Grievance and Redressal Policy

A framework built for the customers we serve.

Deepvue Technologies Private Limited ("Deepvue", "Company", "we") provides identity, verification, compliance, and decisioning APIs to enterprise customers across regulated and non-regulated sectors. Customers, partners, sub-processors, and the regulated entities that build on top of us depend on Deepvue as critical compliance infrastructure.

This Grievance and Redressal Policy ("Policy") sets out the formal framework through which any Customer or other eligible Complainant may raise, escalate, and seek resolution of grievances. It forms an integral part of our Terms of Service and is to be read together with our Privacy Policy, the Master Services Agreement, and any service-specific schedules.

Fair, transparent, time-bound, compliant.

The objective of this Policy is to ensure that every grievance is treated with procedural equity, with clear communication of process and outcome, within defined turnaround times, and in conformity with the IT (Intermediary Guidelines) Rules, 2021, the Digital Personal Data Protection Act, 2023, and other Applicable Laws.

What you can expect from us.

• Every grievance will be acknowledged within the TAT specified in this Policy, regardless of its eventual classification or merit.
• A dedicated Customer Engagement function and a designated Grievance Officer are maintained at all times.
• Resolution will be communicated in writing, with reasoning where the outcome is adverse to the Complainant.
• You retain the right to escalate to a higher level if dissatisfied with the resolution at the current level.
• Where a grievance reveals a systemic concern, we undertake root-cause analysis and corrective action.

What this Policy covers.

This Policy applies to grievances arising in connection with:

• Performance, availability, or quality of the Services or any API, including API Success rates, downtime, latency, and Service Level commitments;
• Billing, invoicing, Subscription Plan charges, recurring charges, taxes, refunds, and chargebacks;
• Data privacy, data principal rights, and consent management under the Digital Personal Data Protection Act, 2023;
• Consent revocation in respect of any consent-based service (DigiLocker KYC, Credit Bureau pulls, Account Aggregator data flows, and similar);
• Information security incidents, suspected unauthorised access, or breaches of confidentiality;
• Compliance with the Information Technology Act, 2000 and the Intermediary Guidelines Rules, 2021;
• Conduct of Deepvue personnel, agents, or sub-contractors;
• Interpretation or alleged breach of the Agreement; and
• Any other matter the Complainant believes warrants formal review.

This Policy operates in addition to, and does not displace, any independent statutory, regulatory, or contractual right of the Complainant.

How to reach us.

You may raise a grievance through any of the following channels. No fee is payable.

What to include in your submission.

To enable verifiable processing and prompt resolution, please include:

• Legal name of the Customer entity and registered email domain;
• Customer ID, account identifier, workspace identifier, or API key reference;
• Name, designation, and contact details of the authorised representative;
• A clear, concise description of the grievance, with dates, transaction identifiers, correlation IDs, request/response logs, or screenshots where relevant;
• The category of the grievance (see Classification);
• The specific outcome or relief sought;
• For escalations beyond Level 1 — the Reference Number assigned at the previous level.

Grievance categories.

Grievances are routed and tracked under the following primary categories. Classification at submission is provisional and may be revised on review.

Five tiers internally. One external.

A grievance may be escalated to the next level only where (a) the Resolution TAT at the current level has lapsed, or (b) the Complainant has received the resolution and records, in writing, the basis of dissatisfaction.

Turnaround at a glance.

Business Day means any day other than a Saturday, Sunday, or public holiday declared under the Negotiable Instruments Act, 1881 in Delhi, India.

Data privacy & DPDP Act grievances.

Grievances concerning the processing of personal data, the exercise of data principal rights, or any matter arising under the Digital Personal Data Protection Act, 2023 are handled under this Policy with the following modifications:

• Routed in the first instance to the Data Protection Officer at [email protected] and deemed to enter this Policy at Level 3.
• Resolution within the timelines prescribed under the DPDP Act and rules framed thereunder, or 15 days, whichever is earlier.
• If unresolved after Levels 3–5, the Complainant retains the right to approach the Data Protection Board of India under Section 27 of the DPDP Act.
• For Customers in regulated sectors, Deepvue cooperates in good faith with any regulator-prescribed grievance routing applicable to the Customer.

