In this Policy, unless the context requires otherwise:
1.1.1.
“we”, “us”, “our” and “YTS Labs” mean Think and Scale, a partnership firm registered under the Indian Partnership Act, 1932 [registration number], having its registered office at [address], which trades through its YTS Labs brand and operates HRxBoard.
1.1.2.
“Applicable Data Protection Law” means, until the DPDP Commencement Date, section 43A of the IT Act, the SPDI Rules and the other provisions of the IT Act that apply to the processing of personal data; and from that date, the DPDP Act and the DPDP Rules together with the provisions of the IT Act that continue to apply
1.1.3.
“Authorised Representative” means a person who acts for a complainant under written authority.
1.1.4.
“Client” means a business that subscribes to the Platform under an Order.
1.1.5.
“Client Admin” means the person the Client names to manage its account.
1.1.6.
“Client Team” means the users the Client adds.
1.1.7.
“Client Data” means data that a Client or its Client Team uploads or records in the Platform, including Workforce Data, Compliance Records, Filing Documents and the Client Business Profile.
1.1.8.
“Complainant” means a person who submits a Grievance.
1.1.9.
“Data Fiduciary”, “Data Processor”, “Data Principal”, “Personal Data” and “Personal Data Breach” have the meanings in the DPDP Act and, before the DPDP Commencement Date, are used in the same sense.
1.1.10.
“Data Protection Board” means the Data Protection Board of India established under the DPDP Act.
1.1.11.
“DPDP Act” means the Digital Personal Data Protection Act, 2023. “DPDP Rules” means the Digital Personal Data Protection Rules, 2025. “DPDP Commencement Date” means the date on which the substantive duties of Data Fiduciaries under the DPDP Act take effect, expected to be [13 May 2027].
1.1.12.
“Grievance” means a complaint, concern or request for redress about how we handle Personal Data, about the Platform or the Website, or about our service, billing or support.
1.1.13.
“Grievance Officer” means the officer named in clause 3.
1.1.14.
“IT Act” means the Information Technology Act, 2000 and the rules under it. “SPDI Rules” means the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. “Intermediary Rules” means the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
1.1.15.
“Our Data” means Personal Data that we collect about Client Team users, Website visitors and people who contact us, as the Privacy Policy describes.
1.1.16.
“Platform” means the HRxBoard application at app.ytslabs.com and its APIs, databases and document storage. “Website” means hrxboard.com.
1.1.17.
“Regulation Master” means the Platform’s database of Acts, Labour Codes, forms, frequencies, filing modes and due-date rules.
1.1.18.
“Security Incident” means an event that compromises, or is reasonably suspected of compromising, the confidentiality, integrity or availability of the Platform or data held in it.
1.1.19.
“Working Day” means a day other than a Saturday, Sunday or public holiday at [city].
1.2.
Interpretation. Headings are for convenience only. “Including” means including without limitation. A reference to a statute, rule or direction includes it as amended, re-enacted or replaced. A reference to a clause is to a clause of this Policy.
2. Purpose, legal basis and scope
2.1.
Purpose. This Policy tells you how to raise a Grievance about HRxBoard, who will handle it, how fast we act, and what you can do if you are not satisfied.
2.2.
Legal basis. This Policy is our grievance redressal mechanism for the purposes of rule 5(9) of the SPDI Rules and, from the DPDP Commencement Date, section 8(10) and section 13 of the DPDP Act and the DPDP Rules. It also serves as our mechanism for the purposes of the Intermediary Rules and the consumer protection rules to the extent they apply to us.
2.3.
Shorter statutory periods. The timelines in this Policy are our standard commitments. Where a law that applies to a particular Grievance prescribes the 24-hour acknowledgement under the Intermediary Rules, we follow the shorter period for that Grievance.
2.4.
Scope. This Policy covers every Grievance about the Platform and the Website, whoever raises it. It works alongside the Privacy Policy, the Terms of Use and the Refund & Cancellation Policy. It does not replace any right you have under law.
3. Grievance Officer
Our Grievance Officer is:
Name:
Designation:
Organisation: Think and Scale (YTS Labs)
Email:
Phone:
Address:
In-app channel: the support channel inside HRxBoard
We will publish any change of Grievance Officer on the Website and in this Policy before or when the change takes effect, and we will keep these contact details current as the law requires.
4. Who may submit a Grievance
4.1.
Any Client user, employee of a Client, Website visitor or other person whose data or interests are affected by HRxBoard may submit a Grievance. No fee is charged.
