Legal centre / Privacy Policy
Privacy Policy
What personal data we collect through this website and our products, why we have it, how long we keep it, who else sees it, and how you get it changed or deleted.
Drafted against
- Digital Personal Data Protection Act, 2023 — sections 5 to 16
- Information Technology Act, 2000 — sections 43A and 72A
- Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — rule 3(1)(a)
Who this is about, and who we are
This policy is published by Mallah Software Services Private Limited, a private company limited by shares incorporated in India on 5 September 2026, CIN U62011MH2026PTC475385, with its registered office at Plot No. 347, Flat No. 301, Status-2 CHSL, Santacruz (East), Mumbai 400055, Maharashtra, India. Where this policy says “we” or “us”, it means that company. Where it says “you”, it means whichever of these you happen to be:
- a visitor to mallahsoftware.com;
- someone who fills in the enquiry form or emails us;
- a person named as a contact or user by an organisation that subscribes to one of our products.
Under the Digital Personal Data Protection Act, 2023 we are a Data Fiduciary for the first two, and you are a Data Principal. The third case is different and section 4 below explains why.
What we collect, and why
We have tried to make this list exhaustive rather than illustrative. If something we do is not on it, treat that as a mistake worth telling us about.
| What | Why we have it | Lawful basis | Kept for |
|---|---|---|---|
| Name, work email, company, and the product you selected | To answer an enquiry you sent us, and to follow up on it | Consent, section 6 — you typed it into a form | 3 years from the last contact, then deleted |
| Email content and any attachments you send | To deal with what you wrote in | Consent, or the legitimate use in section 7(a) where you approached us for a service | 3 years, or as long as a contract or a dispute requires |
| Account and billing contacts for a subscribing organisation | To provide the product, invoice for it, and reach a named administrator | Performance of the contract with that organisation | For the term, then 8 years as books of account require under section 128 of the Companies Act, 2013 |
| Server logs: IP address, user agent, requested URL, timestamp | To keep the service up and to investigate abuse or an incident | Legitimate use, section 7 — security of our systems | 180 days, as the CERT-In Directions of 28 April 2022 require, and no longer unless an incident is open |
| A single browser preference key on this site | To remember an interface choice you made | Consent — refuse it and nothing about the site changes | Until you clear your browser storage. See the Cookie Policy |
| Grievance records | To handle a complaint and to show a regulator we handled it | Compliance with rule 3(2)(a) of the IT Rules, 2021 | 3 years from disposal |
We do not run advertising cookies or third-party analytics on this website. We do not buy contact lists, we do not sell or rent personal data to anyone, and we do not train machine-learning models on customer content. We do not ask for or want your Aadhaar number, and none of our products need one.
Children
Our products are sold to businesses and professional practices. We do not knowingly process the personal data of anyone under eighteen, and we do not offer anything designed for children, so the tracking and targeted-advertising prohibitions in section 9(3) of the DPDP Act do not arise. If you believe a child’s data has reached us, write to the address in section 8 and we will delete it.
Data inside a customer’s workspace
This is the part people usually get wrong, so it is worth being blunt about it.
When an organisation subscribes to CertNotify, Regulane, Lawzer or Lawzer’s compliance workspace and puts data into it — its own employees, its clients, its filings, its evidence — that organisation is the Data Fiduciary and we are a Data Processor acting on its instruction. We process that data under a contract, as section 8(2) of the DPDP Act requires. We do not decide what goes in, we do not use it for our own purposes, and we do not look at it except to run the service, fix a fault you have reported, or comply with a lawful order.
The practical consequence: if you are an employee or a client of one of our customers and you want your data corrected or deleted, we cannot do it on your instruction. Those are another organisation’s records, and quietly editing them would be the wrong answer. Ask that organisation. If you come to us instead, we will identify the customer concerned and forward your request within seven days, and tell you that we have.
Who else sees it
We use a small number of processors to run the business. Each one is under a written contract that limits it to our instructions, as section 8(2) requires.
| Category | What they do for us | Where |
|---|---|---|
| Cloud hosting | Run the application and store its data | India region, primary |
| Transactional email — Resend | Deliver the enquiry you send through the form on this site, and account email for our products | Processes outside India, under section 16 of the DPDP Act |
| Payment gateway | Take card, UPI and netbanking payments. We never see or store your card number | India |
| Error and uptime monitoring | Tell us when something has broken | May process outside India |
A current, named list is maintained per product and is available on request from contact@mallahsoftware.com. We will also disclose personal data where a law, a court, or an agency authorised under rule 3(1)(j) of the IT Rules, 2021 requires it in writing — and we will tell you when we are permitted to.
On transfers outside India: section 16 of the DPDP Act permits them except to a country the Central Government has restricted by notification. Where a processor above operates outside India, that is the basis, and we will stop using it for any country that is later notified.
Your rights, and how to actually use them
Sections 11 to 14 of the DPDP Act give you the following. Write to the address in section 8 and we will act within thirty days.
- Access — a summary of the personal data we hold about you and what we are doing with it, plus the identities of anyone we shared it with.
- Correction, completion and updating — of anything inaccurate or incomplete.
- Erasure — unless we are required to keep it. Books of account and grievance records are the usual reasons we cannot delete on request, and we will tell you which applies.
- Grievance redressal — the mechanism is set out on the grievance page, and you must use it before the Data Protection Board will hear a complaint.
- Nomination — you may nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself.
- Withdrawal of consent — at any time, as easily as you gave it. Withdrawing it does not undo processing that was lawful while the consent stood.
Section 15 puts duties on you too, and one of them is worth repeating: do not file a false or frivolous complaint, and do not impersonate someone else when making a request. The Act allows a penalty for it.
Security, and what happens if it fails
We are required by section 8(5) to take reasonable security safeguards, and the measures we actually take are listed on the security page rather than summarised into nothing here. That page also states plainly which certifications we do and do not hold.
If personal data is breached, section 8(6) requires us to intimate the Data Protection Board and each affected Data Principal, and we will do it without waiting to be asked. A reportable cyber incident goes to CERT-In within six hours, under the Directions of 28 April 2022. What you will get from us is what happened, what data was involved, what we have done, and what you should do — not a reassurance email with no facts in it.
How to contact us about any of this
| Role | Required by | Contact |
|---|---|---|
| Data protection contact | Section 8(9), DPDP Act, 2023 | The Director, Mallah Software Services Private Limited contact@mallahsoftware.com |
| Grievance Officer | Rule 3(2)(a), IT Rules, 2021 | The Director, Mallah Software Services Private Limited contact@mallahsoftware.com |
| By post | — | Plot No. 347, Flat No. 301, Status-2 CHSL, Santacruz (East), Mumbai 400055, Maharashtra, India |
| By telephone | Section 12(3)(c), Companies Act, 2013 | +91 88281 41371, Monday to Friday, 10:00–19:00 IST |
We are not a Significant Data Fiduciary under section 10 of the DPDP Act. If the Central Government notifies us as one, we will appoint a Data Protection Officer resident in India, publish that person’s name here, and commission the independent audit the section requires.
Changes to this policy
This is version 1.0, in force from 9 September 2026. If we change it in a way that affects you, we will say so on this page and email the account contacts of every subscribing organisation before it takes effect. Superseded versions are kept, and you can ask for any of them.