Last updated: 19th October 2026
1. Who I Am
1.1 This Privacy Policy and Notice ("Policy") is issued by Adv. Kanchan Talreja, an advocate practising in an individual capacity, having my office at 205, Dalamal Chambers, 29, New Marine Lines, Mumbai 400 020 ("AKT", "I", "me" or "my"). AKT is an individual and not a company, LLP, partnership firm or other juristic entity, and references to AKT, I, me or my are to Adv. Kanchan Talreja personally. For the purposes of this Policy, I am the Data Fiduciary in respect of personal data processed through the website advkanchantalreja.com (the "Website") and in the course of my practice.
1.2 This Policy is the notice required under Section 5 of the Digital Personal Data Protection Act, 2023 (the "Act") and Rule 3 of the Digital Personal Data Protection Rules, 2025 (the "Rules"). It explains what personal data I process, why I process it, how you can exercise your rights, and how you can make a complaint to the Data Protection Board of India (the "Board").
1.3 Until the relevant provisions of the Act and Rules come into force in full, I shall also comply with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable.
2. Scope
2.1 This Policy applies to digital personal data, and to personal data collected in non-digital form and subsequently digitised, of the following persons (each a "Data Principal" or "you"):
- visitors to the Website, including persons who register their email address on the disclaimer screen to access the Website or virtual office;
- persons who submit an enquiry, book a consultation or contact me by telephone, email or WhatsApp;
- prospective clients and clients of AKT; and
- other persons whose personal data I receive in connection with a matter, such as family members, witnesses, counterparties and their representatives.
2.2 Terms such as "personal data", "processing", "consent", "Data Fiduciary", "Data Principal", "Data Processor", "Consent Manager" and "personal data breach" have the meanings given to them in Section 2 of the Act.
3. Personal Data I Process
3.1 The table below is an itemised description of the personal data I process:
| Category | Personal data | Source |
|---|---|---|
| Website access registration | Email address; date, time and IP address of acceptance of the disclaimer | You, via the disclaimer screen |
| Identity and contact | Name, email address, mobile number, city and country of residence | You, via forms, email, telephone or WhatsApp |
| Enquiry details | Nature of legal issue, brief description of the matter, preferred language, preferred date and time for consultation | You |
| Engagement and KYC | Address, identity and address proof (such as PAN or Aadhaar, with Aadhaar number masked where possible), passport details for NRI clients, signature, photograph where required for filings | You, upon engagement |
| Matter information | Documents, facts, correspondence and records relating to your matter, which may include information about family, property, finances, health or proceedings | You, and third parties, courts and public records in connection with the matter |
| Payment and billing | Name, billing address, GSTIN (if any), transaction reference; card or bank details are handled by the payment provider and not stored by me | You and Razorpay |
| Technical and usage | IP address, device and browser type, pages visited, referring page, cookie identifiers, approximate location | Automatically, via cookies and tools such as Google Tag Manager |
| Communications | Content of emails, WhatsApp messages and call records exchanged with AKT | You |
3.2 I do not seek any personal data that is not necessary for the purposes set out in Clause 4. Please share information about third parties only where you are lawfully permitted to do so.
4. Purposes of Processing and Lawful Basis
4.1 I process personal data only for the following specified purposes and on the lawful basis indicated:
| Purpose | Personal data used | Lawful basis under the Act |
|---|---|---|
| Providing access to the Website and recording your acceptance of the Bar Council of India disclaimer | Website access registration, technical data | Consent (Section 6) |
| Responding to your enquiry and scheduling a consultation | Identity and contact, enquiry details, communications | Consent (Section 6); personal data voluntarily provided for that purpose (Section 7(a)) |
| Conflict check before accepting any engagement | Name, names of counterparties, nature of matter | Consent; compliance with professional obligations under the Advocates Act, 1961 and Bar Council of India Rules (Section 7(d)) |
| Rendering legal services, representation, advice and filings | Engagement, KYC and matter information | Consent; processing necessary for enforcing legal rights or claims (Section 17(1)(a)) |
| Billing, accounting, tax and statutory record-keeping | Payment and billing data | Consent; compliance with law including the Income-tax Act, 1961 and GST laws (Section 7(d)) |
| Complying with court orders, judgments and lawful requests of authorities | As required by the order or request | Section 7(d) and 7(e) |
| Website security, fraud prevention and improvement; anonymised usage analytics | Technical and usage data | Consent through the cookie banner for non-essential cookies; strictly necessary cookies for security and functioning |
4.2 I do not sell personal data, and I do not use your personal data for profiling, automated decision-making or third-party advertising.
4.3 If I intend to process your personal data for a purpose that is not covered above, I will give you a fresh notice and, where required, seek your consent.
