This Privacy Policy articulates the legal basis, technical mechanisms, and administrative safeguards governing the collection, processing, storage, and transfer of personal data by Standing Lawyers through this digital platform. It must be read alongside our Cookie Policy and our Data Protection and Information Security Policy.
This policy applies specifically to digital interactions through this website. Information communicated within a formal advocate-client relationship is governed by the fiduciary duty of confidentiality and statutory Legal Professional Privilege under Section 132 of the Bharatiya Sakshya Adhiniyam, 2023, detailed in our Confidentiality and Conflict of Interest Policy.
1. Data Fiduciary identity and regulatory classification
1.1 Standing Lawyers is a sole proprietorship chamber of an advocate enrolled with the Bar Council of Rajasthan, situated in India. In the statutory taxonomy of the Digital Personal Data Protection Act, 2023, Standing Lawyers constitutes a Data Fiduciary. Under the Explanation to Section 43A of the Information Technology Act, 2000, the firm constitutes a body corporate carrying on professional activities.
1.2 The firm may be contacted at work@standinglawyers.com. Clause 11 identifies the statutory Grievance Officer designated pursuant to Rule 5(9) of the SPDI Rules, 2011.
2. Operative statutory legal framework
2.1 Personal data processing by Standing Lawyers is governed by two statutory regimes in India, which operate concurrently at distinct stages of commencement.
2.2 Currently in force. Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) apply today. Under the Explanation to Section 43A, a sole proprietorship firm engaged in professional activities is deemed a body corporate. The firm complies fully with Rule 4 by publishing this policy, enforces strict consent protocols, restricts third-party disclosures, maintains comprehensive security safeguards, and designates a Grievance Officer who resolves grievances within one month. Section 72A of the same Act imposes criminal liability for unauthorized disclosure of personal information in breach of lawful contract.
2.3 Commenced and forthcoming provisions. The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 are being commenced in phased notifications. The provisions establishing definitions and the Data Protection Board of India commenced on 13 November 2025. The Consent Manager regulatory architecture commences on 13 November 2026. The substantive obligations on Data Fiduciaries and rights of Data Principals commence on 13 May 2027.
2.4 Standing Lawyers has voluntarily adopted the standards of the DPDP Act, 2023 in advance. The Data Principal rights delineated in Clause 10 are made available to all individuals as firm policy today, regardless of whether the specific statutory section has reached its formal commencement date.
3. Categories of personal data collected
3.1 Personal data collected through this digital infrastructure falls into four strictly circumscribed categories:
3.2 Submissions through general enquiry channels
3.2.1 The general contact form collects your name, email address, corporate entity name if provided, and the textual narrative of your enquiry. Only name, email address, and message text are mandatory fields.
3.2.2 Enquiry narratives must remain brief and free of confidential details, in accordance with Clause 5 of our Disclaimer. Where an enquiry discloses particulars of a third party, you warrant that you are legally authorized to communicate such information.
3.2.3 Strict prohibition on sensitive disclosures. You must not transmit sensitive personal data or information, including Permanent Account Numbers, Aadhaar particulars, bank account numbers, credit or debit card data, health records, biometric information, or disputed debtor ledgers through general contact forms.
3.2.4 Provide solely an outline of the nature of the claim, the relevant parties, the approximate quantum, and whether proceedings are pending. This enables preliminary conflict checking under Clause 6 of our Confidentiality Policy before encrypted communication is arranged.
3.3 Submissions through recruitment and internship portals
3.3.1 The career portal collects the applicant's name, email address, contact telephone number, professional portfolio or LinkedIn URL, role selected, cover narrative, confirmation of applicant consent, and attached curriculum vitae. CV files may be uploaded in PDF or Word formats up to five megabytes.
3.3.2 Applicants are instructed not to include identity document numbers, financial data, health disclosures, or photographs in submitted CVs. Such data is unnecessary for professional candidate evaluation.
3.4 Website usage measurement
3.4.1 This website records no public page views, visitor identifiers, or cross-site telemetry. In the event that privacy-preserving aggregate telemetry is introduced, this policy shall be amended prior to implementation.
3.5 Edge security and anti-abuse records
3.5.1 To protect form endpoints from denial-of-service vectors and automated exploitation, our Cloudflare edge infrastructure maintains short-lived submission counters associated with a server-side keyed one-way digest of the originating network address. This technical record stores exclusively the cryptographic hash, a request counter, and a timestamp. It contains no personal identifiers, no message content, and no reversible IP address. Records older than twenty-four hours are purged automatically.
