Privacy Policy

1. Introduction

Legal Galaxy, operated by Businezexcellence StartX LLP ("we", "our", or "us"), provides privacy, data protection and AI governance information and tools through https://dpdpa.businezexcellence.com. This policy explains how we collect, use, disclose, retain and protect personal data when you visit our website, contact us or use our services. Our processing is subject to applicable data protection law, including the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, to the extent in force and applicable.

2. Personal Data We Collect and Why

We seek to collect only the personal data reasonably required for the purposes described below. The information collected depends on the features you use and the information you choose to provide.

• Contact and identity information: Name, email address, phone number and company name, where provided. We use these details to respond to inquiries, arrange consultations, provide requested services and communicate about your request.
• Professional information: Job title, industry and company size, where provided. We use this information to understand your organisation's requirements and tailor relevant compliance or governance assistance.
• Website and technical information: Browser and device information, IP address, pages visited and diagnostic events, where collected. We use this information for website security, troubleshooting and, only where permitted and consented to when required, website analytics.
• Communications and requests: Messages and information you send us. We use them to answer questions, handle service requests and grievances, and maintain relevant records.
• Inbound email replies: If you reply to an email we send you (for example, a contact response, a generated document, or an assessment report), we process the content of your reply — including sender address, subject line, message body, and any attachments you include — to respond to your query. Inbound email is processed through Resend Inbound and may be retained in our email service provider's systems and our internal records for support, audit and legal purposes.
• Assessment and tool inputs: Information you choose to enter into an assessment or other tool. We use it to deliver the requested result and operate that feature.
• Examination and certification data: Where you take our certification exam, we collect your name, email address, exam score, and pass/fail status to issue your certificate and to verify completion when needed. Certificate identifiers are generated server-side.
• Local browser storage (course progress and certificate data): Our certificate course stores your lesson progress and certificate details in your browser's localStorage. This data remains on your device and is not transmitted to our servers for the course feature. You can clear it at any time through your browser settings.

Please avoid entering unnecessary personal or sensitive information into website forms or tools. The information requested by a feature should be explained when you use that feature.

3. Consent and How to Withdraw It

Where consent is the basis for processing, we seek it through a standalone Consent Notice before the relevant processing begins. The notice explains the personal data involved, the specific purpose of processing, the retention period, and how you can exercise your choices, including withdrawal of consent.

Submitting an inquiry form does not, by itself, mean that you have consented to unrelated marketing or optional analytics. Each purpose requires its own consent where applicable.

Where our website uses optional analytics cookies, you can accept or reject them through the cookie banner. You can reopen Cookie Settings using the control displayed on the website and change your choice. Optional analytics do not load before the required consent has been obtained.

You may withdraw consent at any time by:

• Emailing privacy@businezexcellence.com with the subject line "Consent Withdrawal";
• Emailing our Grievance Officer at grievance@businezexcellence.com;
• Using the "Cookie Settings" button on our website to change cookie preferences.

Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. We will process your request within 30 days.

4. Grounds for Processing

We process personal data on the basis applicable to the relevant activity, including consent where required and permitted uses under section 7 of the DPDP Act, where applicable. We do not treat every business purpose as automatically exempt from consent requirements.

Depending on the circumstances, processing may be necessary to respond to a request you make, provide a requested feature, comply with a legal obligation or address security and abuse. Where applicable law requires consent or another specific condition, we will follow that requirement.

5. Children's Personal Data

Our website and services are strictly intended for businesses and professionals who are 18 years of age or older. We do not knowingly seek to collect, use, or disclose personal data from children (individuals under 18 years of age).

If you are under 18, please do not use this Website or submit any personal data through our forms, tools, or assessments.

If we become aware that we have inadvertently collected personal data from a child without verifiable parental consent, we will take reasonable steps to delete such information from our records promptly. If you believe a child has provided personal data to us inappropriately, please contact our Grievance Officer immediately.

6. Data Retention and Deletion

We retain personal data only for as long as reasonably necessary for its stated purpose, subject to applicable legal obligations, dispute resolution and legitimate record-keeping requirements. The applicable retention period depends on the type of data and the reason it was collected.

• Demo Request and Contact Form data: Up to 2 years from the date of submission, unless consent is withdrawn earlier or a different period is required by applicable law.
• Generated documents (Privacy Policy, DPA, etc.): Up to 1 year from the date of generation.
• Examination and certification data: Retained for as long as necessary to verify the certificate, and for up to 3 years after issue, unless a longer period is required for legal or audit purposes.
• Customer and business records: For the duration of the business relationship and up to 7 years thereafter where required for legal, accounting or tax purposes.
• Website analytics: Up to 26 months, subject to the analytics configuration and the provider's actual retention settings.
• Email queue and delivery state: Email job metadata and content held in our queue infrastructure are retained for up to 30 days for delivery, troubleshooting and audit purposes, then automatically deleted.
• Server logs and diagnostics: Server and application logs (which may include IP addresses, request paths and, in limited cases, error context) are retained for up to 30 days for security, debugging and incident response, subject to the hosting provider's log retention settings.
• Breach incident register: Records of personal data breach incidents are retained for 7 years from the date of logging, as required for regulatory compliance and audit.
• Grievance and legal records: Retained as needed to investigate, respond to and document requests, comply with applicable law and resolve disputes.

When the applicable retention period ends, we will delete or anonymise personal data, unless continued retention is required or permitted by law. Backup copies may remain until removed through the relevant backup lifecycle.

7. Data Sharing and Recipients

We do not sell, rent, or trade your personal data. We share your personal data only with the following specific third-party service providers (Data Processors) to operate our platform. Each processor is bound by its respective Data Processing Agreement (DPA) and processes personal data only on our documented instructions.