5. Consent and its Withdrawal
5.1 Where processing is based on consent, your consent shall be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action such as ticking an unchecked box or clicking "I Agree", and limited to the personal data necessary for the specified purpose. Every consent given by ticking a checkbox on any form or call-to-action on the Website is recorded, together with the date, time and IP address from which it was given, and is available as proof of consent.
5.2 You may withdraw your consent at any time, with the same ease with which it was given, by writing to kanchan@eaglelawandintegrity.com with the subject "Withdrawal of Consent", or by using the link provided in any email I send you. Withdrawal will not affect the lawfulness of processing done before withdrawal.
5.3 Upon withdrawal, I shall, within a reasonable time, cease processing and cause my Data Processors to cease processing your personal data, unless retention is required or permitted by law or processing continues on another lawful basis (for example, statutory record-keeping or the conduct of pending proceedings). Where you withdraw consent during an ongoing engagement, I may be unable to continue rendering services, and the consequences shall be governed by the terms of engagement.
5.4 You may also give, manage, review or withdraw consent through a Consent Manager registered with the Board, once that facility becomes operational.
6. Legal Professional Privilege and Exempt Processing
6.1 Information received in the course of a professional engagement is held in strict confidence in accordance with the Bar Council of India Rules and Sections 132 to 134 of the Bharatiya Sakshya Adhiniyam, 2023.
6.2 Under Section 17(1)(a) of the Act, certain provisions of the Act (including those relating to notice, consent and certain rights of Data Principals) do not apply where processing is necessary for enforcing any legal right or claim. Personal data of counterparties, witnesses and other persons processed for this purpose may accordingly be processed without notice or consent, and requests for access, correction or erasure of such data may be declined where compliance would prejudice a legal right or claim or breach professional privilege. I shall nevertheless protect all such data with reasonable security safeguards as required by Section 8(5) of the Act.
7. Children and Persons with Disability
7.1 The Website is not directed at persons below 18 years of age. I do not knowingly collect personal data of a child except through, and with the verifiable consent of, the child's parent or lawful guardian, as required by Section 9 of the Act and Rule 10 of the Rules. Where a matter concerns a child (for example, custody or maintenance), the child's personal data is processed with the consent of the parent or lawful guardian, or as necessary for enforcing legal rights or claims.
7.2 I do not undertake tracking, behavioural monitoring or targeted advertising directed at children. Where the Data Principal is a person with disability who has a lawful guardian, consent shall be obtained from such guardian after verification.
8. Cookies and Similar Technologies
8.1 The Website uses (a) strictly necessary cookies required for the Website to function and to remember your acceptance of the disclaimer, and (b) analytics and performance cookies, including those deployed through Google Tag Manager, which help me understand how the Website is used.
8.2 Non-essential cookies are placed only with your consent through the cookie banner. You may withdraw consent at any time through the cookie settings link in the Website footer or by adjusting your browser settings. Blocking cookies may affect Website functionality.
9. Sharing with Data Processors and Others
9.1 I share personal data only to the extent necessary for the purposes in Clause 4, with:
- Data Processors engaged by me under a valid contract, such as website hosting and maintenance provider MilesWeb Internet Services Pvt Ltd, email and cloud storage provider Google Workspace, analytics provider (Google), payment gateway Razorpay and IT support providers;
- counsel, senior advocates, experts, investigators, translators, notaries and correspondent or foreign counsel engaged in your matter, subject to confidentiality obligations;
- courts, tribunals, registries, the Registrar or Sub-Registrar of Assurances, regulatory and statutory authorities, as necessary for your matter; and
- any authority where disclosure is required by law, a court order or for the prevention or investigation of an offence.
9.2 I remain responsible under Section 8(1) of the Act for processing undertaken by my Data Processors on my behalf.
10. Transfer Outside India
10.1 Some of my Data Processors may store or process data on servers located outside India, and communications with NRI clients and foreign counsel necessarily involve transfer of personal data outside India. Such transfers are made in accordance with Section 16 of the Act and shall not be made to any country or territory restricted by the Central Government by notification.
11. Retention and Erasure
11.1 I retain personal data only for as long as necessary for the purpose for which it was collected, or as required under applicable law, after which it is erased unless its retention is required for compliance with law. Indicative periods are:
| Data | Retention period |
|---|---|
| Website access registration and enquiries that do not result in engagement | 12 months from last interaction, unless you withdraw consent earlier |
| Client matter files and engagement records | Duration of the matter and thereafter 8 years, having regard to limitation periods, professional obligations and possible claims |
| Billing and accounting records | As required under tax and GST laws (generally 8 years) |
| Server and access logs, and personal data processed for security purposes | At least one year, as required under Rule 6 of the Rules |
| Cookie data | As set out in the cookie banner, subject to your preferences |
11.2 Original documents entrusted to me shall be returned to the client at the conclusion of the matter or on request, subject to the terms of engagement.
