Privacy Policy

LLM Advocates ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information in compliance with the General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data Controller Information

Entity Name: LLM Advocates
Registration: Punjab and Haryana High Court
Email: contact@llmadvocates.com
Grievance Officer / Data Protection Officer (DPO): Ritik Khurana, Advocate — contact@llmadvocates.com

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for processing your data
• Contract Performance: Processing is necessary for legal services you have engaged
• Legal Obligation: Compliance with legal and regulatory requirements
• Legitimate Interests: For business operations and service improvement

3. Information We Collect

3.1 Personal Information

• Name and contact details (phone number, email address)
• Case-related information (type of case, preferred consultation date)
• Communication records and correspondence
• Legal documents and case files

3.2 Technical Information

• IP address and browser type
• Device information and operating system
• Website usage data and analytics
• Cookies and similar tracking technologies

4. How We Use Your Information

We use your personal data for the following purposes:

• Providing legal consultation and services
• Responding to inquiries and scheduling appointments
• Case management and legal representation
• Compliance with legal and regulatory obligations
• Improving our services and website functionality
• Sending service-related communications

5. Data Sharing and Disclosure

We may share your personal data with:

• Courts and Legal Authorities: As required by law or legal proceedings
• Professional Advisors: Expert witnesses, consultants, and co-counsel
• Service Providers: IT services, cloud storage, and administrative support
• Regulatory Bodies: Bar Council and other legal regulatory authorities

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. International Data Transfers (GDPR)

If we transfer your data outside India or the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission and adequate data protection mechanisms as required by the DPDP Act.

7. Data Retention

We retain your personal data for as long as necessary to:

• Provide legal services and maintain case records
• Comply with legal, regulatory, and professional obligations
• Resolve disputes and enforce our agreements

Retention Period: Case files and legal documents are retained for a minimum of 7 years from case closure, or as required by applicable law and Bar Council regulations.

8. Your Rights Under GDPR and DPDP Act

You have the following rights regarding your personal data:

8.1 GDPR Rights (for EEA residents)

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

8.2 DPDP Act Rights (for Indian residents)

• Right to Access: Obtain information about personal data processing
• Right to Correction: Correct inaccurate or misleading data
• Right to Erasure: Request deletion when no longer necessary
• Right to Grievance Redressal: File complaints with our Data Protection Officer
• Right to Nominate: Nominate another individual to exercise rights in case of death or incapacity

To exercise any of these rights, please contact us at contact@llmadvocates.com. We will respond to your request within 30 days.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and audits
• Employee training on data protection
• Secure backup and disaster recovery procedures

10. Cookies, Tracking & Technology Disclosure

In accordance with DPDP Act s.6 (Consent) and GDPR Article 13, we provide full transparency about the technologies deployed on this website and the personal data they may process.

10.1 Essential Cookies

These cookies are strictly necessary for the website to function. They do not require consent under DPDP Act s.6(b) or GDPR Art. 6(1)(b).

• Session Cookie (PHPSESSID): Maintains your session state. Expires when you close the browser.
• Cookie Consent Preference (llm_cookie_consent): Remembers your cookie choice. Stored in localStorage.

10.2 Analytics Cookies (Consent Required)

Analytics cookies are only activated after you click "Accept All" in our cookie banner. They are never loaded before consent.

• Google Analytics (_ga, _gid): Measures site traffic and user behaviour. Data is sent to Google LLC (USA). Google's Privacy Policy applies. Retention: 14 months.
• Google Tag Manager (GTM): Container for analytics scripts. No cookies are set by GTM itself, but it enables Google Analytics.

10.3 Third-Party Services & Data Sharing

The following third-party services are used on this website. Each may process personal data as described:

10.4 Server-Side Data Collection

• Visitor Tracking (tracker.php): We log page visits including IP address (resolved to country via local GeoIP database — your IP never leaves our server), browser type, device type, and referring URL. This data is used for traffic analysis and security monitoring.
• Session Analytics: We track session duration, bounce rate, and page flows to improve user experience. This is processed entirely on our own servers.

10.5 Browser Permissions Policy

As a privacy safeguard, our server actively blocks the following browser APIs via the Permissions-Policy HTTP header to prevent fingerprinting: accelerometer, gyroscope, magnetometer, microphone, camera, geolocation, MIDI, USB, Bluetooth, HID, Serial, keyboard-map, compute-pressure, and battery. These APIs cannot be accessed by any script on our website.

11. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the information immediately.

12. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR and the DPDP Act.

13. Complaints and Supervisory Authority

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with:

• For GDPR: Your local Data Protection Authority in the EEA
• For DPDP Act: The Data Protection Board of India

However, we strongly encourage you to contact us first at contact@llmadvocates.com so we can endeavour to resolve your concerns directly before you approach a supervisory authority.

13A. Grievance Officer (DPDP Act s.13)

In accordance with Section 13 of the Digital Personal Data Protection Act, 2023, LLM Advocates has designated a Grievance Officer to address complaints related to the processing of personal data.

Name: Ritik Khurana
Designation: Grievance Officer & Data Protection Officer
Email: contact@llmadvocates.com
Address: LLM Advocates, Chandigarh, India
Response Time: We will acknowledge your grievance within 24 hours and endeavour to resolve it within 30 days.

Any Data Principal (user) may file a grievance with the Grievance Officer regarding the processing of their personal data, consent, or exercise of their rights under the DPDP Act. If unsatisfied with the resolution, you may escalate to the Data Protection Board of India.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website with a revised "Last Updated" date. Your continued use of our services constitutes acceptance of the updated policy.

15. Contact Information

For questions, concerns, or to exercise your data protection rights, please contact us:

Email: contact@llmadvocates.com
Subject Line: "Privacy Policy Inquiry" or "Data Protection Request"

We are committed to resolving any privacy concerns promptly and transparently.