Privacy policy

1. Who we are

This website is operated by Advocate Rahul Bansal, an advocate practising before the Punjab & Haryana High Court and District Courts, Chandigarh (“we”, “us”). For personal data collected through this website we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). You are the Data Principal.

2. Personal data we collect

Please do not send case documents, identity numbers, bank details or health information through the website. Share them only after a consultation is fixed, through a channel agreed with the advocate.

3. Purposes and legal basis

• Responding to your request and arranging a consultation — your consent (DPDP Act s.6).
• Acting on a data-rights request or grievance — compliance with the DPDP Act (s.7).
• Website security and prevention of misuse — reasonable security safeguards required by s.8(5).
• Representing you if you engage the advocate — under the engagement, and where necessary to establish or enforce legal rights or claims (s.7 and s.17(1)(a)). Advocate–client communications are also protected under s.132 of the Bharatiya Sakshya Adhiniyam, 2023.

We do not use your data for profiling, automated decisions, advertising or marketing.

4. Consent and withdrawal

Consent is given by ticking a box yourself — nothing is pre-ticked — and covers only the purpose stated beside it. You may withdraw consent at any time, as easily as you gave it, on the data rights page, by email, or by WhatsApp message. We then stop processing your data for that purpose within a reasonable time unless the law requires us to keep it. Withdrawal does not affect processing already done. We keep a minimal record of each consent (reference, date, notice version, purpose and a one-way hash of your contact detail) to show that consent was given, as s.6(10) requires.

5. Sharing and processors

We do not sell, rent or trade personal data. It is shared only with:

• Hostinger — hosting of this website, its database and the email service, acting as our Data Processor.
• WhatsApp (Meta) — only if you choose to contact us on WhatsApp.
• YouTube (Google) — only if you press play on a YouTube video on this site; nothing is loaded from YouTube before that.
• Courts, authorities or opposite parties — only as needed to act on your matter after you engage the advocate, or where the law requires.

Service providers’ servers may be located in or outside India. We do not transfer personal data to any country restricted by the Central Government under s.16 of the DPDP Act.

6. Retention and erasure

• Enquiries that do not lead to an engagement: automatically erased 12 months after the last activity, or earlier if you withdraw consent or ask for erasure.
• Client matters: kept while the matter continues and afterwards for the period required by professional obligations and the law of limitation.
• Consent records, data-rights requests and access logs: kept for at least one year as the DPDP Rules require, and erased after three years.
• Spam-prevention IP hashes: up to 24 hours. Hosting server logs: as per the hosting provider’s retention.

7. Security and personal data breaches

Reasonable safeguards include: HTTPS throughout; encryption of personal data in the database (AES-256-GCM); a password-protected admin panel with optional two-factor authentication, automatic logout and login throttling; an audit log of access to and deletion of personal data; protection of forms against forgery and spam; and no third-party scripts on the website.

If a personal data breach occurs, we will inform affected Data Principals without delay — describing what happened, the likely consequences, the steps taken and what you can do — and report it to the Data Protection Board of India as required by the DPDP Act and Rules.

8. Your rights

• Access a summary of your personal data, how it is processed and with whom it has been shared (s.11);
• Correction, completion, updating and erasure (s.12);
• Grievance redressal (s.13);
• Nominate a person to exercise your rights in case of death or incapacity (s.14);
• Withdraw consent at any time (s.6(4)).

Use the data rights page or email the Grievance Officer. We may need to verify your identity. We respond as soon as reasonably possible and in any case within 90 days. If you are not satisfied, you may complain to the Data Protection Board of India after using our grievance process.

9. Your duties

Under s.15 of the DPDP Act, please provide accurate information, do not impersonate anyone, and do not file false or frivolous grievances.

10. Children and persons with disabilities

This website is not intended for persons under 18. Where a matter concerns a child, or a person with a disability who has a lawful guardian, the parent or guardian should contact us; we rely on their consent as verifiable consent under s.9. We do not track or monitor children or direct advertising at them.

11. Cookies and browser storage

No advertising, analytics or tracking cookies are used, so there is nothing to opt out of. Only strictly necessary items are used:

• lwb_session — a session cookie that protects the forms against forgery and keeps admin users signed in. It is deleted when you close the browser.
• lwb_disclaimer — saved in your browser’s local storage to remember that you accepted the Bar Council disclaimer. It never leaves your device.

12. Grievance Officer

Advocate Rahul Bansal
Email: rahul@lawwithbansal.com
Phone: +919646078320

13. Language and changes

This policy is available in English. On request, we will provide it in Hindi, Punjabi or any other language in the Eighth Schedule to the Constitution, as s.5(3) of the DPDP Act provides. If this policy changes, the new version and date will be published here; where a change affects a purpose you consented to, we will ask for fresh consent.