Consent revocation.

Several Deepvue services depend on the explicit consent of an end-user / data principal — DigiLocker KYC, Credit Bureau pulls, Account Aggregator data flows, and similar verification services. Requests for revocation of consent ("Consent Revocation Requests") are handled as follows:

Unresolved Consent Revocation Requests follow the escalation matrix above, commencing at Level 3.

Where remedies are due.

Where investigation determines that a grievance discloses a service failure, breach of the Agreement, or other matter for which compensation is due, Deepvue applies the following framework:

• Apply the remedies and service credits contemplated under the Agreement, including any Service Level credit framework;
• Where statutory compensation is mandated by Applicable Laws (including under sectoral regulations), comply with the same;
• In all other cases, propose a reasonable resolution which may include service credits, refund of the relevant invoiced amount, or other commercially appropriate remedy.

Compensation, where awarded, is without prejudice to any limitation of liability, indemnity provisions, or other contractual protections set out in the Agreement. Acceptance of compensation will ordinarily constitute full and final settlement of the underlying grievance unless the Complainant expressly records the contrary in writing.

How we handle your information.

Confidentiality

All grievance communications are treated as confidential and shared only with personnel having a legitimate need to know for purposes of investigation and resolution, subject to disclosure obligations under Applicable Laws or compulsion of legal process.

Records

We maintain a register of grievances containing, at a minimum: Reference Number, date of receipt, classification, escalation history, action taken, date of resolution, and outcome. Records are retained for the period prescribed under Applicable Laws or 2 years, whichever is longer.

Reporting

Grievance trends are reviewed by the Office of the Chief Legal & Compliance Officer at least quarterly, and material trends are reported to the Board or Executive Committee.

Non-Retaliation

No customer or its personnel is subjected to commercial, contractual, or operational disadvantage by reason of having raised a bona fide grievance.

What this Policy does not do.

Nothing in this Policy will be construed as:

1. An admission of liability by Deepvue;
2. A waiver of any limitation of liability, indemnity, or other contractual protection available under the Agreement;
3. An expansion of the scope of Services, warranties, or representations beyond those expressly stipulated in the Agreement;
4. A waiver of Deepvue's right to suspend or terminate Services in accordance with the Agreement, including for breach of the Use Case Categories or Confidentiality clause;
5. A limitation upon any independent statutory or regulatory right of the Complainant, which remains available concurrently; or
6. An obligation to address grievances that are frivolous, vexatious, or that constitute abuse of process — which we reserve the right to dismiss with reasoned communication to the Complainant.

Legal foundation.

This Policy is governed by and construed in accordance with the laws of the Republic of India and is designed to operate consistently with:

• The Information Technology Act, 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• The Digital Personal Data Protection Act, 2023;
• The Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020 (to the extent applicable);
• The Arbitration and Conciliation Act, 1996;
• Sectoral guidelines issued by RBI, SEBI, IRDAI, and UIDAI as may apply to specific Services; and
• Any other Applicable Laws as defined in the Agreement.

Subject to the dispute resolution clause of the Agreement, the courts at Delhi, India have exclusive jurisdiction in respect of any matter arising out of or in connection with this Policy.

How this Policy evolves.

We reserve the right to amend, modify, or supplement this Policy from time to time to reflect changes in Applicable Laws, regulatory expectations, organisational structure, or operational practice. Material amendments will be notified to active Customers by email or through the Deepvue dashboard at least 7 days prior to the effective date, save where a shorter period is required by Applicable Laws.

This Policy is reviewed by the Office of the Chief Legal & Compliance Officer at least once every 12 months and updated as necessary.

Where to reach us.

Use the directory below to identify the right point of contact for your concern. For statutory grievances under the IT Rules, 2021, write to the Designated Grievance Officer. For matters under the DPDP Act, 2023, write to the Data Protection Officer.