Empanelment and partnerships · Neutral ODR under the Mediation Act, 2023 +91 92160 24226 panel@vakilkaro.com

PRIVACY POLICY

For the Vakilkaro ODR Website and Portal (odr.vakilkaro.com)

Operated by Jsons Solicitors Private Limited, under the brand "Vakilkaro ODR"

Effective Date: 26.09.2026 | Last Updated: 26.09.2026 | Version: 1.0

1. Introduction and Scope

1.1 This Privacy Policy ("Policy") describes how Jsons Solicitors Private Limited, operating under the brand "Vakilkaro ODR" ("Vakilkaro", "we", "us", "our"), collects, uses, discloses, stores, and protects Personal Data in connection with the website odr.vakilkaro.com, its case-filing interfaces, dashboards, and Application Programming Interfaces (collectively, the "Website" or "Portal").

1.2 This Policy applies to every category of person whose Personal Data is processed through the Website, including casual visitors, registered Lenders/Businesses and their authorised personnel, Borrowers/Respondents/counterparties who are parties to a Case, empanelled Neutrals, and any other User (collectively, "you", "your").

1.3 This Policy forms part of, and must be read together with, the Terms and Conditions for the Vakilkaro ODR Website and Portal and, where applicable, the Terms and Conditions for Lenders and Neutrals. In the event of any inconsistency specific to the processing of Personal Data, this Policy shall prevail.

1.4 This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the rules made or to be made thereunder, and, to the extent applicable, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as amended or superseded from time to time.

1.5 By accessing or using the Website, or by submitting Personal Data to us in any manner, you acknowledge that you have read and understood this Policy. Where your consent is the legal basis for processing, such consent is sought separately and specifically as described in Clause 6.

2. Definitions

  • "Consent Manager" means a person or platform registered with the Data Protection Board of India that enables a Data Principal to give, manage, review, or withdraw consent through an accessible, transparent, and interoperable platform.
  • "Data Fiduciary" means the person who, alone or in conjunction with others, determines the purpose and means of processing Personal Data.
  • "Data Principal" means the individual to whom the Personal Data relates, and, where such individual is a child, includes the parent or lawful guardian of such child.
  • "Data Processor" means any person who processes Personal Data on behalf of a Data Fiduciary.
  • "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
  • "Processing" means an operation or set of operations performed on Personal Data, including collection, recording, organisation, storage, use, sharing, disclosure, or erasure.
  • "Sensitive Personal Data" includes financial information, credit history, biometric data, and other categories treated as sensitive under applicable law, to the extent such categories continue to apply under Indian law.
  • Terms such as "Case", "Lender", "Borrower/Respondent", "Neutral", "Settlement Agreement", and "Arbitral Award" have the meanings assigned to them in the Terms and Conditions for the Vakilkaro ODR Website and Portal.

3. Roles: Data Fiduciary, Joint Fiduciary, and Data Processor

3.1 In respect of Personal Data collected directly from you at registration (such as your own account and contact details), Vakilkaro acts as the Data Fiduciary.

3.2 In respect of Case data uploaded by a Lender (including a Borrower/Respondent's Personal Data contained in such Case data), the Lender is the Data Fiduciary responsible for having lawfully obtained the data and for providing any notice or obtaining any consent required from the Borrower/Respondent under applicable law. Vakilkaro processes such Case data as a Data Processor acting on the Lender's instructions, for the purpose of operating the Portal's mediation, conciliation, and arbitration workflow.

3.3 In respect of Personal Data submitted by a Borrower/Respondent directly through the Website (for example, when registering to view Case status or participating in a mediation/arbitration session), Vakilkaro and the referring Lender act as joint or independent Data Fiduciaries to the extent of their respective processing activities, each responsible for its own compliance obligations under the DPDP Act.

3.4 In respect of professional and empanelment data submitted by a Neutral, Vakilkaro acts as the Data Fiduciary.

4. Personal Data We Collect

4.1 Data You Provide Directly

  • Account and identity data: name, designation, entity name, registered address, email address, phone number, and login credentials.
  • KYC and verification data (for Lenders and Neutrals): certificate of incorporation, GST/PAN details, board resolutions, authorised-signatory identity documents, professional qualifications, bar/enrolment details, and experience certificates.
  • Financial and billing data: bank account details for wallet settlement, GST invoicing details, and transaction history on the Portal.
  • Case data (for Borrowers/Respondents and counterparties): name, contact details, loan or account details, outstanding amounts, correspondence history, and any supporting documents uploaded to a Case.
  • Communications: content of messages, emails, support tickets, and grievance submissions sent to us through the Website.
  • Content you submit: reviews, feedback, testimonials, or empanelment applications.

