ZipZy® Law Enforcement Request Policy

Our approach to legal requests is guided by three core principles.

1.1 Valid Legal Process. We comply with lawful requests issued under applicable law by competent Indian courts, authorised government agencies, and other legally empowered authorities.

1.2 Appropriate Authority. We do not disclose Customer Data in response to informal requests, verbal requests, or correspondence lacking proper statutory authority. Requesting parties must use the legal process required by applicable law.

1.3 Proportionality. We object to, seek clarification of, or challenge requests that appear overly broad, disproportionate, outside jurisdiction, unsupported by law, or inconsistent with fundamental rights.

Where legally permitted, we notify affected Customers before disclosure so they may exercise any rights available to them under applicable law.

We accept requests only from authorised entities acting within their lawful authority.

• Indian law enforcement agencies acting under statutory authority.
• Indian government departments and authorised public authorities.
• Indian courts and tribunals.
• Regulatory authorities including the Data Protection Board of India where authorised by law.
• Foreign authorities acting through recognised international legal assistance mechanisms.
• Private litigants presenting a valid court order or other legally enforceable process.

Requests should normally be submitted on official letterhead, signed by an authorised officer, using an official government or organisational email address, and include sufficient contact information to allow independent verification.

The legal process required depends on the type of information requested.

3.1 Statutory Requests. Where legislation expressly authorises disclosure without a court order, we verify the legal basis, identity of the requesting officer, scope, and proportionality before responding.

Subject to our Data Retention Policy and other applicable policies, we may retain categories of information including:

• Subscriber information such as account name, email address, phone number, organisation, subscription plan, and account status.
• Billing records including invoices, billing addresses, transaction identifiers, GST information, and payment metadata.
• Authentication and access logs including IP addresses, timestamps, browser information, and login history.
• Resource information relating to links, QR Codes, landing pages, custom domains, and hosted resources.
• Analytics and interaction records including clicks, scans, approximate geolocation, referrer information, and device category.
• Customer Content including hosted pages, uploaded files, form submissions, messaging content, and Workspace information.
• Support tickets and customer communications.

There are categories of information that we either never collect or do not retain beyond the periods specified in our Data Retention Policy. We cannot disclose information that we do not possess.

• Full payment card numbers, CVV values, UPI PINs, or online banking credentials.
• Plaintext passwords. Passwords are stored only as secure one-way hashes.
• Precise GPS location information. Geolocation is derived only from IP address at an approximate city or regional level.
• Content hosted on third-party destination websites reached through ZipZy® links.
• Information permanently deleted under the Data Retention Policy.
• Customer Data relating to Accounts deleted beyond applicable retention periods, except where statutory retention continues to apply.
• Information that was never collected by the Services.

We do not create new monitoring, logging, or collection capabilities solely in response to a legal request unless required by applicable law.

Before any disclosure occurs, every request must satisfy minimum legal and procedural requirements.

1. Be submitted in writing on official letterhead.
2. Identify the applicable statutory authority or legal process relied upon.
3. Precisely identify the account, resource, Workspace, URL, or other relevant identifier.
4. Specify an appropriate date range where relevant.
5. Clearly identify the categories of information requested.
6. Describe the purpose of the request and the related investigation or proceeding.
7. Provide sufficient officer contact information for independent verification.
8. State whether delayed notification to affected Customers is legally required.

6.1 Verification. Every request is independently verified before disclosure, including confirmation of the requesting authority and the authenticity of supporting documentation.

6.2 Deficient Requests. Requests lacking sufficient legal authority, clarity, or supporting information are returned with an explanation and may be resubmitted once corrected.

Transparency is an important principle of our privacy programme. Where legally permitted, we notify affected Customers before disclosing their information.

7.1 Default Position. Unless prohibited by law, we provide notice describing the request and, where permitted, a copy of the legal process so that the affected Customer may exercise any available legal rights.

7.2 Exceptions. Notification may be delayed or withheld where prohibited by law, where immediate disclosure is necessary to prevent imminent harm, where notice would create a substantial risk of evidence destruction or witness intimidation, or where the request concerns child sexual abuse material or similar serious offences.

7.3 Delayed Notice. Where a lawful prohibition expires, we normally provide notice as soon as the restriction is lifted.

7.4 Delivery. Notifications are generally sent to the registered account email address unless that communication itself is prohibited by law.

In exceptional circumstances involving imminent risk to life or serious physical injury, we may disclose limited information before completion of the ordinary legal process.

8.1 Emergency Standard. Emergency disclosure is considered only where we have a good-faith belief that immediate disclosure is necessary to prevent death or serious physical harm.

8.2 Emergency Requests. Emergency requests should be submitted to legal@zipzy.in and clearly identify the nature of the emergency, why immediate disclosure is required, the relevant account or resource, and the minimum information necessary to address the threat.

8.3 Verification. Emergency requests receive immediate review. We independently verify the requesting authority before any disclosure and provide only the minimum information reasonably necessary to address the emergency.

8.4 Follow-up. We generally expect appropriate formal legal process to follow emergency disclosures where required by law. Emergency disclosures are documented and affected Customers are notified when legally permitted.

8.5 Misuse. Misuse of emergency procedures may result in heightened scrutiny of future requests from the requesting organisation.

Authorised authorities may request preservation of existing Customer Data while appropriate legal process is being obtained.

9.1 Preservation Period. We may preserve existing information relating to a specified account or resource for 90 days. Where justified, one additional preservation period may be granted upon written request.

9.2 Scope. Preservation applies only to data already in our possession. We do not begin collecting additional information solely because a preservation request has been received.

