Privacy Policy

Scope of this notice

This notice explains how Jhunjhunwala Legal (“the firm”, “we”) handles personal data collected through www.jhunjhunwalalegal.com. It covers the website only.

Personal data you give us in the course of an engagement — instructions, documents, correspondence and matter records — is governed by our engagement terms and by the professional obligations of confidentiality and privilege that apply to advocates in India. Those obligations are stricter than this notice and are not displaced by it.

The firm is the data fiduciary for the information described here. Our contact details, including those of the person who handles privacy queries, are set out at the end of this notice.

Information we collect

Information you provide deliberately

The enquiry form on our contact page asks for your first name, last name, email address, telephone number, organisation, the area of law your query concerns, and a description of what you would like help with. Only the first name, email address and description are required; the remaining fields exist because they usually shorten our first reply.

If you write to us by email, telephone us, or apply for a role advertised on our careers page, we hold what you send — including any attachments, curriculum vitae, or documents you choose to share.

Information collected automatically

Our hosting provider records standard server logs for every request: the IP address, the date and time, the page requested, the referring page where one is sent, and the browser and operating system reported by your device. These logs exist for security and fault diagnosis.

We also use a privacy-oriented analytics measure that reports aggregate page views, approximate country, referral source and device category. It does not build a profile of you, follow you across other websites, or attempt to identify you.

What we do not collect

• We do not ask for, and would prefer you did not send, financial account details, government identifiers, or health information through the website.
• We do not buy personal data from third parties, and we do not sell, rent or licence yours to anyone.
• We do not run advertising or retargeting pixels, and we do not track you for marketing purposes.

Please do not use the website to send us confidential or privileged material about a live dispute. Until we have confirmed that we are able to act — which requires a conflicts check — such material is not protected by the professional privilege that would otherwise attach to it.

Why we use it

We use the information described above for the following purposes, and no others:

• To respond to you. To identify which of our lawyers should read your enquiry, to reply to it, and to arrange a consultation where one is appropriate.
• To carry out conflicts and eligibility checks. Before the firm can act on any matter we must confirm that we do not already act against the interests of a party involved.
• To keep a record of professional correspondence. Enquiries we decline are recorded so that we can explain, if it is ever asked, what we were told and what we said in reply.
• To maintain and secure the website. To diagnose errors, to understand which pages are read, and to detect abuse or attempted intrusion.
• To meet legal and regulatory obligations. Including any obligation to retain records or to respond to a lawful order of a court or competent authority.

We do not send marketing emails. The Bar Council of India’s rules prohibit an advocate from soliciting work, and we treat your contact details accordingly: they are used to answer you, not to approach you.

Lawful basis for processing

Under the Digital Personal Data Protection Act, 2023 (“the DPDP Act”) personal data may be processed for a lawful purpose for which you have given consent, or for certain legitimate uses specified in the Act. We rely on both, as follows.

• Consent. When you submit the enquiry form or write to us, you do so voluntarily and for the specific purpose of obtaining a response. That is the basis on which we process what you send. Consent given for this purpose may be withdrawn at any time; see Your rights below.
• Voluntary provision for a specified purpose. Where you provide details to us for a purpose you have identified and have not indicated that you object to their use for that purpose, we may process them for it — for example, acting on a request to call you back.
• Compliance with law. Where retention or disclosure is required by a statute, a judgment, a decree, or an order of a court, tribunal or regulator.

Server logs and aggregate analytics do not, in the ordinary course, identify you. Where such data can be linked to an identifiable individual, we treat it under this notice on the same terms as anything else.

How long we keep it

• Enquiries that do not become engagements: retained for three years from the date of the last correspondence, then deleted. This period reflects the limitation window within which a question about the advice we gave, or declined to give, could still arise.
• Enquiries that become engagements: merged into the matter file and retained under our engagement terms and the record-keeping obligations that apply to the practice.
• Recruitment applications: retained for twelve months from the date of the decision unless you ask us to keep them on file for longer.
• Server logs: retained for ninety days.
• Aggregate analytics: retained indefinitely in aggregate form, which does not identify individuals.

Where the DPDP Act or any rule made under it requires erasure at an earlier point, that requirement prevails over the periods above.

