Your data, your rights
Privacy Policy
How Lex Mordecai collects, uses and protects personal data through this website, in line with the Digital Personal Data Protection Act, 2023 and, where it applies, the GDPR.
- Last updated: [add date]
- DPDP Act, 2023
- GDPR
01Who we are and what this notice covers
This notice explains how Lex Mordecai (“we”, “us”), a law practice at [add office address], handles personal data collected through this website. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary, and for the EU/UK General Data Protection Regulation (“GDPR”) we are the controller.
It applies to visitors to this website, people who contact us or book a consultation through it, and readers of our blog. It does not describe how we handle client files once we are engaged on a matter; that is governed by our professional duties of confidentiality and our engagement terms.
Questions about this notice: [add email].
02The personal data we collect
What you give us
- Name, email address and phone number
- The message or short description of your matter that you type into a form
- Preferred date and time when you book a consultation
Collected automatically
- IP address, browser and device type
- Pages visited and time spent
- Cookie identifiers (see our Cookie Policy)
We do not knowingly ask for government identity numbers, financial account details or health information through this website. Please do not include confidential or sensitive details in a form or message before you have spoken to an advocate.
03Why we use your data, and our legal basis
| Purpose | DPDP Act, 2023 | GDPR (where it applies) |
|---|---|---|
| Replying to your enquiry | Your consent; you provide the data voluntarily | Consent, or steps you ask us to take before engagement (Art. 6(1)(a), (b)) |
| Scheduling and holding a consultation, including video calls | Your consent | Steps at your request before a contract; consent (Art. 6(1)(a), (b)) |
| Meeting legal, regulatory and professional obligations, and responding to authorities | Legitimate use: compliance with law | Legal obligation (Art. 6(1)(c)) |
| Keeping the website secure and working | Reasonable security safeguards | Legitimate interests (Art. 6(1)(f)) |
| Optional analytics and preference cookies, if enabled | Your consent | Consent (Art. 6(1)(a)) |
We use your data only for these purposes. We do not sell it, and we do not use it for marketing or advertising.
04Consent and how to withdraw it
Where we rely on your consent, it is given by a clear action, such as ticking the consent box on a form or accepting optional cookies. It is specific to the purposes stated here. You can withdraw consent at any time as easily as you gave it, by writing to us or, for cookies, using the cookie settings. Withdrawing does not affect anything done lawfully before that, and we will stop using the data for that purpose unless the law requires us to keep it.
05Who we share it with
We share personal data only as needed, with service providers who act on our instructions:
- Website, forms and appointment hosting: Odoo (Odoo S.A. and its group companies), which hosts this website and its booking tools.
- Video consultations: [add video call provider, e.g. Google Meet / Zoom].
- Maps and fonts: Google, when the map or fonts load on a page. This can share your IP address with Google.
- Email and messaging: [add email / WhatsApp provider].
- Authorities and advisers: courts, regulators, law enforcement or professional advisers where the law requires it, or to establish or defend legal claims.
Our providers may only use the data for the services they perform for us.
06Transfers outside India
Our service providers may store or process data on servers outside India. The DPDP Act permits transfers to countries other than those the Central Government restricts by notification, and we will comply with any such restriction. Where the GDPR applies to you, we rely on appropriate safeguards for transfers outside the EEA or UK, such as standard contractual clauses, with our providers.
07How long we keep it
- Enquiries and bookings that do not lead to engagement: up to [24 months], then deleted.
- Matters where we are engaged: for the period our professional and legal obligations require, currently [add period, e.g. 7 years] after the matter closes, then deleted.
- Website logs and cookie data: for the periods shown in the Cookie Policy.
Once the purpose is served and the law no longer requires retention, we erase the data or make it anonymous.
08How we protect it
We use reasonable security safeguards, including encrypted connections (HTTPS), access limited to people who need the data, and trusted hosting providers. No online system is completely secure. If a personal data breach occurs we will notify the Data Protection Board of India and the affected people as the DPDP Act requires, and, where the GDPR applies, the relevant supervisory authority and affected individuals within the periods it sets.
09Your rights
Under the DPDP Act, 2023
- Get a summary of the personal data we process and how
- Correct, complete or update your data
- Have your data erased when it is no longer needed
- Grievance redressal
- Nominate another person to exercise your rights if you die or become incapacitated
- Withdraw consent
Under the GDPR (where it applies)
- Access, rectification and erasure
- Restriction of processing and objection
- Data portability
- Withdraw consent at any time
- Complain to your local supervisory authority
To use any right, email us at [add email]. We may need to confirm your identity first, and we will reply within the period the law sets.
Data Principals also have duties under the DPDP Act, including not to file false or frivolous complaints and to provide only authentic information.
10Children
This website is not directed at anyone under 18. We do not knowingly process the personal data of a child without the verifiable consent of a parent or lawful guardian, as the DPDP Act requires. If you believe a child has sent us data, please contact us and we will delete it.
11Grievance redressal and complaints
If you have a concern about how we handle your data, please write first to our contact for data queries: [add grievance contact name], [add grievance email]. We will acknowledge your complaint and respond within the period the law sets.
If you are not satisfied, you may complain to the Data Protection Board of India after using this grievance process. If the GDPR applies to you, you may also complain to the supervisory authority in your country.
12Language
This notice is provided in English. On request, we will provide it in any of the languages listed in the Eighth Schedule to the Constitution of India.
13Changes to this notice
We may update this notice when our practices or the law change. The date at the top shows when it last changed. Where a change affects how we use data you have already given us, we will tell you and, where required, ask for your consent again.
