India Privacy Notice
Effective Date: 9 October 2026
Last Updated: 9 October 2026
Version: 2026-10-09
1. Who this notice is for, and who we are
This notice is for individuals in India whose personal data we handle for our own purposes when they hold an account with MandateRoom, are invited into a data room, or contact us. It is written to meet the Digital Personal Data Protection Act, 2023 (the "Act") and the Digital Personal Data Protection Rules, 2025 (the "Rules"). Parts of the Act and the Rules are being brought into force in stages, and the provisions on notice, consent, your rights and security safeguards are scheduled to apply from 13 May 2027. We follow this notice from the date at the top of this page.
The Data Fiduciary is Aniket Raj, an individual trading as MandateRoom, a sole proprietor (Udyam Registration No. UDYAM-UP-29-0238002), of Delhi NCR, India.
The person who can answer your questions about how we process your personal data, and who is our Grievance Officer, is Aniket Raj, at hello@mandateroom.com.
If you are invited to a data room, the organisation that invited you decides what the room holds and why, and is the Data Fiduciary for the documents and the content in it. This notice does not cover that content; contact the organisation that invited you about it. We process it on that organisation's behalf.
2. The personal data we process and why
| Personal data | What we use it for |
|---|---|
| Your name, work email address, organisation and role | To create and run your account; to recognise you; to let the organisation that invited you give you access; to send you invitations, security notices and billing messages |
| Sign-in time, IP address, browser and device type, session identifiers and failed sign-in attempts | To keep your account and the data rooms secure; to detect fraud and abuse; to limit repeated sign-in attempts |
| Records of what you open, download, ask, search for or change in a room, with the time and your IP address (the audit ledger; the room's administrators can read what you search for, with your name, and can see whether and when you read the room's deal brief) | To give the room's administrators and the parties to a transaction a reliable record of who did what; to protect the confidentiality of the transaction; to support disputes and legal claims |
| The version of the Terms or of an NDA you accept, the time, your IP address, your name and email | To keep evidence of what you agreed to and when |
| Your email address or name, the time and a document reference placed on the pages and downloads you open (a watermark) | To discourage and trace unauthorised copying of confidential material |
| Invoice contact name, email, organisation name and address, tax identifier, and the payment reference and confirmation of a bank transfer | To invoice, receive and account for payment, and to meet tax and accounting law. We do not receive card details |
| Your name, work email address, organisation and any note you enter in our waitlist form | To answer your request for access and to tell you when access is available. Entering them is voluntary |
| What you write to us and what we reply | To answer you and to keep a record of the answer |
We do not use your personal data for advertising or sell it.
3. Your consent, and how to withdraw it
We process this data on the basis of your consent, which you give when you create an account or accept an invitation and tick the box to accept our Terms and this notice, or, for the details in our waitlist form, when you submit the form to ask for access, and on the other grounds the Act permits, for example to comply with the law and, where you gave us your data voluntarily for a purpose, to carry out that purpose. You can withdraw consent at any time by emailing hello@mandateroom.com with "Withdraw consent" in the subject line, or by asking us to close your account. It is as easy to withdraw as it was to give. We confirm in writing, and we stop processing your data for the purposes you withdrew within a reasonable time. Withdrawing consent may mean that we can no longer provide the Service to you, and it does not affect processing done before you withdrew. Where the law requires us to keep a record, or the record is evidence that a transaction took place, we keep it for the period described in section 7 and then delete it.
4. Your rights under the Act
You have the right to: obtain a summary of the personal data we process about you and of the processing activities, and the identities of the other data fiduciaries and processors with whom we have shared it; have inaccurate or misleading data corrected, incomplete data completed, and data updated; have your data erased, unless we must keep it for a legal purpose; have your grievance redressed; and nominate another person to exercise your rights if you die or become unable to do so.
To exercise any of these rights, email hello@mandateroom.com with "Rights request" in the subject line, saying which right you wish to use. We may ask you to confirm who you are. We acknowledge a request promptly and respond within 30 days.
5. Grievances and complaints to the Data Protection Board of India
If you have a complaint about how we handle your personal data, write to the Grievance Officer at hello@mandateroom.com with "Grievance" in the subject line. We acknowledge it within 24 hours and aim to resolve it within seven days, and we explain our decision. If you are not satisfied, or we do not respond in the time the law allows, you may complain to the Data Protection Board of India once its complaint provisions apply, through the Board's digital office, after you have used our grievance process.
6. Children
The Service is for business use by adults. We do not allow a person under 18 to hold an account, and we do not knowingly process the personal data of a child. If you believe that we have, tell us and we will delete it.
7. How long we keep your data
We keep account data while your account exists and delete or anonymise it within 30 days after you close your account and ask us to delete it. We keep audit and activity records, and the records of what you accepted, as evidence for at least seven years, and we keep logs of sign-ins and access for the period the law requires. When you ask for erasure and nothing legally requires us to keep a record, we make the personal identifiers in these records permanently unreadable. We keep invoices and payment records for the period tax and accounting law requires. We keep waitlist details until we invite you to open an account, you ask us to delete them, or we close the waitlist, whichever comes first. Our Privacy Policy sets out all periods in a table.
8. Where your data is processed
Our infrastructure is mainly in the United States, and we work from India, so your data is stored outside India and accessed from India. The provider of our waitlist form stores what you enter in it in Europe, and we read it from India. The Act allows the transfer of personal data outside India except to a country that the Government of India restricts by notice. We will follow any restriction that is notified.
9. Security and breaches
We protect personal data with reasonable security safeguards, including encryption in transit and at rest as provided by our infrastructure providers, access controls that the database enforces, an audit ledger, and restrictions on who can see what. Our Terms of Service and our security page describe them and say what we do not have. If a breach affects your personal data, we will tell you without delay, with what we know and what you can do, and we will report it to the Data Protection Board of India and to CERT-In as the law requires.
10. Language
This notice is in English. You may ask us for it in Hindi, or in another language listed in the Eighth Schedule to the Constitution of India, and we will provide it where we reasonably can.
11. Changes
We may update this notice. For a material change we will give at least 30 days' notice by email or in the Service.