Digital Personal Data Protection Act, 2023
1.1This Privacy Policy and Notice (“Policy”) is issued by Eagle Law & Integrity - Law Offices of Kanchan Talreja & Associates, having its office at 204/205, Dalamal Chambers, 29, New Marine Lines, Mumbai 400020, Maharashtra, India (the “Firm”, “we”, “us” or “our”). For the purposes of this Policy, the Firm is the Data Fiduciary in respect of personal data processed through the website https://eaglelawandintegrity.com (the “Website”) and in the course of its practice.
1.2This Policy is the notice required under Section 5 of the Digital Personal Data Protection Act, 2023 (the “Act”) and Rule 3 of the Digital Personal Data Protection Rules, 2025 (the “Rules”). It explains what personal data we process, why we process it, how you can exercise your rights, and how you can make a complaint to the Data Protection Board of India (the “Board”).
1.3Until the relevant provisions of the Act and Rules come into force in full, the Firm shall also comply with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable.
2.1This Policy applies to digital personal data, and to personal data collected in non-digital form and subsequently digitised, of the following persons (each a “Data Principal” or “you”):
2.2Terms such as “personal data”, “processing”, “consent”, “Data Fiduciary”, “Data Principal”, “Data Processor”, “Consent Manager” and “personal data breach” have the meanings given to them in Section 2 of the Act.
3.1The table below is an itemised description of the personal data we process:
| Category | Personal data | Source |
|---|---|---|
| Website access registration | Email address; date and time of acceptance of the disclaimer | You, via the disclaimer screen |
| Identity and contact | Name, email address, mobile number, city and country of residence | You, via forms, email, telephone or WhatsApp |
| Enquiry details | Nature of legal issue, brief description of the matter, preferred language, preferred date and time for consultation | You |
| Engagement and KYC | Address, identity and address proof (such as PAN or Aadhaar, with Aadhaar number masked where possible), passport details for NRI clients, signature, photograph where required for filings | You, upon engagement |
| Matter information | Documents, facts, correspondence and records relating to your matter, which may include information about family, property, finances, health or proceedings | You, and third parties, courts and public records in connection with the matter |
| Payment and billing | Name, billing address, GSTIN (if any), transaction reference; card or bank details are handled by the payment provider and not stored by us | You and Razorpay |
| Technical and usage | IP address, device and browser type, pages visited, referring page, cookie identifiers, approximate location | Automatically, via cookies and tools such as Google Tag Manager |
| Communications | Content of emails, WhatsApp messages and call records exchanged with the Firm | You |
3.2We do not seek any personal data that is not necessary for the purposes set out in Clause 4. Please share information about third parties only where you are lawfully permitted to do so.
4.1We process personal data only for the following specified purposes and on the lawful basis indicated:
| Purpose | Personal data used | Lawful basis under the Act |
|---|---|---|
| Providing access to the Website and recording your acceptance of the Bar Council of India disclaimer | Website access registration, technical data | Consent (Section 6) |
| Responding to your enquiry and scheduling a consultation | Identity and contact, enquiry details, communications | Consent (Section 6); personal data voluntarily provided for that purpose (Section 7(a)) |
| Conflict check before accepting any engagement | Name, names of counterparties, nature of matter | Consent; compliance with professional obligations under the Advocates Act, 1961 and Bar Council of India Rules (Section 7(d)) |
| Rendering legal services, representation, advice and filings | Engagement, KYC and matter information | Consent; processing necessary for enforcing legal rights or claims (Section 17(1)(a)) |
| Billing, accounting, tax and statutory record-keeping | Payment and billing data | Consent; compliance with law including the Income-tax Act, 1961 and GST laws (Section 7(d)) |
| Complying with court orders, judgments and lawful requests of authorities | As required by the order or request | Section 7(d) and 7(e) |
| Website security, fraud prevention and improvement; anonymised usage analytics | Technical and usage data | Consent through the cookie banner for non-essential cookies; strictly necessary cookies for security and functioning |
4.2We do not sell personal data, and we do not use your personal data for profiling, automated decision-making or third-party advertising.
4.3If we intend to process your personal data for a purpose that is not covered above, we will give you a fresh notice and, where required, seek your consent.
5.1Where processing is based on consent, your consent shall be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action such as ticking an unchecked box or clicking “I Agree”, and limited to the personal data necessary for the specified purpose.
5.2You may withdraw your consent at any time, with the same ease with which it was given, by writing to kanchan [at] eaglelawandintegrity.com with the subject “Withdrawal of Consent”, or by using the link provided in any email we send you. You may also use the request form below. Withdrawal will not affect the lawfulness of processing done before withdrawal.
5.3Upon withdrawal, we shall, within a reasonable time, cease processing and cause our Data Processors to cease processing your personal data, unless retention is required or permitted by law or processing continues on another lawful basis (for example, statutory record-keeping or the conduct of pending proceedings). Where you withdraw consent during an ongoing engagement, the Firm may be unable to continue rendering services, and the consequences shall be governed by the terms of engagement.
5.4You may also give, manage, review or withdraw consent through a Consent Manager registered with the Board, once that facility becomes operational.
