Data request policy

1.Whose data, and our role

• Data you store on our services — websites, databases, files, mailboxes: you decide what it is and what happens to it. We store and process it on your behalf, and access it only to provide a service you've asked for, to keep our systems secure, or when the law requires it.
• Our records about you — your account, contacts, invoices and support history: we're responsible for these, as our privacy policy explains.

2.Requests from courts, police and government

We act only on a written request from an authority with the legal power to make it, such as:

• an order or summons from a court
• a written notice from the police or another investigating agency to produce documents or records, under section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023
• an order to provide information under the IT Rules 2021, which we must answer within 72 hours
• a direction under section 69 or 69B of the IT Act, issued by the authority the law names
• a direction from CERT-In, the national agency for cyber security incidents

3.How we handle them

• We check that the request is genuine, comes from an authorised officer, states its legal basis, and identifies the account, address or data it covers.
• If a request is unclear or broader than its legal basis, we ask for it to be clarified or narrowed before we act.
• We disclose only what the order covers.
• We tell the customer about the request before we disclose, unless the order or the law forbids it, or telling them would put someone at risk.
• We keep a record of each request and of what we disclosed.

4.Requests from other people

We don't give customer data to other businesses, lawyers or members of the public without the customer's written consent or a court order. If you think content on a service we host breaks the law or your rights, write to our Grievance Officer, as set out in our terms and copyright policy.

5.What we're required to keep

• Server and cloud customers: validated names, addresses and contact numbers, ownership pattern, the purpose and period of hire, the IP addresses allotted, and the email address, IP address and time at sign-up — for five years after the account closes, as CERT-In's directions require.
• Logs of our systems: 180 days, kept in India.
• Content removed on an order, and the related records: at least 180 days, or longer if a court or agency requires.
• Account details after an account closes: at least 180 days.

6.Your own personal data

You can ask to see the personal data we hold about you, to correct it, or to delete it, unless a law requires us to keep it. Write to our Grievance Officer: Manoj Kumar Chandna — grievance@chandnas.com, +91 74120 00999. We check that the request comes from you, and reply within 30 days. Details are in section 7 of our privacy policy.

If someone whose data you store on our services asks you for it, we help you find and export it.

7.Taking your data out

You can download your data at any time. On managed plans we help you export it — files, databases and mailboxes — at no charge.

When a service ends, your data stays available for 30 days, and is then deleted, apart from the records listed in section 5. See our refund and cancellation policy.

8.Changes to this policy

When we change this policy we update the date at the top, and tell customers about significant changes in advance.