|---|---|
| Acknowledgement, with a ticket reference | Within 24 hours of receipt |
| A first substantive response | Within 3 working days |
| Disposal, with reasons in writing | Within 15 days of receipt |
| Content that is obscene, that impersonates a person, or that is an intimate image | Removed or access disabled within 24 hours of a valid complaint — rule 3(2)(b), IT Rules 2021 |
| Content unlawful on its face, on a court order or an authorised government notification | Removed within 36 hours — rule 3(1)(d), IT Rules 2021 |
| Information required by an authorised government agency | Provided within 72 hours of a lawful written request — rule 3(1)(j), IT Rules 2021 |
| A data-protection request under sections 11 to 14 of the DPDP Act | Within 30 days |
| A reportable cyber incident, to CERT-In | Within 6 hours of noticing it |
| A personal data breach, to the Data Protection Board and affected Data Principals | Without delay, in the manner section 8(6) of the DPDP Act prescribes |
You will hear from us before it passes, with the reason and a new date. Silence is not one of the outcomes.
How to complain
By email to the relevant officer above, or by post to the registered office. Nothing sits behind a login — someone who cannot sign in can still complain, and someone who is not our customer can still complain about us.
It helps if you include:
- your name and an address we can reply to;
- the organisation or workspace concerned, if you know it;
- what happened and when — dates and times if you have them;
- what you would like us to do about it;
- anything we have already told you, so we do not repeat ourselves.
An anonymous complaint will still be looked at, but we cannot tell you the outcome, and we cannot verify a data-protection request without knowing whose data it concerns.
If we do not resolve it
You do not need our permission to escalate, and escalating will never affect your account or your service.
- Data protection — the Data Protection Board of India, under section 13(3) of the Digital Personal Data Protection Act, 2023, after first raising it with us, which the section requires.
- Consumer complaints — the National Consumer Helpline on 1915 or consumerhelpline.gov.in, or the District, State or National Consumer Disputes Redressal Commission having jurisdiction, under the Consumer Protection Act, 2019.
- Cyber security incidents — CERT-In, at incident@cert-in.org.in.
- Cyber crime — the National Cyber Crime Reporting Portal, cybercrime.gov.in.
- Contractual disputes — the escalation and arbitration route in the Terms of Service, seated at Mumbai.
What we cannot do for you
Being clear about this saves everybody time.
- We cannot change, correct or delete data inside a customer’s workspace on the instruction of someone who is not that customer. Those are another organisation’s records. We will identify the customer and forward your request within seven days, and tell you we have.
- We cannot advise you on your legal, tax or secretarial position, or tell you whether a filing is due. We are a software company. Ask a company secretary, a chartered accountant or an advocate.
- We cannot make a filing for you, chase a government portal, or intervene in a penalty an authority has levied on you.
- We cannot waive a statutory late fee. Nobody at a software company can.
Records and review
Every complaint is logged with its date of receipt, its category, the officer who handled it, the action taken and the date of disposal. The log is reviewed monthly. A complaint that reveals a defect in a product or a policy is raised as a change rather than closed as an individual answer.
Complaint records are kept for three years.