Effective Date: 22-10-2026

. Who we are

1.1 This Privacy Policy explains how [Legal Entity Name], having its registered office at [Registered Office Address] (“LEXEDGE”, “we”, “us” or “our”), collects, uses, shares and protects personal data when you visit https://lexedge.co.in (the “Website”), contact us, or engage our legal, compliance, tax and advisory services (the “Services”).

1.2 For personal data we process to run the Website and deliver our Services, LEXEDGE is the data fiduciary (the entity that decides why and how the data is processed).

1.3 This policy should be read with our Terms of Use.

2. Laws this policy follows

We process personal data in line with:

• the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”);
• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”), as their provisions come into force; and
• the professional confidentiality duties that apply to company secretaries, chartered accountants and advocates.

3. Personal data we collect

What we collect depends on how you interact with us.

When	Personal data
You browse the Website	IP address, device and browser type, pages visited, time spent, referring site, approximate location, cookie identifiers
You use the entity-structure tool	Your answers to the tool’s questions (we do not ask for your name in the tool)
You book a consultation or send an enquiry	Name, email, phone number, company name, city, nature of your requirement, preferred time slot
You subscribe to compliance updates	Name, email address, and optionally phone or WhatsApp number
You become a Client	Identity and address proofs (such as PAN, Aadhaar, passport, voter ID, utility bills), photographs, signatures and Digital Signature Certificate details, Director Identification Number, contact details, and the same for directors, partners, shareholders, nominees and authorised signatories you share with us
You become a Client (business data)	Company or LLP records, financial statements, bank statements, GST, TDS and payroll data, employee details for PF, ESI and POSH work, trademark and IP material, contracts, and documents about disputes
You pay us	Billing name and address, GSTIN, transaction ID and payment status (card and bank details are handled by the payment gateway, not stored by us)
You log in as a Client	Login email, encrypted password, login history, files you upload, messages
You call, email or message us	The content of the communication and, where you are told so, call recordings

3.1 Some of this is sensitive personal data under the SPDI Rules, such as financial information (bank account and payment details) and passwords. We collect it only when it is needed for a Service you have asked for.

3.2 We do not ask for Aadhaar unless a government process requires it. Where it does, we ask you to mask the first eight digits wherever the authority accepts a masked copy.

4. How we collect it

• Directly from you through forms, emails, calls, WhatsApp, video consultations, document uploads and the client login.
• From people acting for you, such as a co-founder, director, finance head or your existing advisor.
• Automatically through cookies and similar technologies when you use the Website (see section 12).
• From public sources such as the MCA21 portal, the Trade Marks Registry, GST portal and court records, when needed for your matter (for example, a name-availability check or a trademark search).

5. Why we use your data

Purpose	Basis
Respond to enquiries, schedule and hold free consultations	Your consent, given when you submit the form
Prepare proposals, deliver Services, make filings and represent you before authorities	Your consent and the engagement you entered into
Run the client login, compliance calendar and status updates	Your consent and the engagement
Send invoices, collect payments, keep tax and accounting records	Legal obligation (GST, Income-tax and Companies Act record-keeping)
Verify identity and meet KYC duties that apply to professionals	Legal obligation
Send compliance updates, deadline reminders and newsletters	Your separate consent, which you can withdraw at any time
Keep the Website secure, prevent fraud, and fix errors	Legitimate use permitted by law
Understand how the Website is used and improve it	Your consent through the cookie banner, for non-essential cookies
Comply with court orders, regulators and law enforcement	Legal obligation

5.1 We do not sell your personal data. We do not use it for automated decisions that have legal or similarly significant effects on you.

6. Consent and withdrawing it

6.1 Where we rely on consent, we ask for it in clear terms at the point of collection, separately for different purposes (for example, your enquiry and our newsletter).

6.2 You can withdraw consent at any time by writing to [privacy@lexedge.co.in] or using the unsubscribe link in our messages. Withdrawing is as easy as giving consent.

6.3 Withdrawal does not affect processing already done. If you withdraw consent needed for an ongoing engagement, we may be unable to continue that Service, and we will tell you so. We may keep data we are legally required to retain.

6.4 Once the relevant DPDP Rules come into force, you may also give, manage or withdraw consent through a registered Consent Manager.

