Data Privacy Policy

Data Privacy Policy — Lemon Yellow LLP

 

Effective Date: 5-February-2026
Last Updated: Latest Version

 

1. Introduction

 

Lemon Yellow LLP ("Lemon Yellow", "we", "us", "our") is a design and technology services company committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, share, and protect personal data obtained through our website www.lemonyellow.design, our communications, and related services

 

This Policy is designed to comply with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the DPDP Rules, 2025, the Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or
Information) Rules, 2011.

 

By using our website, you ("Data Principal") acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

 

2. Data We Collect

 

We collect the following categories of personal data from your directly, through automated technologies such as cookies, and, where applicable, from third-party service providers or publicly available sources, in accordance with applicable law:

  • Identity & Contact Information: Full name, email address, phone number, companyname, and designation (provided via contact forms, inquiry submissions, or email communications
  • Usage & Technical Data: IP address, browser type, device information, pages visited, and session duration (collected via cookies and analytics tools)
  • Communication Data: Messages, project briefs, or other content you voluntarily share with us
  • Business Information: Information about your organization, industry, and projectrequirements (shared during client onboarding)
  • Financial Information: Invoice details and payment records (applicable to clients only — processed via secure third-party payment gateways)

We do not collect sensitive personal data such as biometric data, health information, financial credentials, or government identification numbers unless explicitly required and consented to.

 

3. Purpose of Data Collection


We process your personal data strictly for the following specified purposes:

 

We will not use your personal data for any purpose other than those specified above without
obtaining fresh consent from you.

 

4. Legal Basis for Processing


Under the DPDP Act, we process your personal data on the following legal bases:

  • Consent: For marketing communications, newsletters, and non-essential cookies
  • Contractual Necessity: For fulfilling service agreements with clients
  • Legitimate Use / Legal Obligation: Where required to comply with applicable laws (e.g., GST compliance, statutory filings)
  • Deemed Consent: In situations involving employment-related data of our staff, or
    where data processing is necessary for a legal or regulatory function

 

5. Data Sharing & Third Parties


We do not sell your personal data. We may share data with trusted third parties only to the extent necessary:

  • Service Providers: Cloud hosting (e.g., AWS, Google Cloud), project management tools (e.g., ClickUp), CRM (e.g., Vtiger), and analytics platforms
  • Payment Processors: Secured third-party gateways for billing purposes
  • Legal Authorities: When required by law, court order, or government mandate
  • Business Transfers: In the event of a merger, acquisition, or restructuringAll third-party processors are bound by data processing agreements ensuring DPDP-equivalent protection for your data.

All third-party processors are bound by data processing agreements ensuring DPDP- equivalent protection for your data.

 

6. Cross-Border Data Transfers


Our service providers may process data in servers located outside India. Such transfers are made only to countries notified as permissible by the Government of India under the DPDP Act, or with appropriate safeguards in place. Where required, we obtain your consent for cross-border transfers.

 

7. Data Retention


We retain your personal data only for as long as necessary to fulfil the purpose for which itwas collected, or as required by applicable law.Upon expiry of the applicable retention period any applicable law or upon the purpose forwhich the personal data was collected being fulfilled, such data shall be securely deleted orirreversibly anonymized from our active systems, unless retention is required to comply with applicable legal or contractual obligations. Where deletion requests are received from you, we shall take reasonable steps to delete such personal data in a timely manner, subject to applicable legal or regulatory requirements. Please note that residual copies of your data may temporarily remain in backup systems aspart of our disaster recovery protocols; however, such data shall not be actively processed and shall be securely deleted or overwritten in accordance with our backup retention cycles. Where applicable, we may confirm completion of deletion upon request.

 

8. Your Rights as a Data Principal


Under the DPDP Act, you have the following rights:

  • Right to Access: Request confirmation of whether we process your data and obtain a summary of such data
  • Right to Correction: Request correction of inaccurate or incomplete personal data
  • Right to Erasure: Request deletion of your personal data, subject to legal retention obligations
  • Right to Grievance Redressal: Raise a complaint with our Grievance Officer and receive a response within 30 days
  • Right to Nominate: Nominate a person to exercise your rights in the event of death or incapacity
  • Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of the above rights, contact us at:

 

9. Consent Management

 

When you first visit our website, you will be presented with a consent notice clearly specifying what data is collected and for what purposes. You may choose to accept or decline non- essential data processing (e.g., marketing cookies). You may also withdraw your consent at any time by contacting us or using the cookie preference centre on our website.

 

10. Security Safeguards

 

We implement reasonable technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These include:

  • SSL/TLS encryption on our website
  • Access controls and authentication for internal systems
  • Regular security reviews and vulnerability assessments
  • Data minimization and pseudonymization where applicable

 

11. Cookies

 

Our website uses cookies to enhance your browsing experience. Cookies may include:

  • Essential Cookies: Required for website functionality (no consent needed)
  • Analytics Cookies: Help us understand how users interact with our website (consent required)
  • Marketing Cookies: Used for retargeting or campaign tracking (consent required)

You can manage your cookie preferences via the banner on your first visit or through your
browser settings.

 

12. Children's Data

 

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. In the event that personal data of a child or a person with disability having a lawful guardian is required to be processed, we will do so only upon obtaining verifiable consent from the parent or lawful guardian, in accordance with applicable law. Parents or guardians have the right to review, correct, or request deletion of such personal data. If you believe that such data has been provided without appropriate consent, please contact us, and we will take prompt steps to delete such information. If we become aware that personal data has been collected without verified parental or guardian consent, we shall take immediate steps to delete such data in compliance with applicable legal requirements.

 


13. Anti Spamming Policy

 

We are committed to ensuring that you do not receive unsolicited communications from us.We will send marketing or promotional communications only where you have expressly consented to receive such information. Each marketing communication will include a clear and effective mechanism to opt out or unsubscribe from future communications. You may also withdraw your consent at any time
by contacting us or using the unsubscribe link provided in such communications. We do not sell, rent, or share your contact information with third parties for their independent marketing purposes without your explicit consent. All communications sent by us shall be
relevant, purpose-driven, and in compliance with applicable anti-spam laws and regulations.

 

14. Grievance Redressal

 

If you have any questions, concerns, or complaints about this Privacy Policy or your personal data, please contact our Grievance Officer:

 

Grievance Officer
Lemon Yellow LLP
Name: Mr. Manoj Kulkarni
Email: [email protected]
Response Time: Within 30 days of receipt

If your grievance is not resolved to your satisfaction, you may escalate to the Data Protection Board of India once it is operationalized.


15. Policy Updates

 

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of significant changes via email or a prominent notice on our website. The "Last Updated" date at the top of this Policy will reflect the most recent revision.

 

16. Governing Law

 

This Policy is governed by and construed in accordance with the laws of India, including the DPDP Act, 2023, the IT Act, 2000, and other applicable regulations. Any disputes arising under this Policy shall be subject to the jurisdiction of courts in Mumbai, Maharashtra.