This Privacy Policy explains what personal data is collected by India Law Advocates ("we", "us", "our", "Platform") when you visit our website or book a consultation, why we collect it, how we use and share it, and the rights you have over it. By using the Platform, you agree to the practices described in this Policy.
1 Who We Are
India Law Advocates is an online platform that connects individuals and businesses with verified, independent advocates across India. We are a technology intermediary — we are not a law firm and do not ourselves provide legal representation or advice. The advocate you are connected with is an independent professional.
For data protection purposes, we act as the Data Fiduciary under the DPDP Act, 2023 in respect of the personal data you provide to us on the Platform. The connected advocate independently determines how they use information you share with them during the consultation.
2 Data We Collect
We collect only the data necessary to provide our services.
Identity and Contact Data — we collect your name, mobile number, email address, and city to book and confirm your consultation and arrange the advocate's callback. Legal basis: consent under Section 6 of the DPDP Act, 2023.
Case Details — we collect the service type and any brief problem description you choose to share, used solely to match you with the right specialist advocate. Legal basis: consent.
Payment Data — we collect the payment confirmation and Razorpay transaction ID only. We do not store card numbers, CVV, UPI PINs, or net-banking credentials. This data is used to confirm your booking and issue refunds if applicable. Legal basis: contract performance.
Technical Data — we collect your IP address, browser type, device type, pages visited, and session duration via Google Analytics, used to operate and improve the website and detect abuse. Legal basis: legitimate interest and consent.
We do not collect caste, religion, political opinion, biometric data, or any sensitive personal data as defined under the SPDI Rules, 2011 — other than health or financial details you may voluntarily include in your case description.
3 How We Use Your Data
We use your data for the following purposes only. Matching: to connect you with a verified, specialist advocate suited to your specific legal matter. Booking and Payment: to confirm your consultation, process payment via Razorpay, and send booking confirmations by SMS, email, or WhatsApp. Customer Support: to respond to queries, resolve complaints, and process any eligible refunds. Platform Security: to detect, investigate, and prevent fraudulent transactions or misuse of the Platform. Legal Compliance: to comply with applicable Indian law, court orders, or requests from competent government authorities. Service Improvement: to analyse aggregated, anonymised usage patterns — no individual is identified in this analysis.
We will not use your case description or personal data for advertising, profiling, or any purpose not listed above.
4 Consent
We process your personal data on the basis of free, specific, and informed consent which you give by ticking the checkbox before submitting a booking. The checkbox is not pre-ticked. You may withdraw your consent at any time by contacting us at indialawadvocates@gmail.com.
Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal, and does not entitle you to a refund of a completed consultation. Where we rely on contract performance (e.g., processing your payment), withdrawal of consent does not prevent that processing.
5 How We Share Your Data
We share your personal data only with the following parties and only to the extent necessary.
The connected advocate receives your name, contact number, city, and case description so they can call you and advise you. The advocate is bound by professional obligations of confidentiality under the Bar Council of India Rules and the Advocates Act, 1961.
Razorpay Software Private Limited processes your payment securely. Razorpay's own privacy policy governs how they handle your payment data.
Google LLC receives anonymised analytics data via Google Analytics and Google Tag Manager, processed under Google's data processing terms.
Meta Platforms, Inc. — if you visit our site after clicking a Meta (Facebook/Instagram) advertisement, Meta Pixel may record the page visit for advertising attribution. You can opt out via your Facebook ad settings.
Hosting infrastructure — Render (our hosting provider) and GitHub host our site files. Neither has access to your booking or case data.
Law enforcement or courts — where we are legally required to disclose data by court order, government direction, or applicable law.
We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes.
6 Data Retention
We retain your personal data for the following periods. Booking and contact details are kept for 3 years from the date of your last consultation, as required for grievance handling and legal compliance. Payment transaction records are kept for 8 years as required under the Income Tax Act, 1961 and applicable accounting standards. Technical and analytics data is retained for 26 months (Google Analytics default). Data shared in case descriptions is deleted or anonymised within 90 days of your erasure request, subject to any pending legal proceedings or regulatory requirement. After the retention period, data is securely deleted or irreversibly anonymised.
7 Data Security
We implement the following security measures to protect your personal data. All pages use HTTPS encryption — data in transit is encrypted using TLS. Booking data is accessible only to authorised personnel on a need-to-know basis via strict access controls. Card numbers, UPI PINs, and net-banking details are handled entirely by Razorpay and never touch our servers. Content Security Policy (CSP) headers are applied to prevent cross-site scripting and data injection attacks.
No method of transmission over the internet is 100% secure. While we take all reasonable precautions, we cannot guarantee absolute security. In the event of a data breach that is likely to cause harm to you, we will notify you as required under applicable law.
8 Cookies
We use cookies and similar tracking technologies on this Platform. For a full list of cookies used, what they do, how long they last, and how to manage or disable them, please read our Cookie Policy.
In summary: we use essential cookies (required for the site to work), analytics cookies (Google Analytics, with your consent), and advertising cookies (Meta Pixel, where applicable). You can withdraw consent to non-essential cookies at any time.
9 Your Rights Under the DPDP Act, 2023
Under the Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal.
Right to Access Information (Section 11): you may request a summary of the personal data we hold about you, the identities of all Data Fiduciaries and Data Processors with whom it has been shared, and a description of the processing activities.
Right to Correction and Erasure (Section 12): you may request that we correct inaccurate or incomplete personal data, or erase data that is no longer necessary for the purpose for which it was collected, subject to legal retention requirements.
Right to Grievance Redressal (Section 13): you may raise a grievance with our Grievance Officer. If the grievance is not resolved to your satisfaction within the prescribed period, you may escalate to the Data Protection Board of India once constituted.
Right to Nominate (Section 14): you may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
Right to Withdraw Consent (Section 6): you may withdraw the consent you have given at any time. This will not affect prior processing.
To exercise any of these rights, write to our Grievance Officer at the contact details below. We will respond within 30 days of receiving your request.
10 Children's Privacy
The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal data from persons under 18. Under the DPDP Act, 2023, processing of personal data of children requires verifiable parental consent — we do not offer services to children and have no mechanism for such consent. If you believe we have inadvertently collected data of a minor, please contact us immediately and we will delete it.
11 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Policy periodically. Continued use of the Platform after a change constitutes acceptance of the updated Policy.
12 Grievance Officer & Contact
For any questions about this Policy, to exercise your rights, or to raise a privacy grievance, contact our designated Grievance Officer at indialawadvocates@gmail.com. We aim to acknowledge all grievances within 48 hours and resolve them within 30 days, as required under the DPDP Act, 2023.
The DPDP Act, 2023 implementing rules are yet to be finalised by the Government of India. This Policy reflects our current good-faith compliance with the Act and existing IT Rules, 2011. It will be updated as implementing rules are notified.
← Back to Home · Cookie Policy · Terms & Conditions · Refund Policy · Contact Us