3.6 Categories of data explicitly excluded
3.6.1 For complete transparency, Standing Lawyers affirms the following exclusions:
- we set zero cookies and execute zero third-party trackers on public routes;
- we do not collect Sensitive Personal Data or Information as defined under the SPDI Rules, 2011, encompassing passwords, banking details, biometric records, physiological health conditions, or sexual orientation;
- we do not knowingly collect personal data relating to children under eighteen years of age;
- we do not purchase, sell, lease, or commercially trade personal data with third-party marketing entities;
- we operate no promotional marketing lists, distribution broadcasts, or unsolicited newsletters;
- we deploy no automated profiling algorithms to make legal determinations regarding individuals; and
- we will never solicit banking passwords, OTPs, or CVV numbers under any circumstances.
4. Technical transmission and storage architecture
4.1 When an enquiry form is submitted, the payload is persisted in a distributed Cloudflare D1 SQL database and transmitted via Resend transactional email to the firm's mailboxes. An automated confirmation receipt is returned to the user's email. Database persistence ensures that client communications are not lost in the event of upstream email delivery disruption.
4.2 When a career or internship form is submitted, candidate metadata is saved in Cloudflare D1, while the attached curriculum vitae is transmitted as an email attachment through Resend directly to the recruitment mailbox. CV files are not stored in permanent public object buckets on the website server.
4.3 Enquiry data persists in the firm's D1 database and encrypted email mailboxes. The database is accessible exclusively by authenticated server-side worker code and authorized firm administrators.
5. Lawful bases and purposes of processing
5.1 Standing Lawyers processes personal data exclusively under the following lawful bases:
| Processing Purpose | Data Utilized | Statutory Lawful Basis |
|---|---|---|
| Reviewing and responding to enquiries and determining capacity to act | Name, email address, corporate entity, enquiry text | Voluntary provision by Data Principal for that specific purpose, and legitimate interest in responding to enquiries |
| Conducting statutory conflict of interest checks prior to substantive engagement | Party names, adverse entity particulars, dispute summary | Advocates Act professional obligations and necessity prior to entering an advocate-client relationship |
| Evaluating recruitment and internship applications | Candidate contact data, educational credentials, cover narrative, CV | Explicit affirmative consent recorded via mandatory submission checkbox |
| Preventing automated abuse and malicious exploitation of form endpoints | Ephemeral keyed one-way cryptographic IP digests and timestamps | Legitimate interest in maintaining infrastructure security under Information Technology Act standards |
| Complying with statutory, regulatory, and taxation mandates, and establishing legal defenses | Relevant transaction, correspondence, and identification records | Statutory compliance under applicable laws, and Section 17(1)(a) of the DPDP Act, 2023 |
5.2 Personal data is never processed for secondary or incompatible purposes without obtaining fresh consent.
6. Consent revocation mechanics
6.1 Where processing relies on consent, you may withdraw consent at any time by transmitting an email to our designated contact address. Revocation is straightforward and requires no explanation.
6.2 Withdrawal of consent takes effect upon receipt and does not retroactively invalidate prior lawful processing. Where statutory retention mandates apply, we shall advise you of the legal basis requiring continued retention.
7. Authorized technical processors and data transfers
7.1 The firm transfers personal data to a strictly circumscribed group of technical service providers essential for web operations and secure communications:
| Service Provider | Operational Role | Data Categories Handled | Hosting Jurisdiction |
|---|---|---|---|
| Cloudflare, Inc. | Edge hosting, CDN delivery, Workers runtime, and D1 database persistence | Form field submissions and ephemeral security digests (excluding CV files) | Global edge network; database regional storage configured by Cloudflare |
| Resend, Inc. | Transactional email dispatch and automated confirmation | Form message payloads and curriculum vitae attachments | United States and global cloud infrastructure |
| GoDaddy Operating Company, LLC | Enterprise email mailbox hosting | Inbound correspondence and delivered attachments | Secure global data centers |
| Google LLC (Firebase) | Administrative identity authentication | Zero public visitor data; internal administrative credentials only | Global secure authentication cloud |
7.2 Service providers are bound by strict contractual covenants restricting processing exclusively to our instructions, with absolute prohibitions against commercial exploitation or model training.
7.3 Cross-border data transfers comply with Section 16 of the Digital Personal Data Protection Act, 2023, ensuring transfers occur only to jurisdictions not restricted by the Central Government of India.