• Google LLC (Google Analytics, Google Sheets, Google Apps Script, and Google Gemini API): We use Google Analytics — only if you accept analytics cookies — to understand website traffic. We use Google Sheets, populated via Google Apps Script webhooks, as a database to store your form submissions, inquiries and generated documents. Where you use AI-powered search or retrieval features, your search query and relevant knowledge-base context may be sent to the Google Gemini API to generate a response; no user-account data is sent for this purpose. Data shared: Name, Email address, Phone number, Company details, Website usage data, search query data, and relevant knowledge-base snippets. Processing may occur outside India.
• Resend, Inc. (Resend outbound email and Resend Inbound): We use Resend to deliver transactional emails — such as responses to your contact requests, generated documents and assessment reports — and to receive inbound replies to those emails. Inbound email content, including sender address, subject line, message body and any attachments you send, is processed through Resend Inbound so we can respond to your query. Data shared: Name, Email address, email subject, email body, attachments you send us, and delivery metadata. Processing may occur outside India.
• Vercel Inc. (Vercel hosting, Vercel Analytics and Vercel Speed Insights): We use Vercel for website hosting and infrastructure, and Vercel Analytics and Speed Insights for aggregate website performance monitoring. Vercel processes technical data to ensure the Website operates securely and efficiently. Data shared: Technical data (IP addresses, browser and device information), Website usage logs, and aggregate performance metrics. Processing may occur outside India.
• Upstash Inc. (Upstash Redis, Upstash Vector and Upstash QStash): We use Upstash Redis for rate limiting, email queue state and breach incident register storage; Upstash Vector for search functionality; and Upstash QStash for asynchronous email job scheduling. Data shared: Email addresses, search query data, email job metadata, and breach incident metadata. Processing may occur outside India.

These providers act as Data Processors and are bound by their respective Data Processing Agreements (DPAs) to ensure your data is handled securely and only for the purposes we specify. A current list of sub-processors is available on request. They may process data in locations outside India, subject to appropriate safeguards.

We may also disclose data to professional advisers or authorities where necessary for legal compliance, the establishment or defence of legal claims, or a lawful request from a competent authority.

Where a Data Processor engages a sub-processor that handles personal data, we require the processor to impose equivalent data protection obligations on that sub-processor through contract.

8. International Data Transfers

Some hosting, analytics or communication providers may process personal data outside India. The location of processing depends on the provider, service configuration and the data involved.

Where personal data is transferred outside India, we will comply with applicable Indian law and any restrictions or requirements imposed by the competent authorities. We will assess the relevant providers and transfers and implement safeguards where required.

This policy does not guarantee that all data remains in India. Please contact us if you require further information about a particular processing activity or recipient.

9. Security Measures

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. Measures may include access restrictions, secure connections, system monitoring and procedures for managing security incidents.

No website or electronic transmission can be guaranteed to be completely secure. Security measures are reviewed and applied according to the nature of the information and the risks involved.

10. Data Breach Response

A personal data breach may include unauthorised access to, disclosure of, alteration of, loss of access to or destruction of personal data. If we become aware of a suspected incident, we will assess it and take appropriate steps to contain, investigate and remediate it.

Where a personal data breach is established, we will provide notifications to affected individuals and the relevant authorities, including the Data Protection Board of India where required, within 72 hours of becoming aware of the breach, in accordance with the applicable legal requirements and time limits. We will maintain appropriate incident records and take steps to reduce the risk of recurrence.

11. Grievance Redressal and Privacy Contact

If you have any concerns about how we process your personal data, you can contact our Grievance Officer. We have also published a dedicated Grievance Redressal page that explains the complaint process in detail.

If you are not satisfied with our response, or if we fail to resolve your grievance within 90 days, you have the right to file a complaint with the Data Protection Board of India (DPB). You may also approach the DPB directly if your grievance involves a personal data breach.

12. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, subject to applicable law and its conditions, you have the following rights:

• Right to Access: Request a summary of the personal data we process about you and the identity of entities with whom it has been shared.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data where applicable, subject to legal retention requirements.
• Right to Withdraw Consent: Withdraw your consent at any time (see Section 3).
• Right to Grievance Redressal: File a complaint with our Grievance Officer (see Section 11) and, if unsatisfied, with the Data Protection Board of India.
• Right to Nominate: Nominate another individual to exercise your rights in case of death or incapacity.

To exercise any of these rights, email privacy@businezexcellence.com or grievance@businezexcellence.com. We may need to verify your identity and clarify your request before responding. We will respond within 30 days.

13. Cookies and Similar Technologies

Our website uses the following categories of cookies and similar technologies:

• Essential Cookies: Required for basic website functionality and security. These cannot be disabled. Our essential cookies include:
  • cookie-consent — records your cookie consent choice (accepted or rejected).
  • consent-log — stores a timestamped audit trail of your consent decision, including whether analytics was enabled.
• Analytics Cookies: Google Analytics cookies (e.g., _ga, _gid, _gat, _gac_*) that help us understand how visitors use the website. These are only enabled if you click "Accept All" in the cookie banner.

You can change your analytics choice at any time through the Cookie Settings control on our website (bottom-left corner). When you choose "Reject Non-Essential", we remove any existing Google Analytics cookies from your browser.

Local browser storage: Separately from cookies, our certificate course uses your browser's localStorage to remember lesson progress and certificate details. This data stays on your device and is not transmitted to our servers for the course feature. You can clear it at any time through your browser settings.

Blocking or deleting cookies through your browser settings may affect certain website features. Browser controls are separate from the website's consent settings.

14. Changes to This Policy

We may update this policy when our services, processing practices or legal requirements change. The revised version will be published on this page with an updated revision date. Where required, we will provide additional notice or seek consent for changes to processing.