When a retention period ends, we delete the data or irreversibly anonymise it. Where the DPDP Rules require it, we will inform you at least forty-eight hours before deleting data on the ground that you have not engaged with us, so that you can prevent the deletion by logging in or contacting us.

​​

11. Security and personal data breaches

11.1 LexCampus takes reasonable security safeguards to protect personal data, including restricting access to those who need it, using encrypted connections, protecting accounts with strong passwords and two-factor authentication, and keeping logs that allow unauthorised access to be detected.

​

11.2 If a personal data breach occurs, we will inform each affected person without delay, describing the breach, its likely consequences, the steps we have taken to reduce the risk, the steps you can take to protect yourself, and the person you can contact. We will report the breach to the Data Protection Board of India within the time the DPDP Rules require, which is within seventy-two hours of our becoming aware of it for the detailed report.

​

12. Your rights

12.1 Under the DPDP Act you have the right:

(a) to obtain a summary of the personal data we process about you, the processing activities undertaken, and the identities of the persons with whom it has been shared;

(b) to have inaccurate or misleading data corrected, incomplete data completed and data updated;

(c) to have your data erased when it is no longer needed for the purpose for which it was collected, unless the law requires us to retain it;

(d) to withdraw your consent, as described in section 4;

(e) to have your grievances redressed by us; and

(f) to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

12.2 How to exercise them. Write to contact@lexcampus.org, stating the right you wish to exercise. We may ask for information to confirm your identity. We will respond within [thirty] days and, in any event, within ninety days, as the DPDP Rules require.

​

12.3 Your duties. The DPDP Act requires you to provide authentic information, not to impersonate another person, not to suppress material information, and not to register false or frivolous grievances.

​​

13. Grievances

13.1 Complaints about the way we handle your personal data may be made to the Grievance Officer named at the head of this Policy. We will acknowledge a complaint within forty-eight hours and resolve it within the period stated in section 12.2.

13.2 If you are not satisfied with our response, you may complain to the Data Protection Board of India after exhausting this procedure.

​

14. Children

The Services are intended for persons aged eighteen and over. Applicants are asked to confirm that they are eighteen or older. Where a person under eighteen is permitted to take part with a guardian's consent under clause 4.2 of the Terms of Use, we obtain verifiable consent from the parent or lawful guardian, in the manner the DPDP Rules require, before processing that person's data. We do not track, monitor the behaviour of, or direct advertising at children.

​

15. Communications

15.1 Service messages. We send you emails and, where needed, messages about Services you have purchased or applied for, such as schedule changes, links to classes and invoices.

​

15.2 Announcements. We send announcements about new publications and Cohorts only if you have opted in. Every announcement contains an unsubscribe link.

​

15.3 Calls, SMS and WhatsApp. We make promotional calls or send promotional SMS only in accordance with the Telecom Commercial Communications Customer Preference Regulations, 2018, and we do not send them to numbers registered on the National Customer Preference Register unless you have given us your specific consent. We use WhatsApp only if you have given us your number for that purpose.

​

16. Visitors from outside India

16.1 If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation or the UK General Data Protection Regulation may also apply to our processing. The legal bases on which we rely are your consent, the performance of a contract with you, compliance with legal obligations, and our legitimate interest in running and securing the Website. In addition to the rights in section 12, you may object to processing based on legitimate interest, ask us to restrict processing, receive your data in a portable format, and complain to the data protection authority where you live.

16.2 If you are in the Kingdom of Saudi Arabia or another country with its own data protection law, you may exercise the rights that law gives you by writing to contact@lexcampus.org.

17. Changes to this Policy

We may revise this Policy by publishing a new version on the Website with a new effective date. If a change materially affects how we use personal data that you have already given us, we will inform you by email and, where the law requires it, seek your consent again.

​

18. Governing law and disputes

This Policy is governed by the laws of India. Disputes arising from it are resolved in the manner stated in clauses 19 and 20 of the Terms of Use, and the courts at Malappuram District, Kerala have jurisdiction, without prejudice to your right to approach the Data Protection Board of India.