Privacy & Cookie Policy

1. Introduction & Scope

AMLEGALS ("Firm", "we", "us", or "our") sets forth in this Privacy & Cookie Policy its practices concerning the collection, use, retention, disclosure and protection of personal data, in accordance with applicable law, subject to territorial scope and commencement:

• The Digital Personal Data Protection Act, 2023 ("DPDPA") and the Rules framed thereunder (India)
• The Information Technology Act, 2000 and the rules made under it
• The General Data Protection Regulation ("GDPR"), Regulation (EU) 2016/679, where applicable
• Other applicable international data protection frameworks

2. Platforms Covered by This Policy

This policy applies to the following AMLEGALS-operated domains (collectively, the "Platforms"):

• amlegals.com and amlegals.in - the firm's primary websites
• amlegalsdpdpa.com - our data privacy / DPDPA knowledge platform
• amlegalsai.com - our AI law & governance platform

The implementation details below describe amlegals.in; an individual platform or embedded service may have an additional notice. On amlegals.in we do not intentionally add advertising or behavioural-tracking cookies, third-party analytics, or marketing pixels for browsing. We do operate a limited first-party pageview measurement, and the website loads a library supplied by its hosting platform; both are described in full in Section 4. Where a specific page or sub-domain uses a strictly necessary security cookie, an enquiry / intake form, or an embedded third-party component (for example, a map or a video player), the component may contact its provider. Review its notice alongside Section 4 (Cookies) and Section 6 (Data Processors). We do not assert a universal "no-collection" rule for any page where a form or embed is in fact present.

3. Information We Collect

3.1 Browsing the website. When you simply read our pages, we do not require you to provide personal data and we do not profile you for advertising. Our own servers record a limited set of technical details for each page you open (the page path and title, the referring URL without query or fragment, any campaign (UTM) parameters in the link, device, browser and operating-system type, browser language, the browser user-agent string, and approximate country where our host supplies it). The first-party measurement records do not store your IP address; hosting and security providers receive network information when serving requests. Section 4 explains how this works.

3.2 When you contact us or submit a form. If you use a contact form, request a briefing, subscribe to an update, or otherwise approach us to engage our services, we collect the data you choose to provide - typically your name, organisation, email address, phone number and the details of your enquiry.

3.3 When you become a client. On engagement we may additionally process Identity Information (professional credentials, organisation affiliation), Engagement Details (scope of matter), KYC documentation, and Transactional Information (billing and payment records). The detailed handling of this category is set out in your Engagement Letter / Retainership Agreement.

4. Cookies & Tracking

4.1 First-party pageview measurement. When a page opens, your browser sends our own server the details listed in Section 3.1, together with a random session identifier. That identifier is generated in the page's memory; it is not written to a cookie, localStorage or sessionStorage, and it is discarded when you close or reload the tab. It lets us see which pages are read together in one visit. The records are held on the firm's own hosting database, are used only to understand which pages readers use, and are not used for advertising, sold, or shared for any other purpose.

4.2 Forms. Nothing you type into an enquiry form is sent to us until you press submit. There is no keystroke, partial-entry or abandoned-form capture. When you submit an enquiry, the session identifier and the technical details above are recorded with it, so that we know which page you wrote from. Submitted enquiry metadata can also include screen and viewport dimensions. Separate operational submission/error events contain no form-field contents. Query strings and fragments are removed from source and referrer URLs; campaign labels should never contain personal information.

4.3 Hosting-platform library. This website is built and hosted on the Abacus.AI platform, which loads a script from apps.abacus.ai/chatllm/appllm-lib.js on every page. Loading it, like loading any web resource, causes your browser to send that provider your IP address and standard browser information. Abacus.AI acts as our hosting provider and is listed in Section 6.

5. Consent & Itemized Notice (DPDPA Section 5)

Where we process personal data on the basis of your consent, that consent is preceded or accompanied by a clear, itemised notice describing the personal data sought and the purpose of processing, consistent with the Section 5 notice structure, subject to the phased commencement described below. Each enquiry, intake and subscription form on our Platforms therefore carries an explicit consent notice in substantially the following terms:

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and may, where applicable, prevent us from continuing to provide a requested service.