12. Security Safeguards
12.1 In accordance with Section 8(5) of the Act and Rule 6 of the Rules, I take reasonable security safeguards to prevent personal data breach, including:
- encryption, masking or obfuscation of personal data where appropriate, and secure (HTTPS) transmission on the Website;
- role-based access controls, limiting access to personal data to myself and any associates, interns or staff who assist me and need it for the matter;
- logging and monitoring of access to detect unauthorised access, and retention of such logs as required;
- regular backups to ensure continued availability of data in the event of loss or compromise;
- confidentiality undertakings from any associates, interns and staff, and contractual security obligations on Data Processors; and
- periodic review of these measures.
13. Personal Data Breach
13.1 In the event of a personal data breach, I shall, in accordance with Section 8(6) of the Act and Rule 7 of the Rules:
- intimate each affected Data Principal without delay, in clear and plain language, describing the breach, its likely consequences, the mitigation measures taken, safety measures you may take, and contact details of a person who can respond on my behalf; and
- intimate the Board without delay, and furnish detailed information within seventy-two hours of becoming aware of the breach, or such longer period as the Board may allow.
14. Your Rights
14.1 Subject to Clause 6.2 and applicable law, you have the following rights under Chapter III of the Act:
- Right to access information (Section 11): to obtain a summary of your personal data processed by me and the processing activities undertaken, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared, along with a description of the data shared;
- Right to correction and erasure (Section 12): to have inaccurate or misleading personal data corrected, incomplete data completed, data updated, and data erased where it is no longer necessary for the specified purpose, unless retention is required by law;
- Right of grievance redressal (Section 13): to have your grievance about my processing of your personal data addressed by me; and
- Right to nominate (Section 14): to nominate another individual to exercise your rights in the event of your death or incapacity.
14.2 How to exercise your rights: write to kanchan@eaglelawandintegrity.com, or to the address in Clause 16, using the form at Annexure B or otherwise, stating your name, contact details and the right you wish to exercise. I may ask for information reasonably necessary to verify your identity before acting on a request.
14.3 I shall respond to requests and grievances within a reasonable period, and in any event within ninety days of receipt or such shorter period as may be prescribed.
15. Your Duties
15.1 Under Section 15 of the Act, while exercising your rights you shall comply with applicable law, not impersonate another person, not suppress any material information while providing your personal data, not register a false or frivolous grievance or complaint, and furnish only verifiably authentic information when seeking correction or erasure. Breach of these duties may attract a penalty of up to Rs. 10,000 under the Act.
16. Contact Person for Data Protection
16.1 In accordance with Section 8(9) of the Act, questions about the processing of your personal data may be addressed to me, as the contact person, at:
Name and designation: Adv. Kanchan Talreja, Advocate (Data Fiduciary in individual capacity)
Address: 205, Dalamal Chambers, 29, New Marine Lines, Mumbai 400 020
Email: kanchan@eaglelawandintegrity.com
Telephone: +91 9619 354 354
16.2 I also act as the Grievance Officer for the purposes of the Information Technology Act, 2000 and the rules made thereunder.
17. Complaint to the Data Protection Board of India
17.1 If you are not satisfied with my response to your grievance, or if I do not respond within the period stated in Clause 14.3, you may file a complaint with the Data Protection Board of India in the manner prescribed under the Act and the Rules, through the digital platform provided by the Board. As required by Section 13(3) of the Act, you must first exhaust the grievance redressal mechanism with me before approaching the Board.
18. Language
18.1 This Policy is available in English. On request to the contact person in Clause 16, I shall provide it in any language specified in the Eighth Schedule to the Constitution of India, including Hindi, Marathi and Gujarati.
19. Changes to this Policy
19.1 I may update this Policy to reflect changes in law or my practices. The updated Policy will be posted on the Website with a revised "Last updated" date. Where changes materially affect the purposes of processing based on consent, I will give you notice and, where required, seek fresh consent.
20. Governing Law
20.1 This Policy is governed by the laws of India, including the Act and the Rules. Subject to the jurisdiction of the Board under the Act, the courts at Mumbai shall have jurisdiction.
Data Principal Request Form
Use this form to exercise your rights under Clause 14 of this Policy. It is addressed to Adv. Kanchan Talreja (AKT), 205, Dalamal Chambers, 29, New Marine Lines, Mumbai 400 020, kanchan@eaglelawandintegrity.com. You may also send the same details by email or post.
