Grievance Redressal Mechanism

The purpose of this mechanism is to provide a structured process for:

• Receiving grievances.
• Acknowledging them.
• Examining the relevant facts and records.
• Obtaining further information where required.
• Taking appropriate corrective or remedial action.
• Communicating the outcome.
• Escalating the matter internally where the complainant remains dissatisfied.

SPIN seeks to handle grievances fairly, objectively, confidentially and within reasonable timelines.

A grievance may be raised by:

• A customer or former customer.
• A prospective customer whose matter has been considered by SPIN.
• A Data Principal whose personal data is processed by SPIN.
• An authorised representative of a customer or Data Principal.
• An authorised representative of an organisation.
• Another person directly affected by the matter forming the subject of the grievance.

SPIN may request reasonable information or documentation to verify the identity, relationship or authority of the person raising the grievance.

A grievance may relate to matters including:

• Service Delivery: Concerns regarding service administration, timelines, communication, coordination or performance of an agreed service.
• Investigator or Forensic Specialist Conduct: Concerns regarding the professional conduct of an independent investigator or forensic specialist assigned through SPIN.
• Scope of Engagement: Concerns regarding whether the work undertaken was consistent with the agreed scope, authority or engagement requirements.
• Quality of Deliverables: Concerns regarding investigation reports, assessments, forensic outputs, monitoring outputs or other agreed deliverables.
• Confidentiality: Concerns regarding access to, handling, disclosure or protection of confidential customer or case information.
• Privacy and Personal Data: Concerns regarding the collection, use, disclosure, retention, security, correction, erasure or other processing of personal data.
• Digital Evidence: Concerns regarding the preservation, transfer, examination, access, documentation, integrity or handling of digital evidence.
• Conflict of Interest: Concerns regarding an actual or potential conflict involving an investigator, forensic specialist or another person connected with the engagement.
• Billing or Commercial Administration: Concerns regarding invoices, charges, payments or other agreed commercial matters.
• Other Relevant Matters: Any other reasonable concern arising directly from SPIN's services, operations or interaction with the complainant.

The grievance mechanism may be used to raise concerns relating to the process, scope, methodology, professional conduct, evidence handling or quality of work associated with an investigation or forensic examination.

However, disagreement with an independent technical finding or professional opinion does not, by itself, require that finding or opinion to be changed.

Where a grievance concerns a technical or forensic finding, SPIN may consider:

• Whether the agreed scope was followed.
• Whether relevant information or evidence was considered.
• Whether appropriate professional or forensic practices were followed.
• Whether material limitations were appropriately identified and documented.
• Whether the findings were presented clearly and independently.

The professional independence of the investigator or forensic specialist will be preserved throughout the grievance process.

A grievance may be submitted through SPIN's designated Grievance Submission Form.

Alternatively, a grievance may be submitted to:

Level 1 – Grievance Officer

Grievance Officer: Mr. Gaurav Banerjee

Designation: Director – Operations and Compliance

Email: contact@spyeye.org

Where applicable, the grievance should contain:

• Name and contact details of the complainant.
• Relevant case, engagement or reference number.
• Nature of the grievance.
• Relevant dates.
• A clear description of the concern.
• Supporting information or documentation, where relevant.
• The resolution or assistance sought.

The complainant should not submit passwords, OTPs, private keys, seed phrases or other access credentials.

Highly sensitive evidence should not be submitted through the Grievance Submission Form. Where such evidence is required, SPIN will request it separately in accordance with its applicable evidence- handling, confidentiality and data-protection policies and procedures.

SPIN will seek to acknowledge receipt of a grievance within seventy-two (72) hours.

The acknowledgement may include:

• A grievance or reference number.
• Confirmation that the grievance has been received.
• The contact point handling the grievance.
• A request for further information, where required.

Acknowledgement of a grievance does not constitute acceptance of the allegations or determination of the grievance in favour of the complainant.

Depending on the nature of the grievance, SPIN may:

• Review applicable case or engagement records.
• Review the agreed scope of work.
• Examine relevant communications.
• Review applicable case-management records.
• Obtain information from the assigned investigator or forensic specialist.
• Examine evidence-handling or access records where relevant.
• Seek clarification or additional information from the complainant.
• Consult appropriate technical, privacy, legal, financial or professional personnel.
• Undertake another reasonable review necessary to understand and address the grievance.

