DPDP-2023 disclosure

Lekha is an Indian SaaS operated by Ekarche Private Limited. This page summarises how we comply with the Digital Personal Data Protection Act 2023 (DPDP-2023). Read alongside Privacy and Terms.

Grievance officer (§10)

The Grievance Officer, Ekarche Private Limited, is reachable at lekha@ekarche.com. We acknowledge complaints within 7 working days and respond within 30 days. Escalation: Data Protection Board of India.

Lawful basis (§4)

We process personal data on the basis of contract (account provisioning, billing) and legitimate use (fraud prevention, security logging). For optional features we obtain explicit consent.

Data principal rights (§11-15)

Right to access — see what Lekha holds about you.
Right to correction — update inaccurate fields.
Right to erasure — delete your user account and the personal data held against it, subject to statutory retention on financial records.
Right to grievance redressal — via the officer above.
Right to nominate — assign someone to act on your behalf.

Retention

Account data retained while the account is active. Financial records retained for 7 years per the Companies Act and GST record-keeping rules. On erasure request, personal identifiers are purged within 30 days; statutory-retention rows are anonymised.

Breach notification

Per §8(6), Lekha reports personal-data breaches to the Data Protection Board and affected data principals as soon as practicable. Our internal target is 72 hours from detection.

Children

Lekha is for business use; you must be 18 or older to hold an account, and we do not knowingly accept accounts from minors. DPDP §9 (verifiable parental consent) therefore does not arise in normal operation. If you believe a minor holds an account, email lekha@ekarche.com.