DPDP Act 2023 Notice

This notice describes how Partlee processes personal data under India's Digital Personal Data Protection Act 2023.

Data fiduciary

Partlee is the data fiduciary for personal data collected through the platform. The empanelled firm or mediator handling your matter acts as a separate data fiduciary or processor, governed by their own engagement.

Lawful basis for processing

We process your personal data on the basis of consent, contract performance (delivering the track you have purchased), and statutory obligation (record retention, payment compliance).

Categories of data processed

Identification, contact, matter information, payment information, and platform interaction data. Sensitive data such as financial documents and matter-specific evidence is processed only with explicit consent and only where required to deliver your track.

Free-text safety scanning

Free-text answers in the questionnaire are silently scanned for safety keywords so we can route at-risk users away from mediation prompts and toward the Priority Safety Support. The scan is automated, disclosed here, and does not result in human review unless safety keywords are matched.

Cross-border transfer

Personal data is processed in India. Where infrastructure providers operate outside India, transfers happen under Standard Contractual Clauses or DPDP-compliant equivalent terms.

Retention

Active matter data is retained for the life of the matter plus 7 years for statutory compliance. Anonymised matter outcomes may be retained for product analytics; PII is purged at the end of the retention period.

Your rights

You have rights of access, correction, erasure, withdrawal of consent, and grievance redressal. Email privacy@partlee.com with the subject line "DPDP request". We respond within 30 days.

Grievance officer

Grievance officer email: grievance@partlee.com. Escalations under the DPDP Act 2023 are routed to the Data Protection Board of India.