Privacy Notice
Effective date: 18 April 2026
This Privacy Notice sets out how Corpus Lawyers collects, uses, stores, shares, and protects personal data of visitors to corpuslawyers.in and of persons who correspond with us through the website.
This Notice is issued in compliance with the Digital Personal Data Protection Act 2023 (DPDP Act). It is addressed to every identified or identifiable natural person whose personal data we process (Data Principal).
1. Data Fiduciary identity
Corpus Lawyers is the Data Fiduciary within the meaning of s.2(i) of the DPDP Act for all personal data collected through this website. The practice operates from 148 Lawyers Chambers, Saket Court Complex, New Delhi 110017, and is regulated by the Bar Council of India and the Bar Council of Delhi under the Advocates Act 1961.
All privacy and data-protection correspondence may be directed to mail@corpuslawyers.in.
2. Categories of personal data we collect
2.1 Information you voluntarily provide through the website contact form or through direct email:
- Name
- Email address
- Telephone number (optional)
- The content of your message
- Any other information you choose to include in your message
2.2 Information collected automatically when you visit the website:
- IP address, pseudonymised and hashed after session close
- Browser type and version
- Operating system
- Referring URL
- Pages visited, duration, and navigation path
- Timestamp of visit
- Country, inferred from IP at the country level only
2.3 Consent and interaction records:
- A record of your acceptance of the sitewide Disclaimer, stored in a browser cookie named pum-disclaimer-ack
- A record of your cookie preferences, stored in a banner cookie
- A record of your submission of any contact form, including form identifier, submission identifier, timestamp, a one-way HMAC-SHA-256 hash of your IP address, a one-way HMAC-SHA-256 hash of your user-agent string, and a consent flag
2.4 We do not collect:
- Financial account details
- Government-issued identification numbers
- Biometric data
- Data relating to children, to our knowledge (see clause 11 below)
- Any category of sensitive personal data within the meaning of the DPDP Act, unless you expressly choose to include it in a message you send us
3. Purposes for which we process personal data
We process your personal data only for the following specified purposes (DPDP Act, s.4 read with s.5):
3.1 To respond to your enquiry, complaint, or request submitted through the contact form or by email.
3.2 To establish, conduct, and maintain professional correspondence in accordance with the rules of professional conduct applicable to advocates in India.
3.3 To maintain aggregate website analytics in a form that does not permit re-identification of individual visitors.
3.4 To preserve a tamper-resistant audit trail of consent, for defensibility against future claims under the DPDP Act and the Bar Council of India Rules.
3.5 To ensure the security, availability, and integrity of the website.
3.6 To comply with legal obligations, court orders, regulatory directions, and lawful requests from competent authorities.
We do not use your personal data for direct marketing, behavioural profiling, advertising targeting, or automated decision-making that produces legal effects.
4. Lawful bases for processing
Processing is grounded on one or more of the following lawful bases under the DPDP Act:
4.1 Consent (s.6) when you submit the contact form, accept non-strictly-necessary cookies through the banner, or accept the sitewide Disclaimer.
4.2 Certain legitimate uses (s.7) in particular:
- s.7(a) for the specified purpose for which you voluntarily provided your data, being to receive a response from us;
- s.7(g) for the purposes of responding to a medical emergency or public-order need, where applicable;
- s.7(i) for compliance with any judgment, decree, or order under law, where applicable.
4.3 Compliance with legal obligation where retention or disclosure is required under the Advocates Act 1961, the Bar Council of India Rules, the Limitation Act 1963, the Income-tax Act 1961, or any other statute.
5. Cookies and similar technologies
A detailed account of cookies set on this website, the purpose of each cookie, and the retention period is provided in our Cookie Policy. That Cookie Policy forms an integral part of this Privacy Notice.
In summary, the website sets:
- strictly necessary cookies to remember your Disclaimer acceptance and cookie preferences; these do not require consent;
- one analytics cookie, loaded only after you grant consent through the banner;
- no advertising, tracking, or third-party profiling cookies of any kind.
6. Recipients of personal data
We do not sell, rent, or trade personal data. We disclose personal data only to:
6.1 Our hosting provider (Hostinger) for the operational purposes of hosting the website.
6.2 Google LLC for the limited purpose of generating aggregate analytics through Google Analytics 4, only where you have granted cookie consent. Google acts as a Data Processor to us within the meaning of the DPDP Act.