Who we share it with

We share personal data only where it is necessary, and only with the following categories of recipient:

• Lawyers and staff of the firm who need it to consider or act on your matter.
• Service providers acting as data processors — our website host, email provider and document storage provider. Each is engaged under contractual terms that restrict them to processing on our instructions and require appropriate security measures.
• Counsel, experts, or co-counsel instructed on a matter, where you have engaged us and such instruction is part of the work.
• Courts, tribunals, regulators and other authorities where disclosure is compelled by law or is necessary to establish, exercise or defend a legal claim.

Some of these providers operate infrastructure outside India. Where personal data is processed outside India, it is transferred only to countries not restricted for that purpose by the Central Government under the DPDP Act, and only under contractual terms that hold the provider to the standards described in this notice.

How we protect it

The website is served only over HTTPS. Access to enquiry records and matter files is restricted to the people within the firm who need it, protected by individual accounts and multi-factor authentication, and reviewed periodically. Devices used for firm work are encrypted at rest.

Everyone at the firm — including interns and administrative staff — is bound by written confidentiality obligations that survive the end of their association with us.

If a personal data breach occurs that affects you, we will notify the Data Protection Board of India and the affected individuals in the manner and within the time required under the DPDP Act and the rules made under it. No system is beyond compromise, and we do not claim otherwise; what we undertake is to tell you promptly and honestly if something goes wrong.

Your rights as a data principal

The DPDP Act gives you the following rights in respect of personal data we hold about you. You may exercise any of them by writing to us at the address in the final section.

• Right to information. To obtain a summary of the personal data we hold about you, the processing activities undertaken with it, and the identities of other data fiduciaries and processors with whom it has been shared.
• Right to correction and erasure. To have inaccurate or misleading data corrected, incomplete data completed, data updated, and data erased where it is no longer necessary for the purpose it was collected for and no legal obligation requires us to keep it.
• Right to withdraw consent. To withdraw consent as easily as it was given. Withdrawal stops future processing that relied on that consent; it does not undo processing already carried out, and it does not affect retention required by law.
• Right to grievance redressal. To complain to us about how we have handled your data or a request, before approaching the Data Protection Board of India.
• Right to nominate. To nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

We acknowledge requests within three working days and answer them substantively within thirty days. Where we need to verify that a request comes from you, we will ask for whatever is proportionate to establish that and nothing more. If we decline a request, we will tell you why, and we will tell you how to escalate it.

Two duties also sit with you under the Act: requests must be made in good faith, and the information you give us in support of one must be authentic. Frivolous or false complaints are subject to penalty under the Act.

Cookies and similar technologies

This website sets no advertising, profiling or cross-site tracking cookies. What it does store on your device is limited to the following:

• A disclaimer acknowledgement. When you accept the Bar Council of India notice shown on your first visit, we record that acceptance in your browser’s local storage so that it is not shown again. It contains a single value and no identifier.
• Strictly necessary operational storage. Short-lived values used to serve the site correctly, including protection against cross-site request forgery.

You can clear local storage and cookies at any time through your browser settings. Doing so will cause the first-visit disclaimer to appear again. Our analytics measure does not rely on a cookie and is not affected.

Children and persons under guardianship

The website is intended for adults seeking legal assistance and is not directed at children. We do not knowingly collect personal data of a child through it, and we do not undertake any tracking, behavioural monitoring or targeted advertising directed at children — all of which the DPDP Act prohibits.

Where a matter genuinely concerns a child or a person with a disability who has a lawful guardian, we take instructions from the parent or guardian and obtain verifiable consent from them before processing the individual’s personal data. If you believe a child has sent us personal data through this website, please write to us and we will delete it.

Changes to this notice

We revise this notice when our practice changes or when the law does. The date at the top of the page is the date of the version you are reading. Where a change materially affects how we use personal data already collected, we will place a notice on this page and, where we hold your contact details for the purpose, write to you.

Contacting us

Privacy queries, data-principal requests and grievances should be addressed to the partner responsible for data protection at the firm:

• Jhunjhunwala Legal
• 21 Commercial Street, Kolkata 700 001, India
• Email: info@jhunjhunwalalegal.com
• Telephone: +91 33 4000 1290
• Office hours: 09:00 – 18:00, Monday to Saturday

If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner prescribed under the Digital Personal Data Protection Act, 2023.