Grievance Redressal Policy

Grievance Redressal Policy

1. Purpose

This policy sets up Graine's grievance redressal system. Section 8(10) of the Digital Personal Data Protection Act, 2023 (the "Act") requires a Data Fiduciary to have an effective mechanism to redress the grievances of Data Principals, and section 13 gives every person the right to readily available means of redress. Rule 14(3) of the Digital Personal Data Protection Rules, 2025 (the "Rules") requires the system to be published and to respond within a reasonable period not exceeding ninety days, with technical and organisational measures to make that real. Rule 9 requires a published contact. The Rules' duties start on 13 May 2027; we run this process now.

2. In short

3. Scope

Who can raise a grievance: any person whose personal data Graine holds or processes, a person they have nominated (Act s.14; Rule 14(4)), or a person who has made a rights request and is unhappy with the answer.

What it covers: how Graine collects, uses, shares, keeps or protects personal data; a rights request not answered or answered wrongly; a consent that was not honoured; a personal data breach; any breach of the Act or Rules by Graine.

Where Graine is the Data Fiduciary: for workspace users, visitors, billing contacts and people who write to us. We decide the outcome.

Where Graine is a Data Processor: for people a customer called or chatted with using a Graine agent, the customer decides. We log your grievance, pass it to the customer within 3 working days, help it respond, and tell you we have done so. The customer's own grievance process also applies. You may still go to the Board against the customer.

4. Roles

5. How to raise a grievance

• Email: founders@graine.ai, subject "Grievance".
• Web form: on our website at www.graine.ai/privacy-policy, and on the Grievance Officer page at www.graine.ai/grievance-officer. It gives a reference number at once.
• Post: The Grievance Officer, Mavrix AI Private Limited, Basement, Rajendra Complex, Naya Bans, Near Union Bank, Sector 15, Noida, Gautam Buddha Nagar, Uttar Pradesh – 201301, India.

Tell us what happened, what you want, and how to reach you, and give an identifier so we can find your data (the email of your account, or the phone number a business used and its name). If you need help to write it down, or need another language or an accessible format, say so and we will help.

6. Policy statements

1. Every grievance receives a reference number and a written acknowledgement within 2 working days.
2. The Grievance Officer decides within 30 days of receipt and never later than 90 days.
3. If more than 30 days will be needed, the Grievance Officer tells the person why, and the date by which they will have an answer, before day 30. That date is never later than day 90.
4. The reply is in writing and plain language. It says what we found, what we did or will do, the reasons if we decline, and how to take the matter further.
5. No one is penalised for raising a grievance, and the grievance is kept confidential to those who need to handle it.
6. There is no charge.
7. A grievance about a personal data breach is also an incident: it is passed to the incident process at once (see the Incident and Breach Notification Commitments).
8. A grievance that shows a wider fault leads to a fix and a change to our controls, recorded in our corrective-action log.

7. Process and time limits

8. Escalation

Complaint to the Board (Rule 3(c)(iii)). Once our process has run, you may complain to the Data Protection Board of India, which works as a digital office (Rule 20). The address of the Board's complaint channel is not set out in the Rules. We will add the link here once we have confirmed it from the Board's own official sources; until then, write to us and we will point you to the route the Board has published. If you are in the European Union or the United Kingdom, you may also complain to your local data protection supervisory authority.

9. Records and reporting

The Grievance Officer keeps a register: reference, date received, who, what, which data, the date acknowledged, the date answered, the outcome, and any escalation. The Grievance Officer reviews it monthly: how many are open, closed, older than 30 days and older than 90 days (the target for the last is none), and the common causes. A grievance record is kept as proof that we answered; the retention period is in the Data Retention and Deletion summary. The register holds identifiers and a summary, not more personal data than needed.

10. How this is implemented at Graine (as of 3 Nov 2026)

11. Exceptions and enforcement

No exception to the 90-day limit is allowed. Failure by staff to pass on or answer a grievance on time is handled under Graine's disciplinary process.

12. Review

The owner approves this policy and reviews it at least every 12 months, and after any grievance that reaches the Board.

13. Framework mapping

Contact

founders@graine.ai, for the attention of the Grievance Officer. Mavrix AI Private Limited, trading as Graine AI (CIN U62099KA2025PTC210316).

Revision history