UNI FinTech Private Ltd (“we”) is the Data Fiduciary for personal data processed through www.legaleva.com and our apps. This Policy explains, in plain language, what personal data we collect, why, who receives it, how long we keep it, and how you can exercise your rights. It is published under section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011, and is designed to meet the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the DPDP Rules, 2025.
1. Contact for privacy matters
Grievance Officer and data-protection contact: Kalvin / Business Relationship Manager / / +91-22-6834 0545 / S-193, Haware Fantasia Business Park, Sector-30A, Vashi, Navi Mumbai, Thane (MH) 400703
2. What we collect, why, and for how long
| Category | Examples | Purpose | Basis | Kept for |
|---|---|---|---|---|
| Account | Name, email, mobile, password (hashed), date of birth, optional photo | Create and secure your account; contact you about your courses | Consent; your voluntary provision for this purpose | While your account is active; erased within 90 days of closure unless law requires longer |
| Billing | Billing name, address, state, GSTIN, order and transaction IDs, amount, payment method type (masked) | Process payments, issue GST invoices, handle refunds | Contract; legal obligation (GST and Companies Act) | 8 years from the end of the financial year |
| Learning | Enrolments, progress, quiz scores, assignments, projects, certificates | Deliver courses, grade work, issue and verify certificates | Contract / consent | Account life; certificate records 10 years for verification |
| Live classes | Name, video, audio, chat messages, attendance; session recordings | Run live sessions; provide recordings to your batch | Consent (notice shown before each recorded session) | Recordings (if any) 6 months after the cohort ends |
| Proctoring (only if you opt in for a proctored test) | Webcam images, screen activity, browser events during the test | Protect exam integrity | Separate, explicit consent for that test | 30 days after the result, longer only if a misconduct case is open |
| Support | Tickets, chat transcripts, call recordings (with notice) | Resolve your queries and complaints | Consent / legal obligation | 3 years |
| Device and usage | IP address, device and browser type, log-in times, pages viewed, error logs | Security, fraud prevention, troubleshooting | Legitimate use for security; legal obligation | Logs at least 1 year (DPDP Rules) and 180 days in India (CERT-In) |
| Cookies and analytics | Cookie IDs, analytics events | Analytics and advertising, only if you allow | Consent (see Cookie Policy) | As stated in the Cookie Policy |
| Career services (only if you opt in) | Resume, LinkedIn URL, job preferences | Prepare you for jobs; share your profile with a hiring partner you approve | Specific consent each time we share | Until you withdraw consent or 24 months of inactivity |
| Marketing preferences | Consent records, opt-outs | Send offers only if you agreed | Consent | Until you withdraw, plus a record of the withdrawal |
We do not ask for Aadhaar numbers, biometrics, religion, caste, political views or health data. If you choose to tell us about a disability so we can make accommodations, we use it only for that purpose.
3. Consent and how to withdraw it
3.1 Where we rely on consent, we ask for it through a clear action, such as an unticked box you tick. Each request names the specific purpose.
3.2 You can withdraw consent at any time from Dashboard → Privacy Centre, by email to info@legaleva.com, or by replying STOP to a WhatsApp or SMS message. Withdrawing is as easy as giving consent.
3.3 Withdrawal does not affect processing already done. If you withdraw consent needed to deliver a course (for example, account data), we may not be able to continue the service; refunds then follow the Refund & Cancellation Policy.
3.4 Once registered Consent Managers are operational, you may also give, manage and withdraw consent through one of them.
4. Who we share personal data with
We share only what each recipient needs, under written contracts that require them to protect it:
- payment aggregators and banks (to process payments and refunds);
- cloud hosting, video streaming and DRM, live-class and proctoring providers;
- email, SMS and WhatsApp messaging providers, CRM and analytics tools;
- certificate-verification services (only the details shown on your certificate);
- your employer or sponsor, if they paid for your enrolment (enrolment, progress and completion only);
- hiring partners, only with your specific consent each time;
- professional advisers, auditors and insurers under confidentiality;
- courts, police and regulators when the law requires; and
- a successor entity in a merger or acquisition, which must honour this Policy.
We do not sell your personal data.
5. Where your data is stored
Our main servers are in India (cloud provider, Mumbai region). Some service providers may process data outside India. We do so only where Indian law permits transfer to that country and under contractual safeguards.
6. How we protect it
We follow reasonable security practices aligned with IS/ISO/IEC 27001: encryption in transit and at rest, access on a need-to-know basis with multi-factor authentication for staff, logging and monitoring, regular vulnerability testing, backups and staff training. Payment card numbers are handled by our payment aggregator and are never stored on our servers.
7. If a breach happens
If a personal data breach occurs, we will inform affected users without delay through their registered email or phone, describing what happened, the likely consequences, what we are doing, and steps you can take. We will report the breach to the Data Protection Board of India and to CERT-In within the timelines the law sets.
8. Your rights
You have the right to:
- get a summary of the personal data we process and the processing activities, and the identities of those we have shared it with;
- correct, complete or update inaccurate or incomplete data;
- erase data that is no longer needed or for which you withdraw consent, unless the law requires us to keep it;
- withdraw consent;
- nominate another person to exercise your rights if you die or become incapable; and
- have your grievances addressed.
Make requests from the Privacy Centre or at info@legaleva.com. We may verify your identity first. We will respond within 30 days and in any case within the period the DPDP Rules allow (currently up to 90 days).
You also have duties under the DPDP Act: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.
9. Children
If you are under 18, a parent or lawful guardian must create your account and give verifiable consent before we process your data. We do not carry out behavioural tracking of children or show them targeted advertising. See the Minors & Parental Consent Policy.
10. Persons with disabilities
Where a person with a disability has a lawful guardian, we obtain the guardian’s verifiable consent.
11. Marketing
We send promotional emails, SMS or WhatsApp messages only with your consent. Every email has an unsubscribe link; SMS follows TRAI’s DLT and Do-Not-Disturb rules. Transactional messages about your account and courses are not marketing and will continue.
12. Cookies
See our Cookie Policy. You can change choices any time through Cookie settings in the footer.
13. Complaints
Contact our Grievance Officer first. We acknowledge within 24–48 hours and aim to resolve within 30 days. If you are not satisfied after using our grievance process, you may complain to the Data Protection Board of India.
14. Changes
We will notify you of material changes by email and on-site notice before they take effect, and ask for fresh consent where the law requires.