4.2.
You may act yourself or through an Authorised Representative. We may ask for the written authority and proof of identity of both. If you are a Data Principal who has died or become incapable, your nominee may act for you from the DPDP Commencement Date.
4.3.
We accept Grievances in English and Hindi. If you need help in another language, or because of a disability, tell us and we will make reasonable arrangements to receive your Grievance.
5. What you can raise
How we handle Our Data, including access, correction, completion, updating and erasure, and withdrawal of consent.
A suspected Security Incident, unauthorised access or Personal Data Breach.
An error in the Regulation Master, such as a wrong form, frequency, due date or applicability rule.
Platform, service or support problems, such as an outage, bug or delay.
Billing or refund issues.
Content on the Platform that you believe is unlawful or infringes your rights.
A suspected vulnerability (clause 12).
Any other matter about the Platform or the Website.
6. How to submit, what to include and how we verify you
6.1.
Channels. Submit a Grievance by email to the Grievance Officer, through the in-app support channel, or by post to the address in clause 3.
6.2.
What to include. Please include your name and contact details, your organisation and role, the email or mobile number registered with HRxBoard if you have an account, a clear description of the issue with dates, screenshots or documents, and the outcome you want.
6.3.
Verification. For requests about your Personal Data, we need enough information to confirm who you are. We ask only for what we need, we use it only for verification and we never ask for your password. If we cannot verify you, we tell you why and what more we need.
6.4.
Please do not email workforce data. Do not send Workforce Data or Filing Documents by email. If the issue involves such data, use the in-app support channel or ask the Grievance Officer to arrange a secure method.
7. Timelines
7.1.
Acknowledgement. We confirm receipt and give a reference number within 2 Working Days of receiving the Grievance.
7.2.
Assessment. The Grievance Officer reviews it and may ask for more information within 7 days of receipt. If you do not reply to a request for information within 15 days, we may close the Grievance and tell you, and you may reopen it by writing again.
7.3.
Resolution. We investigate, act and tell you the outcome and our reasons within 30 days of receipt. If we cannot resolve it in that time for a reason outside our control, we tell you why before the 30 days end and give you a date. This is within the period that the SPDI Rules and the DPDP Rules allow.
7.4.
Review. If you are not satisfied, you may ask in writing, within [30] days of our outcome, for review by a partner of Think and Scale who was not involved in the first decision. We decide the review within 15 days of your request.
7.5.
Urgent matters. A Security Incident or suspected Personal Data Breach is handled at once under our incident plan, as clause 13 describes, and does not wait for these steps.
8. How we classify and prioritise
Security or data incident. First response is immediate, by our incident lead. We contain the matter at once, report qualifying cyber incidents to CERT-In within 6 hours of noticing them, and tell an affected Client within 24 hours of becoming aware of a Personal Data Breach affecting its Client Data.
Personal data rights. Requests to access, correct, update or erase Our Data, or to withdraw consent. First response within 2 Working Days. Resolution within 30 days.
Regulation Master error. A wrong form, frequency, due date or applicability rule. First response within 2 Working Days. Where an error is confirmed, we correct it after review by a Qualified Professional within [7] days of confirmation, and we tell affected Clients.
Platform or service. Outages, bugs, support delays or missing features. First response within 2 Working Days. Resolution within 30 days.
Billing. Wrong charges, refunds or invoice issues. First response within 2 Working Days. Resolution within 30 days, or as the Refund & Cancellation Policy provides.
Content complaints. A complaint that content is unlawful, handled under the Intermediary Rules where they apply, and acknowledged and decided within the periods they prescribe.
9. Handling and escalation
9.1.
Level 1: Grievance Officer. The Grievance Officer logs the Grievance, gives a reference number, investigates, may involve the Engineering Lead, the Compliance Content Reviewer or the Support Lead, and replies with the outcome and reasons.
9.2.
Level 2: Partner review. A partner of Think and Scale who was not involved in the first decision reviews the Grievance on request, as clause 7.4 provides.
9.3.
Conflicts. If the Grievance Officer is a partner, or is personally involved in the matter or is the subject of the Grievance, another partner handles it from the start and the reviewer is someone who has no connection with it.
9.4.
Level 3: External remedies. After you have used this mechanism, you may approach the Data Protection Board of India (from the DPDP Commencement Date), a court, a tribunal or any other authority with jurisdiction.