6.1Information received in the course of a professional engagement is held in strict confidence in accordance with the Bar Council of India Rules and Sections 132 to 134 of the Bharatiya Sakshya Adhiniyam, 2023.
6.2Under Section 17(1)(a) of the Act, certain provisions of the Act (including those relating to notice, consent and certain rights of Data Principals) do not apply where processing is necessary for enforcing any legal right or claim. Personal data of counterparties, witnesses and other persons processed for this purpose may accordingly be processed without notice or consent, and requests for access, correction or erasure of such data may be declined where compliance would prejudice a legal right or claim or breach professional privilege. The Firm shall nevertheless protect all such data with reasonable security safeguards as required by Section 8(5) of the Act.
7.1The Website is not directed at persons below 18 years of age. We do not knowingly collect personal data of a child except through, and with the verifiable consent of, the child’s parent or lawful guardian, as required by Section 9 of the Act and Rule 10 of the Rules. Where a matter concerns a child (for example, custody or maintenance), the child’s personal data is processed with the consent of the parent or lawful guardian, or as necessary for enforcing legal rights or claims.
7.2We do not undertake tracking, behavioural monitoring or targeted advertising directed at children. Where the Data Principal is a person with disability who has a lawful guardian, consent shall be obtained from such guardian after verification.
10.1Some of our Data Processors may store or process data on servers located outside India, and communications with NRI clients and foreign counsel necessarily involve transfer of personal data outside India. Such transfers are made in accordance with Section 16 of the Act and shall not be made to any country or territory restricted by the Central Government by notification.
11.1We retain personal data only for as long as necessary for the purpose for which it was collected, or as required under applicable law, after which it is erased unless its retention is required for compliance with law. Indicative periods are:
| Data | Retention period |
|---|---|
| Website access registration and enquiries that do not result in engagement | 12 months from last interaction, unless you withdraw consent earlier |
| Client matter files and engagement records | Duration of the matter and thereafter 8 years, having regard to limitation periods, professional obligations and possible claims |
| Billing and accounting records | As required under tax and GST laws (generally 8 years) |
| Server and access logs, and personal data processed for security purposes | At least one year, as required under Rule 6 of the Rules |
| Cookie data | As set out in the cookie banner, subject to your preferences |
11.2Original documents entrusted to the Firm shall be returned to the client at the conclusion of the matter or on request, subject to the terms of engagement.
12.1In accordance with Section 8(5) of the Act and Rule 6 of the Rules, we take reasonable security safeguards to prevent personal data breach, including:
13.1In the event of a personal data breach, the Firm shall, in accordance with Section 8(6) of the Act and Rule 7 of the Rules:
14.1Subject to Clause 6.2 and applicable law, you have the following rights under Chapter III of the Act:
14.2How to exercise your rights: use the Data Principal Request Form below, or write to kanchan [at] eaglelawandintegrity.com or to the address in Clause 16, stating your name, contact details and the right you wish to exercise. We may ask for information reasonably necessary to verify your identity before acting on a request.
14.3We shall respond to requests and grievances within a reasonable period, and in any event within ninety days of receipt or such shorter period as may be prescribed.
15.1Under Section 15 of the Act, while exercising your rights you shall comply with applicable law, not impersonate another person, not suppress any material information while providing your personal data, not register a false or frivolous grievance or complaint, and furnish only verifiably authentic information when seeking correction or erasure. Breach of these duties may attract a penalty of up to Rs. 10,000 under the Act.
16.1In accordance with Section 8(9) of the Act, questions about the processing of your personal data may be addressed to:
16.2This person also acts as the Grievance Officer for the purposes of the Information Technology Act, 2000 and the rules made thereunder.
17.1If you are not satisfied with our response to your grievance, or if we do not respond within the period stated in Clause 14.3, you may file a complaint with the Data Protection Board of India in the manner prescribed under the Act and the Rules, through the digital platform provided by the Board. As required by Section 13(3) of the Act, you must first exhaust the grievance redressal mechanism with the Firm before approaching the Board.
18.1This Policy is available in English. On request to the contact person in Clause 16, we shall provide it in any language specified in the Eighth Schedule to the Constitution of India, including Hindi, Marathi and Gujarati.
19.1We may update this Policy to reflect changes in law or our practices. The updated Policy will be posted on the Website with a revised “Last updated” date. Where changes materially affect the purposes of processing based on consent, we will give you notice and, where required, seek fresh consent.
20.1This Policy is governed by the laws of India, including the Act and the Rules. Subject to the jurisdiction of the Board under the Act, the courts at Mumbai shall have jurisdiction.
To: The Contact Person for Data Protection, Eagle Law & Integrity, 204/205, Dalamal Chambers, 29, New Marine Lines, Mumbai 400020. Use this form to access, correct, complete, update or erase your personal data, withdraw consent, nominate a person, or raise a grievance. We respond within ninety days (Clause 14.3).
Thank you. Your request has been received.
It has been sent to our Contact Person for Data Protection. We may contact you to verify your identity, and we will respond within ninety days of receipt.