8. Data retention schedules and disposal
| Data Category | Operative Retention Period | Disposal Methodology |
|---|---|---|
| General enquiries in D1 database and mailboxes | Retained for the duration necessary to answer and maintain record of enquiry, reviewed and purged annually | Permanent database row deletion and mailbox expungement |
| Unsuccessful recruitment and internship applications | Retained up to twelve months from recruitment cycle conclusion with candidate consent | Permanent electronic deletion from recruitment mailboxes and database |
| Client matter files and litigation records | Retained for statutory limitation periods and taxation compliance under Advocates Act standards | Secure cryptographic purging and physical document shredding |
| Ephemeral security rate-limiting records | Retained for a maximum of twenty-four hours from creation | Automated programmatic overwrite and expiration |
9. Technical and organizational security architecture
9.1 Personal data is safeguarded by enterprise-tier technical controls: mandatory TLS 1.3 encryption in transit with HSTS enforcement, cloud database encryption at rest, server-side Zod schema input validation, restricted administrative role-based access, and ephemeral one-way keyed digests for rate limiting.
9.2 While the firm implements rigorous technical measures, transmission across the public internet cannot be guaranteed to be immune from interception. Visitors are reiterated not to submit privileged documents through general forms.
9.3 In the event of a personal data breach, the firm will execute the incident protocols set forth in our Data Protection Policy, including prompt notification to affected individuals and the Data Protection Board of India.
10. Data Principal rights and exercise procedures
10.1 Under firm policy today and pursuant to the Digital Personal Data Protection Act, 2023, Data Principals possess the following rights:
- Right to Access (Section 11). Obtain a summary of personal data processed, processing activities undertaken, and identities of third parties with whom data has been shared;
- Right to Correction and Updating (Section 12). Require the rectification of inaccurate or misleading data and completion of incomplete records;
- Right to Erasure (Section 12). Request the deletion of personal data that is no longer necessary for the purpose collected, unless retention is required by law;
- Right of Grievance Redressal (Section 13). Lodge a formal grievance with the designated Grievance Officer;
- Right to Nominate (Section 14). Nominate another natural person to exercise rights in the event of death or incapacity; and
- Right to Withdraw Consent (Section 6). Revoke previously granted consent without prejudice.
10.2 To exercise any right, submit an email to work@standinglawyers.com detailing your request. The firm may require identity verification prior to processing. No administrative fee is levied for rights requests.
10.3 The firm will acknowledge your request within three working days and provide a substantive determination within thirty days.
11. Statutory Grievance Officer and escalation hierarchy
11.1 Pursuant to Rule 5(9) of the SPDI Rules, 2011, the designated Grievance Officer for Standing Lawyers is Mohit Sharma, Advocate, proprietor of the firm, reachable at work@standinglawyers.com with the subject line Data Protection Grievance.
11.2 The Grievance Officer shall acknowledge all grievances within three working days and redress them within thirty days of receipt, complying with Rule 5(9) of the SPDI Rules, 2011.
11.3 Complainants dissatisfied with our determination may escalate grievances to the Data Protection Board of India under Section 13 of the DPDP Act, 2023 following commencement, subject to exhausting internal mechanisms, or seek legal remedies before the competent civil courts or the Bar Council of Rajasthan under Section 35 of the Advocates Act, 1961.
12. Minors and children's data
12.1 This website is directed exclusively at commercial entities and adult professionals. We do not knowingly collect personal data of individuals under eighteen years of age.
12.2 Upon receiving notification that a minor's data has been submitted, the firm will purge such records immediately.
13. Periodic policy amendments
13.1 This Privacy Policy is updated periodically to reflect changes in our practice, technical architecture, or statutory law. Revisions will be published on this page with an updated effective date.
Effect, review and contact
A This Privacy Policy takes effect on 11 October 2026 and supersedes every earlier version published on this website. The version published on this page constitutes the operative regulatory instrument at any given point in time.
B Standing Lawyers reviews this Privacy Policy at least annually, and forthwith upon any amendment to applicable statutes, subordinate rules, regulatory notifications, or firm operational systems. Where an amendment is material, formal notice shall be published on this page, and where the amendment concerns personal data in respect of which contact particulars are maintained, direct notification shall be transmitted.
C All formal communications, statutory notices, and grievances arising out of or in connection with this Privacy Policy must be addressed to work@standinglawyers.com, marked for the attention of the Grievance Officer where the communication constitutes a formal complaint.