10. Employees of a Client
10.1.
The employer decides. If your Personal Data is on HRxBoard because you work for a Client, your employer is the Data Fiduciary for that data and decides your request. Please use your employer’s grievance mechanism first.
10.2.
If you write to us. We tell you first that we will pass your request to the Client. We then pass it on within 2 Working Days, disclosing only what is needed to deal with it, and tell you where it has gone. We answer any Platform question that the Client passes to us.
10.3.
No adverse action. We ask the Client not to take adverse action against you for raising a Grievance. We cannot control the Client’s response, and nothing in this Policy limits your remedies against your employer.
11. Requests about your Personal Data
11.1.
For Our Data we handle your request as the Privacy Policy describes. We tell you what we did, what we could not do and why. We may refuse or limit a request where the law allows or requires, for example because we must keep a record by law, to protect another person’s rights, or because the request is manifestly unfounded, and we tell you the reasons and your remedies.
11.2.
If we hold data that we must retain for a legal purpose, we mark it, restrict its use to that purpose, and delete it when the purpose ends.
12. Reporting a security vulnerability
12.1.
Report. If you believe you have found a weakness in HRxBoard, write to [security@ytslabs.com] with the details.
12.2.
Rules of engagement. Please give us reasonable time to fix the issue, do not access, change or destroy other people’s data, do not degrade the service or use social engineering, and do not disclose the weakness publicly until we have responded.
12.3.
Our commitments. We acknowledge reports within 2 Working Days. Our fix targets, counted from confirmation, are 7 days for critical issues, 30 days for high and 90 days for medium. These are targets and not guarantees.
12.4.
Good-faith safe harbour. We will not start legal action against a researcher who acts in good faith and follows these rules. This commitment does not bind third parties or authorities, and does not extend to conduct that causes harm or breaks the law.
13. Reporting a suspected data breach
If you think data on HRxBoard has been exposed or accessed without authority, tell us immediately through the in-app support channel or on [incident phone], at any hour. Our designated point of contact is reachable 24 hours a day, every day. Please give what you know and do not wait for full details before reporting. We handle the report under our incident plan, as the Privacy Policy describes.
14. Regulation Master errors
If you believe a due date, form, frequency or applicability rule in the Regulation Master is wrong, tell us with the reference to the official notification if you have it. We verify it with a Qualified Professional, correct it where it is wrong, tell affected Clients, and record the root cause. A correction does not by itself change any filing that is already due or complete, and the Risk & Financial Disclaimer continues to apply.
15. Billing Grievances
For a disputed invoice, contact billing first at [billing@ytslabs.com], as the Refund & Cancellation Policy explains. If billing does not resolve it, it comes to the Grievance Officer under this Policy. We do not suspend an account for a disputed amount while a good-faith dispute is under review, if you pay the undisputed part.
16. Confidentiality, fair treatment and non-retaliation
We keep Grievances, and the identity of those who raise them, confidential, and share them only with people who need them to resolve the matter or as the law requires. We will not penalise, suspend, or treat adversely anyone for raising a Grievance in good faith. A Client Team user does not lose access to the Platform because of a Grievance.
17. Frivolous, abusive or repeated Grievances
We take every Grievance seriously. From the DPDP Commencement Date, section 15 of the DPDP Act requires a Data Principal not to register a false or frivolous grievance. We may decline to act again on a Grievance that repeats one we have already resolved without new facts, or that is abusive, and we will tell you why and remind you of your external remedies. We do not use this clause to avoid a genuine complaint.
18. Records, review and learning
We log every Grievance, its handling and its outcome. We review volumes, causes and response times in our monthly performance tracking and at management review. A confirmed defect leads to a root-cause analysis and a recorded corrective action under our quality system, and the person who raised it is told what changed. We keep Grievance records for [3] years after closure.
19. Limits of this Policy
This Policy is a process for resolving complaints. It does not create new rights or liabilities, and it does not extend or shorten any limitation period or change the dispute resolution terms in the Terms of Use. Using it does not stop you from using any other remedy, and the time spent in it is not counted against you where the law allows.
20. Changes to this Policy
We update this Policy when the law or our practices change, and we publish the new version with its effective date. Material changes are notified to Clients through the Platform or by email.
21. Contact
Grievance Officer, Think and Scale (YTS Labs): [name], [email], [phone and hours], [address].
Questions or concerns about this policy? Our Grievance Officer is here to help, as set out in the Grievance Redressal Policy.