4.2 Data Collected Automatically

  • Device and usage data: IP address, browser type and version, device identifiers, operating system, referring/exit pages, and pages viewed.
  • Log data: timestamps of login, case actions, outreach communications, and API calls, retained for audit and compliance purposes.
  • Cookies and similar technologies, as described in Clause 11.

4.3 Data Received from Third Parties

  • Case data bulk-uploaded or transmitted via API/LMS integration by a registered Lender.
  • Verification results from KYC, sanctions-screening, or credit-information providers engaged for onboarding due diligence.
  • Confirmation and audit data from payment gateway, e-signature (including Aadhaar-based e-signature), and DigiLocker service providers used to execute Settlement Agreements.

5. How We Use Personal Data

We use Personal Data for the following purposes:

  • To register and verify Accounts, and to onboard Lenders and empanel Neutrals, including KYC and sanctions-screening checks;
  • To operate the case-management workflow: validating, allocating, and processing Cases, and facilitating outreach to Borrowers/Respondents in compliance with the applicable Fair Practices Code;
  • To facilitate mediation, conciliation, and arbitration sessions, and to prepare, execute, and store Settlement Agreements and Arbitral Awards;
  • To process payments, issue invoices, reconcile wallet balances, and comply with tax obligations;
  • To maintain audit trails and MIS reports for compliance, regulatory reporting, and dispute-resolution recordkeeping;
  • To communicate with you regarding your Account, a Case, billing, or a grievance;
  • To detect, prevent, and investigate fraud, security incidents, and unauthorised access;
  • To improve the Website's functionality, content, and user experience, including through aggregated or anonymised analytics; and
  • To comply with applicable law and respond to lawful requests from courts, regulators, or law enforcement authorities.

6. Legal Basis and Consent

6.1 Where we rely on your consent as the basis for processing, we will seek such consent through a clear, itemised notice describing the Personal Data to be collected and the purpose of processing, in accordance with Section 5 and Section 6 of the DPDP Act. You may give, manage, review, or withdraw consent at any time by writing to us at the contact details in Clause 17, or, where made available, through a registered Consent Manager.

6.2 Withdrawal of consent will not affect the lawfulness of processing carried out before such withdrawal, and may result in our being unable to continue providing certain features of the Website to you (for example, Case processing cannot continue without the underlying Case data).

6.3 Certain processing is carried out for "legitimate uses" recognised under the DPDP Act without requiring separate consent, including processing for a purpose you have voluntarily provided data for, compliance with a legal obligation or court/regulatory order, responding to a medical emergency, and other purposes permitted under Section 7 of the DPDP Act.

7. Disclosure of Personal Data

We may disclose Personal Data to the following categories of recipients, on a need-to-know basis and subject to confidentiality obligations:

  • Empanelled Neutrals, solely to the extent necessary for them to hear and resolve the Case allocated to them;
  • The Lender and Borrower/Respondent who are parties to a Case, to the extent necessary to conduct outreach, mediation, or arbitration;
  • Payment gateway, banking, and wallet-settlement service providers, for processing fees and payouts;
  • E-signature and digital-locker service providers (including Aadhaar-based e-signature and DigiLocker), for execution of Settlement Agreements;
  • Cloud hosting, IT infrastructure, and security service providers engaged to operate the Website, under contractual confidentiality and data-protection obligations;
  • Auditors, legal advisors, and insurers, under an equivalent duty of confidentiality;
  • Regulators, courts, tribunals, or law-enforcement authorities, where disclosure is required by law or a valid legal process; and
  • A successor entity in connection with a merger, acquisition, or sale of assets, subject to that entity agreeing to honour the commitments in this Policy.

We do not sell Personal Data to third parties for their independent marketing purposes.

8. Cross-Border Data Transfer

Personal Data collected through the Website is hosted on infrastructure located in India. Where any transfer of Personal Data outside India becomes necessary (for example, for a cross-border Case or a cloud service provider with servers outside India), such transfer will be made only in accordance with the DPDP Act and any restrictions on transfer to specific countries or territories notified by the Central Government from time to time.

9. Data Security

  • Case files and Personal Data are encrypted.
  • Access to Personal Data is restricted through role-based access controls, multi-factor authentication for privileged accounts, and logging of access to sensitive records.
  • We conduct periodic security testing, vulnerability assessments, and internal audits of our data-handling practices.
  • Notwithstanding these measures, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security of Personal Data.

