Privacy Policy

Trademark Desk is a Legalio product run by Zion Web Services, India. There are two situations, and our role is different in each.

• Practitioners and visitors. For the data of practitioners who sign up, and of people who visit our own website, we decide why and how the data is used. We are the data fiduciary.
• Your clients' data. When a practitioner uses Trademark Desk to serve their clients, the practitioner's firm is the data fiduciary and we act only as its data processor. We use that data on the firm's instructions. See the Data Processing Agreement. If you are a client of a firm, please contact the firm first about your data.

• Account details: name, email address, phone number if you give it, firm name, and your sign-in method (email code or Google).
• Professional details: practice type and your registration, enrolment or membership number, so that we can verify you.
• Billing details: plan, invoices, payment status and the details of your GST registration if you give them. Card and bank details are handled by Razorpay. We do not store them.
• Use of the service: sign-in times, actions in the app, support messages, and technical data such as browser type and IP address, used to keep the service secure and working.

• Information you type into our contact or sign-up forms.
• Basic technical data such as IP address, device and pages visited, used for security and to understand how the site is used.
• Only the cookies or similar storage that are needed to run the site and keep you signed in.

We use your data only for these purposes, and only where you have given consent or the law allows it, such as to perform our contract with you or to comply with a legal duty.

• To create and run your account, verify your credentials and provide the plan you chose.
• To bill you, issue invoices and handle failed payments.
• To send service emails such as sign-up, verification, billing and security notices. We do not send marketing emails.
• To keep the service secure, prevent misuse and meet legal obligations.
• To give support and improve the service.

Firms use Trademark Desk to collect and manage information about their clients, such as names, contact details, business details, trademark details, documents, messages and payment records. The firm decides what is collected and why. We store and process it for the firm, and we do not use it for our own purposes.

Documents are kept in private storage. Links to open a document expire within 10 minutes, and each view or download of a client document is recorded in an audit log. Intake forms show a short notice of what is collected, why and who processes it, and the consent is recorded with a timestamp.

We use the following service providers to run Trademark Desk. They process data only to provide their service to us.

• Clerk for sign-in.
• Resend to send emails.
• Razorpay to collect plan payments. Client payments to a firm are processed through the firm's own Razorpay account.
• Cloudflare for hosting, storage (R2), databases, networking and security.

We do not sell personal data or use it for advertising. We share it only with the providers above, with the firm concerned for its own clients' data, or where the law or a court requires.

• Account data is kept while your account is active.
• After cancellation, practice data is kept for 30 days so that it can be exported, and then deleted. The deletion is logged.
• Invoices and payment records may be kept for longer where tax or other laws require it.
• A firm can export or delete a client's data. Deletion also removes the stored files, unless a legal hold applies.

Under the DPDP Act you have the right to:

• ask for a summary of your personal data and how it is processed (access);
• ask us to correct or complete inaccurate data, and to update it;
• ask us to erase your data when it is no longer needed for the purpose or the law does not require us to keep it;
• have your grievance heard and resolved;
• nominate another person to exercise these rights for you if you die or become unable to do so.

Where we rely on your consent, we ask for it clearly and say what it is for. You can withdraw consent at any time by writing to us. Withdrawing is as easy as giving it. It does not affect what we did before, and if the data is needed to run your account or to meet a legal duty, we will explain what this means for the service.

For clients of a firm, requests to access, correct or erase data, or to withdraw consent, are best sent to the firm. We will help the firm act on them promptly.

No system is perfectly secure, but we take reasonable steps to protect personal data.

• All traffic uses HTTPS.
• Files are stored in private storage and opened only with short-lived signed links.
• Access is limited by role, so staff and clients see only what they need.
• Payment keys are stored encrypted.
• Public forms are protected against bots and abuse.

If we learn of a personal data breach, we will act quickly to contain it. For data we process for a firm, we tell the firm without undue delay with the details it needs, so that it can inform its clients and the Data Protection Board of India. For our own data, we will notify the Board and affected people as the law requires.

Trademark Desk is for professionals and is not meant for children. We do not knowingly collect data of anyone under 18 for our own purposes. If a firm needs to handle a child's data for a matter, the firm is responsible for getting the verifiable consent of a parent or guardian that the law requires.

We use global providers such as Cloudflare, Clerk, Resend and Razorpay, so data may be processed or stored outside India. We transfer it only to the extent the DPDP Act allows, and require our providers to protect it appropriately.

To exercise your rights or raise a concern, write to our grievance officer.

Name: [PENDING: grievance officer name]. Email: [PENDING: grievance officer email]. Address: [PENDING: registered address].

We will acknowledge your message and try to resolve it within a reasonable time. If you are not satisfied, you may complain to the Data Protection Board of India once it is operating.

We will post any changes here with a new date and, for material changes, let account holders know by email or in the dashboard.