9.3 Disclosure. Preserved information is disclosed only after receipt of valid legal process meeting the requirements described in this Policy.

9.4 Expiry. Where no valid legal process is received before the preservation period expires, preserved information returns to the normal retention schedule defined by the Data Retention Policy.

We comply with lawful orders requiring removal or restriction of content where issued by a court or other competent authority acting under applicable law.

10.1 Compliance. Valid removal orders are implemented as required by law, generally within 36 hours where applicable.

10.2 Proportionality. We seek to remove or restrict only the specific content identified in the order. Requests seeking removal of substantially broader content may be challenged where appropriate.

10.3 Customer Notice. Where legally permitted, affected Customers are informed of the removal request, the issuing authority, and the relevant reference information.

10.4 Appeals. Orders issued by competent authorities are not subject to our internal appeal procedures. Any challenge must be directed to the issuing authority or court.

10.5 Intellectual Property Requests. Copyright and trademark complaints that are not accompanied by court orders continue to be handled under the Copyright Policy and Trademark Policy.

Pranava Company Group is established in India and responds to international legal requests in accordance with applicable Indian law.

11.1 Foreign Authorities. Requests issued solely under foreign law are generally not enforceable directly against us.

11.2 International Cooperation. Foreign authorities should normally proceed through recognised international legal assistance mechanisms such as Mutual Legal Assistance Treaties (MLATs), letters rogatory, or other legally recognised procedures applicable in India.

11.3 Emergencies. Genuine emergencies involving imminent danger to life may be considered under the emergency disclosure procedures described in Section 8 regardless of the requesting jurisdiction.

11.4 Legal Conflicts. Where compliance would conflict with Indian law or other binding legal obligations, we may decline the request or seek clarification before responding.

11.5 International Privacy Obligations. Where appropriate, we also consider applicable international privacy obligations, including commitments owed to Customers under contractual data protection agreements.

In many circumstances we process Customer Personal Data solely on behalf of a Customer acting as the Data Controller or Data Fiduciary.

12.1 Customer Responsibility. Requests relating to Customer Content—including Workspace information, HRMS records, CRM data, forms, and similar Customer-controlled information—should generally be directed to the relevant Customer rather than to us.

12.2 Customer Notification. Unless prohibited by law, we notify the Customer promptly and provide an opportunity for the Customer to respond before disclosing Customer-controlled information.

12.3 Compelled Disclosure. Where we are legally required to disclose Customer-controlled information directly, we disclose only the minimum information required by law and notify the Customer as soon as legally permitted.

12.4 Data Processing Addendum. These procedures are intended to operate consistently with our Data Processing Addendum.

Private individuals, businesses, insurers, investigators, and other non-governmental parties generally cannot obtain Customer Data directly from us without appropriate legal authority.

13.1 Required Process. We normally require a valid court order, summons, or the documented consent of the affected Customer before responding to requests from private parties.

13.2 Service. Legal documents should be served through appropriate legal channels and copied to legal@zipzy.in.

13.3 Customer Notice. Where legally permitted, affected Customers are notified before responding to private legal process.

13.4 Review. Requests from private parties are evaluated using the same standards of authenticity, jurisdiction, proportionality, and legal sufficiency applied to governmental requests.

Every legal request received by Pranava Company Group is reviewed by authorised personnel before any disclosure or action is taken.

14.1 Acknowledgement. We generally acknowledge valid legal requests within 3 business days. Emergency requests are prioritised immediately.

14.2 Legal Review. Every request is assessed for authenticity, jurisdiction, legal authority, proportionality, scope, and compliance with applicable law before any disclosure occurs.

14.3 Response Time. Where a request is valid and we possess the requested information, we generally respond within 15 business days or within any shorter deadline imposed by the applicable legal order.

14.4 Data Minimisation. We disclose only the information specifically required by the applicable legal process. We do not voluntarily provide additional data outside the authorised scope.

14.5 Delivery Format. Information is normally provided electronically using standard formats. Where required, accompanying certifications or authenticity statements may also be provided.

14.6 Secure Delivery. Responses are transmitted only through appropriately verified and secure communication channels.

14.7 Record Keeping. We maintain internal records of legal requests, our assessment, actions taken, and disclosures made for audit, compliance, and accountability purposes.

Where permitted by law, we may request reimbursement of reasonable costs associated with unusually burdensome requests requiring substantial engineering effort, extended preservation, exceptional data volumes, or specialist processing.

Ordinary legal requests and genuine emergency disclosures involving imminent threats to life are generally processed without charge.

We intend to publish periodic transparency reports summarising our handling of legal requests while protecting the confidentiality of individual investigations.

• Total number of government, court, and regulatory requests received.
• Number of requests complied with in full, partially complied with, or rejected.
• Number of content removal orders received.
• Number of emergency disclosure requests.
• Number of affected users notified where legally permitted.

Transparency reports contain only aggregated, non-identifying statistics and never disclose confidential investigative information or individual requests unless legally required.

We may revise this Law Enforcement Request Policy from time to time to reflect changes in legislation, judicial decisions, operational practices, or our privacy programme.

Material changes generally become effective 30 days after publication unless earlier implementation is required by applicable law.

Postal Address
Legal Department
Pranava Company Group (ZipZy®)
62, Mandola, Loni
Ghaziabad, Uttar Pradesh 201102
Bharat (India)

Related Policies: Privacy Policy • Terms of Service • Data Processing Addendum • Data Retention Policy • Copyright Policy • Acceptable Use Policy.

Pranava Company Group is committed to protecting user privacy while complying with lawful legal process. Every request is reviewed carefully to ensure it is lawful, proportionate, and appropriately limited before any disclosure is made.