7. Who we share data with

We share personal data only as needed for the purposes above, and only with:

• Our Professionals — company secretaries, chartered accountants, advocates and tax practitioners working on your matter, all bound by confidentiality.
• Government authorities and regulators where a filing or application requires it, such as the Ministry of Corporate Affairs and Registrar of Companies, Trade Marks Registry, GSTN, Income Tax Department, DPIIT, FSSAI, DGFT, EPFO, ESIC, and courts, tribunals and ODR platforms.
• Service providers that process data on our behalf under written contracts, including: website hosting [name]; email and cloud storage [e.g. Google Workspace]; payment gateway [e.g. Razorpay]; scheduling and video calls [e.g. Calendly, Google Meet, Zoom]; messaging [e.g. WhatsApp Business]; website analytics [e.g. Google Analytics]; and accounting software [name].
• Others you direct us to, such as your investors, auditors, bankers or counterparties in a transaction.
• Law enforcement or other parties where required by law, court order, or to protect the rights, property or safety of LEXEDGE, our Clients or others.
• A successor business in a merger, acquisition or restructuring, which will be bound by this policy.

8. Transfers outside India

Some service providers (such as cloud email and storage) may store data on servers outside India. We transfer data only to countries not restricted by the Government of India, and we require recipients to protect it to standards no less than those in this policy and Indian law.

9. How long we keep data

We keep personal data only as long as needed for the purpose it was collected, or as required by law. Typical periods:

Data	Retention
Enquiries and consultation records that do not become an engagement	12 months from last contact
Client files, filings and engagement documents	8 years after the engagement ends (in line with Companies Act, Income-tax and GST record-keeping periods), or longer if a dispute or proceeding is pending
Invoices and payment records	8 years from the end of the relevant financial year
Newsletter subscriptions	Until you unsubscribe
Website logs and analytics data	Up to 12 months
Client login accounts	Closed 12 months after the last engagement ends, unless you ask earlier

When a period ends, we delete or anonymise the data.

10. How we protect it

10.1 We follow reasonable security practices as required by Section 43A of the IT Act and the SPDI Rules, including:

• encryption of data in transit (HTTPS) and at rest for client documents;
• role-based access, so only those working on your matter can see your files;
• multi-factor authentication for staff accounts;
• access logs, kept for at least one year;
• regular backups and security updates; and
• written confidentiality obligations for staff, Professionals and service providers.

10.2 No system is completely secure. Please keep your client login password private and send sensitive documents only through the client login or channels we confirm.

11. Data breaches

If a personal data breach affects you, we will inform you without undue delay, describing what happened, the likely consequences, what we are doing about it and what you can do to protect yourself. We will also report the breach to the Data Protection Board of India and CERT-In as required by law.

12. Cookies

12.1 Cookies are small files stored on your device. We use:

• Essential cookies to run the Website, remember your session in the client login and keep forms secure. These cannot be switched off.
• Analytics cookies to understand how visitors use the Website, only with your consent.
• Third-party content such as embedded fonts, booking widgets or video, which may set their own cookies under their providers’ policies.

12.2 You can accept or decline non-essential cookies through our cookie banner, and change your choice at any time. You can also block or delete cookies in your browser settings, though some parts of the Website may then not work.

13. Your rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and how we use it, and the names of those we have shared it with;
• Correct, complete or update inaccurate or incomplete data;
• Erase data that is no longer needed, unless we must keep it by law;
• Withdraw consent at any time (see section 6);
• Nominate another person to exercise your rights if you die or become incapable; and
• Raise a grievance with us, and if unresolved, with the Data Protection Board of India.

To exercise any right, email support@lexedge.co.in from your registered email address. We may need to verify your identity first. We will respond within 30 days, and resolve grievances within the time set out in section 17.

14. Children’s data

Our Services are meant for adults and businesses. We do not knowingly collect personal data of anyone under 18. Where a Service requires a minor’s data (for example, a minor shareholder or nominee), we will process it only with verifiable consent from a parent or lawful guardian, and we will not track, profile or target advertising at children.

15. Marketing communications

We send compliance updates, deadline reminders and promotional messages only if you have opted in. Every email contains an unsubscribe link, and you can reply STOP to WhatsApp or SMS messages. We will still send messages needed for an active engagement, such as invoices and filing updates.

16. Changes to this policy

We may update this policy to reflect changes in our practices or the law. The updated version will be posted here with a new Effective Date. If a change materially affects how we use data you have already given us, we will notify you by email or on the Website, and seek fresh consent where required.

17. Grievance Officer and contact

If you have a question, request or complaint about your personal data, contact our Grievance Officer:

[Grievance Officer Name], [Designation]
[Legal Entity Name]
Mumbai · Bengaluru · Delhi NCR
Email: support@lexedge.co.in
Phone: +91 8928809025
Hours: Monday to Saturday, 10:00 AM – 7:00 PM IST

We will acknowledge your grievance within 24 hours and resolve it within 30 days of receipt. If you are not satisfied with our response, you may approach the Data Protection Board of India once the relevant provisions are in force.

For general queries, write to support@lexedge.co.in.