Grievance Redressal Mechanism
Who to complain to, what happens when you do, how long it takes, and where to go if we get it wrong.
Drafted against
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — rule 3(2)(a)
- Consumer Protection (E-Commerce) Rules, 2020 — rules 4(1), 4(2) and 4(5)
- Digital Personal Data Protection Act, 2023 — sections 8(9) and 13
- Consumer Protection Act, 2019
1.The officers
Three separate contacts, because three different laws require them and they answer different questions. Every one of them is a real person at Mallah Software Services Private Limited with authority to decide, not a shared inbox that routes to nobody.
| Role | Required by | Handles | Contact |
|---|---|---|---|
| Grievance Officer | Rule 3(2)(a), IT Rules 2021; rule 4(5), Consumer Protection (E-Commerce) Rules 2020 | Any complaint about the platform, the service, a charge, content hosted on it, or a breach of our own policies | contact@lawzer.in |
| Data Protection Officer | Sections 8(9) and 13, DPDP Act 2023 | Anything about personal data — access, correction, erasure, nomination, consent withdrawal, or a suspected breach | contact@lawzer.in |
| Nodal Contact Person | Rule 4(2), Consumer Protection (E-Commerce) Rules 2020; rule 3(7), IT Rules 2021 | Requests from law-enforcement agencies and coordination with government bodies | contact@lawzer.in |
- Registered office
- Published on the Legal Centre page once filed.
- Customer care
- contact@lawzer.in · Monday to Friday, 10:00–19:00 IST
2.What we commit to
Two sets of rules apply to us and they set different clocks. Rule 3(2)(a) of the IT Rules, 2021 requires acknowledgement within 24 hours and disposal within 15 days. Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020 allows 48 hours and one month. We apply the shorter of the two to every complaint, whichever route it arrives by.
| Stage | Our commitment |
|---|---|
| Acknowledgement, with a ticket reference | Within 24 hours of receipt |
| A first substantive response | Within 3 working days |
| Disposal, with reasons in writing | Within 15 days of receipt |
| Complaints about content that is obscene, that impersonates a person, or that is an intimate image | Removed or access disabled within 24 hours of a valid complaint — rule 3(2)(b), IT Rules 2021 |
| Content unlawful on its face, on a court order or an authorised government notification | Removed within 36 hours — rule 3(1)(d), IT Rules 2021 |
| Information required by an authorised government agency | Provided within 72 hours of a lawful written request — rule 3(1)(j), IT Rules 2021 |
| A data-protection request under sections 11 to 14 of the DPDP Act | Within 30 days |
| A reportable cyber incident, to CERT-In | Within 6 hours of noticing it |
| A personal data breach, to the Data Protection Board and affected Data Principals | Without delay, in the form and manner prescribed under section 8(6) of the DPDP Act |
3.How to complain
By email to the relevant officer above, or by post to the registered office. Nothing is behind a login — a person who cannot sign in can still complain, and a person who is not our customer can complain about us.
It helps if you include:
- Your name and a contact address we can reply to.
- The workspace or organisation concerned, if you know it.
- What happened, and when — dates and times if you have them.
- What you would like us to do about it.
- Anything you have already been told by us, so we do not repeat it.
An anonymous complaint will still be looked at, but we cannot tell you the outcome and we cannot verify a data-protection request without knowing whose data it concerns.
4.If we do not resolve it
You do not need our permission to escalate, and escalating will never affect your account or your service.
- Data protection
- The Data Protection Board of India, under section 13(3) of the Digital Personal Data Protection Act, 2023 — after first raising it with us, which the section requires.
- Consumer complaints
- The National Consumer Helpline (1915, consumerhelpline.gov.in), or the District, State or National Consumer Disputes Redressal Commission having jurisdiction, under the Consumer Protection Act, 2019.
- Cyber security incidents
- CERT-In, at incident@cert-in.org.in.
- Cyber crime
- The National Cyber Crime Reporting Portal, cybercrime.gov.in.
- Contractual disputes
- The escalation and arbitration route in clause 13 of the Terms of Service, seated at Mumbai.
5.What we cannot do for you
Being clear about this saves everyone time.
- We cannot change, correct or delete data inside a Customer's workspace on the instruction of someone who is not that Customer. Those are another organisation's statutory records. We will identify the Customer and forward your request within seven days.
- We cannot advise you on your legal, tax or secretarial position, or tell you whether a filing is due. We are a software company. Ask a company secretary, chartered accountant or advocate.
- We cannot make a filing on your behalf, chase a government portal, or intervene in a penalty levied on you by an authority.
- We cannot waive a statutory late fee. Nobody at a software company can.
6.Records and review
Every complaint is logged with its date of receipt, category, the officer who handled it, the action taken and the date of disposal. The log is reviewed monthly, and a complaint that reveals a defect in the product or a policy is raised as a change rather than closed as an individual answer.
Complaint records are kept for three years.