6.3 Our professional email provider for the operational delivery of correspondence sent to and received from mail@corpuslawyers.in.
6.4 Competent judicial, quasi-judicial, or regulatory authorities where disclosure is required by a valid legal process.
We do not authorise any processor to use your personal data for any purpose other than the purpose for which we have entrusted it, and we require each processor to maintain reasonable security safeguards.
7. Cross-border transfer
Some of the above-named processors operate data centres outside India. Where your personal data is transferred outside India, such transfer is made in reliance on s.16 of the DPDP Act and on the fact that the Central Government has not, as of the date of this Notice, notified any jurisdiction as restricted for cross-border transfer.
If and when the Central Government notifies any restriction under s.16, we will promptly review our processor arrangements and update this Notice.
8. Retention periods
We retain personal data only for so long as is necessary for the specified purpose, and in any event no longer than the periods set out below:
| Data category | Retention period | Anchor |
|---|---|---|
| Contact form submissions | Three years from date of last substantive correspondence | Limitation Act 1963, Art.137 |
| DPDP consent audit log | Three years from date of log entry, auto-purged daily | Limitation Act 1963, Art.137 |
| Google Analytics 4 event data | Fourteen months | GA4 retention setting |
| Cookie banner preference record | 365 days | Cookie refresh cycle |
| Disclaimer acceptance cookie | Two years | Annual revalidation |
| Server access logs | 30 days | Operational security only |
On lapse of the applicable period, personal data is deleted or anonymised.
9. Security safeguards
We maintain reasonable security practices and procedures under s.8(5) of the DPDP Act and Rule 8 of the IT (Reasonable Security Practices) Rules 2011, including:
9.1 TLS 1.2 or higher in transit.
9.2 One-way hashing (HMAC-SHA-256) of IP and user-agent in the DPDP consent audit log, with a year-rotating salt.
9.3 Role-based access control with two-factor authentication on all administrative accounts.
9.4 Nonce-protected administrative actions, including the CSV export of the consent log.
9.5 Security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, HSTS.
9.6 Periodic review of software, themes, and plugins for security updates.
Where a personal data breach occurs and is capable of causing harm to a Data Principal, we will notify the Data Protection Board of India and every affected Data Principal in the manner required under s.8(6) of the DPDP Act.
10. Your rights as a Data Principal
10.1 Right to information (s.11) to obtain a summary of the personal data we are processing and the processing activities undertaken.
10.2 Right to correction and erasure (s.12) to have inaccurate or misleading data corrected, incomplete data completed, data updated, and data no longer necessary erased, subject to any retention required by law.
10.3 Right of grievance redressal (s.13) to raise a grievance with us. We will respond within the period specified by the Central Government; until that period is notified, we will respond within 30 calendar days.
10.4 Right to nominate (s.14) to nominate another natural person who will exercise your rights in the event of your death or incapacity.
You may exercise any of these rights by writing to mail@corpuslawyers.in from the email address associated with your submission.
11. Children data
This website is not directed at children below the age of 18 years. We do not knowingly collect personal data from any person we have reason to believe is a child within the meaning of s.2(f) of the DPDP Act. If you are aware that a child has provided personal data through this website, please notify us at mail@corpuslawyers.in and we will take steps to delete that data in accordance with s.9 of the DPDP Act.
12. No tracking technologies beyond those disclosed
We do not deploy any hidden trackers, device-fingerprinting scripts, session-replay tools, advertising pixels, or behavioural-advertising cookies. The complete list is set out in the Cookie Policy.
13. Amendments to this Notice
We may update this Privacy Notice from time to time. The version in force is the version published on this page as of the Effective date above. Material changes will be accompanied by a prominent notice on the homepage for a reasonable period.
14. Governing law and jurisdiction
This Privacy Notice is governed by the laws of India. Any dispute arising out of or in connection with this Privacy Notice shall be subject to the exclusive jurisdiction of the competent courts and tribunals in Delhi.
15. Contact
Postal address: Corpus Lawyers, 148 Lawyers Chambers, Saket Court Complex, New Delhi 110017, India
Email: mail@corpuslawyers.in
For DPDP Act correspondence, please include DPDP in the subject line. A dedicated Data Protection Officer has not been appointed, as we are not designated a Significant Data Fiduciary under s.10 of the DPDP Act.