Access to grievance-related information would be limited to persons reasonably requiring such access for review or resolution.

Where a grievance concerns an independent investigator or forensic specialist, SPIN may:

• Notify the specialist of the relevant concerns.
• Obtain their response.
• Review compliance with the agreed scope.
• Review applicable professional, confidentiality and evidence-handling requirements.
• Assess any alleged conflict of interest.
• Determine whether corrective, contractual, supervisory or empanelment-related action is appropriate.

Where necessary to protect the customer, evidence, confidentiality or integrity of an engagement, SPIN may implement reasonable interim safeguards while the grievance is under review.

Such review will not be used to compromise the independent professional judgement of the specialist.

A Data Principal may raise a grievance concerning SPIN's processing of their Personal Data.

This may include concerns relating to:

• Information regarding the processing of Personal Data.
• Correction, completion or updating.
• Erasure; where applicable.
• Withdrawal of Consent; where applicable.
• Unauthorised or inappropriate disclosure.
• Security of Personal Data.
• Retention of Personal Data.
• Exercise of applicable Privacy Rights.
• Any other acts or omission relating to SPIN's data-protection obligations.

Such grievances will be handled together with the requirements of SPIN's Privacy Policy and applicable data-protection law.

For matters concerning Personal Data:

Data Protection Officer: Mr. Gaurav Banerjee

Designation: Director – Operations and Compliance

Email: contact@spyeye.org

It shall be noted that the same grievance may involve both SPIN's general grievance mechanism and its privacy or data-protection responsibilities.

A grievance may itself contain confidential, personal, evidentiary or otherwise sensitive information.

SPIN will seek to handle such information using appropriate measures, which may include:

• Restricted access.
• Need-to-know access.
• Minimum-necessary disclosure.
• Controlled transfer.
• Confidentiality safeguards.
• Additional handling controls for particularly sensitive cases.

Information may nevertheless be disclosed where authorised, contractually agreed, legally required or otherwise permitted by applicable law.

SPIN will seek to resolve grievances within thirty (30) calendar days from the date of receipt.

Where additional information or documentation is required, SPIN may request it from the complainant.

The complainant should provide requested information within a reasonable period so that the grievance can be examined effectively.

Where applicable law prescribes a different mandatory period for a particular category of grievance, the applicable statutory requirement will prevail.

For privacy grievances, SPIN will also comply with applicable grievance-redressal requirements under data-protection law from the date on which those requirements become legally applicable.

Depending on the nature and findings of the grievance review, SPIN may take one or more appropriate actions, including:

• Providing clarification or explanation.
• Correcting an administrative error.
• Providing pending information.
• Taking corrective action relating to service administration.
• Implementing corrective or preventive process measures.
• Conducting an additional quality review.
• Taking appropriate action relating to an investigator or forensic specialist.
• Reassigning a matter; where justified and feasible.
• Correcting or updating applicable Personal Data.
• Undertaking appropriate privacy or security remediation.
• Making an appropriate billing or commercial adjustment.
• Referring the matter to another appropriate function or authority.
• Closing the grievance where no further action is considered necessary.

The remedy, if any, will depend upon the circumstances of the grievance and the applicable contractual, professional, legal and technical requirements.

Once the grievance has been reviewed, SPIN will communicate the outcome to the complainant.

The response may include, as appropriate:

• A summary of the grievance considered.
• The outcome of the review.
• Action taken or proposed.
• Relevant reasons or explanation.
• The available internal escalation route.

SPIN may withhold information that cannot appropriately be disclosed because it is confidential, legally privileged, security-sensitive, related to another person's privacy, commercially sensitive, restricted by law or otherwise inappropriate to disclose.

Where the complainant remains dissatisfied after receiving the Level 1 response, the grievance may be escalated to SPIN's Nodal Officer.

Level 2 – Nodal Officer

Nodal Officer: Mr. P. Ramesh Babu

Designation: Founder and Chairman

Email: contact@spyeye.org

The escalation request should preferably:

• Quote the original grievance reference.
• Identify the aspect of the Level 1 response being disputed.
• Explain why the complainant remains dissatisfied.
• Provide any additional relevant information.