10. Data Retention and Deletion

10.1 We retain Personal Data only for as long as necessary to fulfil the purposes described in this Policy, including the period required under applicable law (such as limitation periods under the Limitation Act, 1963, and record-retention norms applicable to regulated Lenders) or as agreed in a Lender's commercial agreement.

10.2 Where you withdraw consent, or where the purpose for which Personal Data was collected is no longer being served and retention is not necessary for a legal purpose, we will erase such Personal Data, or cause our Data Processors to erase it, unless retention is required to comply with a legal obligation.

10.3 On termination of a Lender's registration, we will, on written request, export the Lender's Case data in a commonly used format and will thereafter delete or anonymise such data in accordance with our retention schedule, save for data required to be retained by law.

11. Cookies and Similar Technologies

11.1 The Website uses cookies, local storage, and similar technologies for authentication and session management, security and fraud prevention, remembering your preferences, and analytics to understand how the Website is used.

11.2 You may control or disable cookies through your browser settings; disabling certain cookies (particularly those required for authentication) may affect your ability to use Portal features such as Dashboard access or Case filing.

11.3 We may use third-party analytics providers who set their own cookies subject to their respective privacy policies; we do not permit such providers to use Website analytics data for their own independent marketing purposes.

12. Rights of Data Principals

Subject to the DPDP Act and applicable exemptions, you have the right to:

  • Obtain a summary of the Personal Data we hold about you and the processing activities undertaken with respect to it;
  • Request correction, completion, updating, or erasure of your Personal Data;
  • Nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity;
  • Withdraw consent previously given, as described in Clause 6;
  • Have readily available means to register a grievance with us, as described in Clause 17; and
  • Approach the Data Protection Board of India where your grievance is not resolved to your satisfaction.

To exercise any of these rights, please write to us at the contact details in Clause 17. We may need to verify your identity before acting on a request, and may decline a request to the extent permitted or required under applicable law (for example, where erasure would conflict with a legal retention obligation or an ongoing dispute-resolution process).

13. Children's Privacy

The Website is intended for use by persons who are at least eighteen (18) years of age and legally competent to contract. We do not knowingly collect Personal Data from children. If we become aware that we have inadvertently collected Personal Data from a child without verifiable parental or guardian consent, we will take steps to delete such data.

14. Marketing Communications

We may send you service-related communications (Case updates, billing notices, security alerts) that are necessary for operating your Account, which you cannot opt out of while your Account remains active. Where we send promotional or informational communications about our services, you may opt out at any time using the unsubscribe mechanism provided in such communication or by writing to us.

15. Data Breach Notification

In the event of a personal data breach, we will take prompt remedial measures and will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Act and rules made thereunder, describing the nature of the breach and the measures taken or proposed to be taken to mitigate risk.

16. Third-Party Links and Services

The Website may link to or integrate with third-party services (such as payment gateways, DigiLocker, or e-signature providers) that have their own privacy policies. We are not responsible for the privacy practices of such third parties, and we encourage you to review their policies before providing Personal Data to them.

17. Grievance Officer and Data Protection Contact

In accordance with the Information Technology Act, 2000 and the DPDP Act, we have designated a Grievance Officer/Data Protection contact to address queries and complaints regarding the processing of your Personal Data. You may reach this office at:

Vakilkaro ODR — Grievance Officer / Data Protection Desk

Email: contact@vakilkaroodr.com

Phone: +91 92160 24226

We will acknowledge a grievance within twenty-four (24) hours and endeavour to resolve it within fifteen (15) days, or such shorter period as may be prescribed under applicable law. If you are not satisfied with our resolution, you may approach the Data Protection Board of India or a competent court.

18. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or applicable law. Material changes will be notified through the Website, email, or Dashboard notification, with reasonable prior notice where practicable. Continued use of the Website after such changes take effect constitutes acknowledgement of the revised Policy. The "Last Updated" date at the top of this Policy indicates when it was last revised.

19. Governing Law

This Policy shall be governed by and construed in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023, and any dispute concerning this Policy that is not resolved through the grievance mechanism in Clause 17 shall be subject to the exclusive jurisdiction of the courts at Jaipur, Rajasthan, India, without prejudice to your right to approach the Data Protection Board of India.

20. Contact Us

For any questions about this Privacy Policy or our data-handling practices, please contact:

Vakilkaro ODR — Privacy Desk

Email: contact@vakilkaroodr.com

Phone: +91 92160 24226

Disclaimer: This Privacy Policy describes Vakilkaro ODR's data-handling practices and does not constitute legal advice. It should be read together with the Terms and Conditions for the Vakilkaro ODR Website and Portal and, where applicable, the Terms and Conditions for Lenders.