Your data, your rights
Privacy Policy
How Lex Mordecai collects, uses and protects personal data through this website, in line with the Digital Personal Data Protection Act, 2023 and, where it applies, the GDPR.
- Last updated: [add date]
- DPDP Act, 2023
- GDPR
01Who we are and what this notice covers
This notice explains how Lex Mordecai (“we”, “us”), a law practice at [add office address], handles personal data collected through this website. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary, and for the EU/UK General Data Protection Regulation (“GDPR”) we are the controller.
It applies to visitors to this website, people who contact us or book a consultation through it, and readers of our blog. It does not describe how we handle client files once we are engaged on a matter; that is governed by our professional duties of confidentiality and our engagement terms.
Questions about this notice: [add email].
02The personal data we collect
What you give us
- Name, email address and phone number
- The message or short description of your matter that you type into a form
- Preferred date and time when you book a consultation
Collected automatically
- IP address, browser and device type
- Pages visited and time spent
- Cookie identifiers (see our Cookie Policy)
We do not knowingly ask for government identity numbers, financial account details or health information through this website. Please do not include confidential or sensitive details in a form or message before you have spoken to an advocate.
03Why we use your data, and our legal basis
| Purpose | DPDP Act, 2023 | GDPR (where it applies) |
|---|---|---|
| Replying to your enquiry | Your consent; you provide the data voluntarily | Consent, or steps you ask us to take before engagement (Art. 6(1)(a), (b)) |
| Scheduling and holding a consultation, including video calls | Your consent | Steps at your request before a contract; consent (Art. 6(1)(a), (b)) |
| Meeting legal, regulatory and professional obligations, and responding to authorities | Legitimate use: compliance with law | Legal obligation (Art. 6(1)(c)) |
| Keeping the website secure and working | Reasonable security safeguards | Legitimate interests (Art. 6(1)(f)) |
| Optional analytics and preference cookies, if enabled | Your consent | Consent (Art. 6(1)(a)) |
We use your data only for these purposes. We do not sell it, and we do not use it for marketing or advertising.
04Consent and how to withdraw it
Where we rely on your consent, it is given by a clear action, such as ticking the consent box on a form or accepting optional cookies. It is specific to the purposes stated here. You can withdraw consent at any time as easily as you gave it, by writing to us or, for cookies, using the cookie settings. Withdrawing does not affect anything done lawfully before that, and we will stop using the data for that purpose unless the law requires us to keep it.
05Who we share it with
We share personal data only as needed, with service providers who act on our instructions:
- Website, forms and appointment hosting: Odoo (Odoo S.A. and its group companies), which hosts this website and its booking tools.
- Video consultations: [add video call provider, e.g. Google Meet / Zoom].
- Maps and fonts: Google, when the map or fonts load on a page. This can share your IP address with Google.
- Email and messaging: [add email / WhatsApp provider].
- Authorities and advisers: courts, regulators, law enforcement or professional advisers where the law requires it, or to establish or defend legal claims.
Our providers may only use the data for the services they perform for us.
06Transfers outside India
Our service providers may store or process data on servers outside India. The DPDP Act permits transfers to countries other than those the Central Government restricts by notification, and we will comply with any such restriction. Where the GDPR applies to you, we rely on appropriate safeguards for transfers outside the EEA or UK, such as standard contractual clauses, with our providers.
07How long we keep it
- Enquiries and bookings that do not lead to engagement: up to [24 months], then deleted.
- Matters where we are engaged: for the period our professional and legal obligations require, currently [add period, e.g. 7 years] after the matter closes, then deleted.
- Website logs and cookie data: for the periods shown in the Cookie Policy.
Once the purpose is served and the law no longer requires retention, we erase the data or make it anonymous.
08How we protect it
We use reasonable security safeguards, including encrypted connections (HTTPS), access limited to people who need the data, and trusted hosting providers. No online system is completely secure. If a personal data breach occurs we will notify the Data Protection Board of India and the affected people as the DPDP Act requires, and, where the GDPR applies, the relevant supervisory authority and affected individuals within the periods it sets.
09Your rights
Under the DPDP Act, 2023
- Get a summary of the personal data we process and how
- Correct, complete or update your data
- Have your data erased when it is no longer needed
- Grievance redressal
- Nominate another person to exercise your rights if you die or become incapacitated
- Withdraw consent
Under the GDPR (where it applies)
- Access, rectification and erasure
- Restriction of processing and objection
- Data portability
- Withdraw consent at any time
- Complain to your local supervisory authority
To use any right, email us at [add email]. We may need to confirm your identity first, and we will reply within the period the law sets.
Data Principals also have duties under the DPDP Act, including not to file false or frivolous complaints and to provide only authentic information.
10Children
This website is not directed at anyone under 18. We do not knowingly process the personal data of a child without the verifiable consent of a parent or lawful guardian, as the DPDP Act requires. If you believe a child has sent us data, please contact us and we will delete it.
11Grievance redressal and complaints
If you have a concern about how we handle your data, please write first to our contact for data queries: [add grievance contact name], [add grievance email]. We will acknowledge your complaint and respond within the period the law sets.
If you are not satisfied, you may complain to the Data Protection Board of India after using this grievance process. If the GDPR applies to you, you may also complain to the supervisory authority in your country.
12Language
This notice is provided in English. On request, we will provide it in any of the languages listed in the Eighth Schedule to the Constitution of India.
13Changes to this notice
We may update this notice when our practices or the law change. The date at the top shows when it last changed. Where a change affects how we use data you have already given us, we will tell you and, where required, ask for your consent again.