The Level 2 review may examine both the grievance and the manner in which it was considered at Level 1.

Where reasonably practicable, the Level 2 review would provide an independent internal review of the earlier determination.

Following the Level 2 review, SPIN may:

* Uphold the Level 1 outcome.

• Modify the earlier outcome.
• Require additional review.
• Direct appropriate corrective or remedial action.
• Refer a technical matter for additional professional consideration.
• Direct appropriate privacy, administrative or governance action.
• Close the grievance with reasons.

The complainant will be informed of the outcome of the internal escalation.

SPIN's internal grievance mechanism does not remove or restrict any remedy or right available under applicable law.

After following the internal grievance process, a complainant may pursue such statutory, regulatory, judicial or other remedy as may lawfully apply to the particular grievance.

For grievances relating to Personal Data, any statutory right to approach the Data Protection Board of India or another competent authority will remain subject to the applicable requirements of data- protection law, including any requirement to first exhaust SPIN's grievance-redressal mechanism.

For other grievances, the appropriate external remedy will depend upon:

• The nature of the dispute.
• Applicable legislation.
• The contractual relationship.
• The relief sought.
• The jurisdiction of the relevant authority, court, tribunal or other forum.

Nothing in this mechanism is intended to confer jurisdiction upon any authority, court, tribunal or forum where such jurisdiction does not otherwise exist under applicable law.

Applicable dispute-resolution and jurisdiction provisions contained in SPIN's Terms of Service or engagement-specific documentation will continue to apply, subject to mandatory legal requirements.

The grievance mechanism is not an emergency-response channel.

Where a matter involves:

• Immediate danger to a person,
• A serious offence that is actively unfolding,
• Financial fraud that is actively occurring,
• Unauthorised banking, payment or fund-transfer activity that is currently in progress,
• Threats involving a child,
• Another situation requiring urgent statutory or institutional intervention,

the appropriate bank, payment provider, platform, law-enforcement agency, emergency service or competent authority should be contacted without waiting for SPIN's grievance process.

Grievances should be raised in good faith and using information that is accurate to the best of the complainant's knowledge.

SPIN may appropriately manage grievances that are:

• Knowingly false.
• Fraudulent.
• Repetitive without materially new information.
• Abusive or threatening.
• Intended to harass an investigator, specialist, employee or another person.
• Unrelated to SPIN's services or obligations.

This provision will not be used to discourage legitimate complaints, privacy requests or good-faith disagreement.

SPIN may process and retain personal data reasonably required for:

• Receiving and administering grievances.
• Verifying the complainant's identity or authority.
• Examining the grievance.
• Communicating with relevant persons.
• Documenting the outcome.
• Internal escalation.
• Quality assurance.
• Compliance.
• Dispute management.
• Establishment, exercise or defence of legal claims.

Such information will be handled in accordance with SPIN's Privacy Policy, applicable data-protection requirements and relevant data-retention requirements.

SPIN may review grievance trends and outcomes for purposes including:

• Identifying recurring service issues.
• Improving operating processes.
• Identifying training requirements.
• Addressing quality concerns.
• Strengthening confidentiality, privacy or security controls.
• Improving investigator governance.
• Improving customer experience.

Such review should be undertaken without unnecessary disclosure of customer, case or personal information.

Where appropriate, corrective and preventive actions may be implemented.

SPIN may update this Grievance Redressal Mechanism to reflect:

• Changes in applicable law or regulation.
• Changes in SPIN's services.
• Changes in organisational or governance arrangements.
• Changes in grievance-handling requirements.
• Improvements to its processes.

The updated version will be published on the SPIN website together with the revised Last Updated date.

Spy Eye Intelligence Network LLP (SPIN)

Registered Office: Rajahmundry, Andhra Pradesh, India

Email: contact@spyeye.org

Phone: +91 877 762 8651

Level 1 – Grievance Officer

Mr. Gaurav Banerjee

Director – Operations and Compliance

contact@spyeye.org

Privacy / Personal Data Matters

Data Protection Officer: Mr. Gaurav Banerjee

Director – Operations and Compliance

contact@spyeye.org

Level 2 – Nodal Officer

Mr. P. Ramesh Babu

Founder and Chairman

contact@spyeye.org