About Lab Systems India & This Policy
Lab Systems India Pvt Ltd ("Lab Systems", "we", "our", or "us"), incorporated in 1989, is a Digital Forensics and Cybersecurity company headquartered in Mumbai, India. We also offer Data Privacy & DPDP Compliance Services, the ChanakAI private AI platform, and DPDP Training Programmes.
This Privacy Policy explains how we collect, use, store, share, and protect personal data of individuals ("Data Principals") who interact with our website, contact us, or use our services — and what rights you have under the Digital Personal Data Protection Act 2023 ("DPDP Act") and the DPDP Rules 2025.
We are committed to practising what we preach. As DPDP compliance consultants, we hold ourselves to the same standard we recommend to our clients.
Personal Data We Collect
2.1 Data You Provide to Us
- Contact form submissions: Full name, email address, phone number, company name, designation, service of interest, and message content
- Email and phone enquiries: Name, contact details, and the content of your enquiry
- Event registrations: Name, organisation, designation, and contact details for conferences or webinars we organise
- Business cards exchanged at events: Name, designation, company, email, and phone number
2.2 Data Collected Automatically
- Website usage data: Pages visited, time on site, browser type, device type, and referring URL (via standard web analytics)
- IP address: Collected automatically by our web server for security and analytics purposes
2.3 Data We Do NOT Collect
- We do not collect sensitive personal data (health, financial, biometric, or caste data) through our website
- We do not collect data of children under 18 through this website without verifiable parental consent
- We do not use cookies for advertising or behavioural tracking
Purpose of Processing & Lawful Basis
We process your personal data only for the following specific purposes, each with its own lawful basis under the DPDP Act:
- Responding to enquiries: To answer questions you send us via contact form, email, or phone — lawful basis: consent given when you make contact
- Service delivery: To deliver DPDP consulting, training, or ChanakAI services you have engaged us for — lawful basis: performance of contract
- Event management: To register and communicate with attendees at events organised by Lab Systems — lawful basis: consent given at registration
- Marketing communications: To send service updates, DPDP insights, or event invitations — lawful basis: your explicit consent; you can withdraw at any time
- Website security and analytics: To maintain website security and understand how visitors use our site — lawful basis: legitimate organisational interest
We will never use your personal data for any purpose beyond what is stated above without obtaining your explicit consent first.
Data Retention
- Enquiry and contact data: Retained for 2 years from last interaction, then securely deleted
- Client engagement data: Retained for 7 years after project completion for legal and audit purposes
- Marketing consent records: Retained until consent is withdrawn, then deleted within 30 days
- Website analytics: Anonymised after 12 months; no personally identifiable data retained beyond this
- Event registration data: Retained for 1 year after the event, then deleted
When retention periods expire, personal data is securely deleted or anonymised. We do not retain data beyond the stated periods unless required by law.
Data Sharing & Third Parties
We do not sell, rent, or trade your personal data. We may share data with the following categories of third parties, only as necessary:
- Technology service providers: Web hosting, email service providers, and analytics tools — each bound by a Data Processing Agreement
- Professional advisors: Legal counsel, auditors, or regulators — only where required by law or for legal proceedings
- Event co-organisers: Only with your explicit consent, and only for the specific event
All third parties who process personal data on our behalf are required to have signed Data Processing Agreements that comply with the DPDP Act 2023.
We do not transfer your personal data to countries outside India except to countries included in MeitY's permitted country list under Rule 15 of the DPDP Rules 2025.
Security Safeguards
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of personal data at rest (AES-256) and in transit (TLS 1.3)
- Role-based access control — only authorised personnel can access personal data
- Regular security assessments and vulnerability testing
- Staff training on data protection obligations
- Documented breach response procedure with DPB notification within prescribed timelines
Your Rights as a Data Principal
Under the DPDP Act 2023, you have the following rights regarding your personal data held by Lab Systems India:
Right to Information
Know what personal data we hold about you, for what purpose, and with whom it is shared.
Right to Correction
Request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure
Request deletion of your personal data when the purpose for which it was collected has been fulfilled.
Right to Withdraw Consent
Withdraw consent for any processing activity at any time — as easily as you gave it. Email sales@labsystems.co.in.
Right to Grievance Redressal
Raise a complaint with our Grievance Officer. If unsatisfied, escalate to the Data Protection Board of India.
Right to Nominate
Nominate a person to exercise your data protection rights on your behalf in case of death or incapacity.
To exercise any of these rights, email us at sales@labsystems.co.in with the subject line "Data Principal Rights Request". We will respond within 30 days.
Data Breach Notification
In the event of a personal data breach that may affect your rights or interests, we will notify you and the Data Protection Board of India within the timelines prescribed under Rule 7 of the DPDP Rules 2025. Notification will include the nature of the breach, data affected, and steps taken to mitigate harm.
Contact & Grievance Officer
Grievance Officer
[Name of Grievance Officer to be inserted by Lab Systems management] · Designation: [Designation] · Email: sales@labsystems.co.in · Response time: Within 30 days of receipt of grievance.
Updates to This Policy
We will update this Privacy Policy when required by changes in law, our services, or our data processing practices. Material changes will be communicated by posting a prominent notice on our website. The "Last Updated" date at the top of this page will always reflect the most recent revision.
We recommend reviewing this policy periodically. Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.