6. Sharing With Data Processors

We do not sell or rent your personal data. In the course of operating the firm and delivering legal services, we engage a limited number of trusted third-party Data Processors, including:

• Website hosting, database and application platform (Abacus.AI), which hosts this website, stores enquiry and pageview records, and delivers enquiry notifications to the firm
• Enterprise cloud storage and productivity providers (for example, Microsoft 365 / OneDrive or Google Workspace)
• Secure, access-controlled email and document management services
• Encrypted legal billing and practice-management software

Each such processor acts only on our documented instructions and is bound by contractual confidentiality and data-protection obligations. We may also disclose information where required by law, court order, or a competent regulatory or statutory authority.

7. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, after which it is securely destroyed or anonymised:

• Enquiries: retention depends on the follow-up purpose, any resulting engagement and relevant legal or dispute requirements. Contact the privacy channel below to request deletion or confirmation of the period applicable to your record.
• Client files: the engagement terms and applicable legal, tax, professional and litigation requirements determine retention. There is no single statutory seven-year rule for every document or matter.
• Technical records: pageview and operational records require a separate retention assessment; they are not described here as automatically deleted by an unverified scheduled process.
• A legal hold or required retention may limit deletion. The applicable reason should be explained when responding to a request.

8. Legal Basis for Processing

8.1 India (DPDPA). Section 4 of the DPDPA permits processing of digital personal data only for a lawful purpose once the relevant provisions commence, on the basis of the Data Principal's consent under Section 6 or for certain legitimate uses under Section 7. We rely on:

• Consent (Section 6) for enquiries, subscriptions, prospective-client communications and the technical details recorded with a submitted enquiry, given after the itemised notice described in Section 5.
• Certain legitimate uses (Section 7) only where the use falls within that section, for example where you voluntarily provide personal data for a specified purpose and have not indicated that you do not consent (Section 7(a)), to fulfil a legal obligation to disclose information to the State (Section 7(d)), or to comply with a judgment, decree or order (Section 7(e)).
• Where you are a client, processing under the engagement is additionally governed by your Engagement Letter / Retainership Agreement.

8.2 EU / UK (GDPR, where applicable). Where the GDPR or UK GDPR applies, we rely on Article 6(1): consent (Art. 6(1)(a)) for enquiries and subscriptions; performance of a contract or steps prior to entering into one at your request (Art. 6(1)(b)) for engagement and intake; compliance with a legal obligation (Art. 6(1)(c)) for professional-conduct, tax and anti-money-laundering requirements; and, where justified by the necessary purpose and balancing assessment, legitimate interests (Art. 6(1)(f)) for limited first-party measurement. These GDPR grounds are not a substitute for the DPDP Act’s separate statutory grounds.

8.3 Pageview measurement. The pageview records in Section 4.1 contain no name, email address or IP address, and the session identifier is not retained on your device. These records are pseudonymous rather than guaranteed anonymous. The session can link browsing records to a submitted enquiry; use and rights must be assessed accordingly.

Commencement matters: the substantive processing duties, breach-reporting requirements and penalty adjudication provisions discussed here belong to the eighteen-month phase after Gazette publication under G.S.R. 843(E) and Rule 1. They are not yet operative. Existing CERT-In and other applicable legal obligations continue independently. Commencement authority.

9. Data Security

All personal data is protected using reasonable, industry-standard security safeguards, including encryption in transit, access controls on a need-to-know basis, and secure storage. We maintain strict confidentiality consistent with legal professional privilege and our client-confidentiality obligations. In the event of a personal-data breach, we will notify the Data Protection Board of India and affected individuals without delay under Rule 7 once operative, with the detailed Board report within 72 hours of awareness or a longer period the Board allows on written request. Applicable CERT-In and sectoral duties are assessed separately.

10. Your Rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we process about you
• Request correction, completion or updating of inaccurate data
• Request erasure of your data (subject to legal retention requirements)
• Withdraw consent at any time
• Nominate another individual to exercise your rights in the event of death or incapacity (DPDPA)
• Have your grievance redressed through the channel below
• Use the applicable complaint route, subject to commencement, jurisdiction and any requirement to first exhaust grievance redressal

11. Grievance Redressal & Exercise of Rights

To exercise any of the rights above, or to raise a complaint regarding your data, you may contact our designated Grievance Officer:

12. International Data Transfers

Hosting, support and communication can involve providers or processing outside India; this policy does not promise India-only storage or a particular data-centre location. For a transfer subject to the GDPR or UK GDPR, the applicable transfer mechanism and any required supplementary measures must be assessed. For DPDPA-covered processing, apply Section 16 and relevant Rules when operative, together with any stricter applicable sectoral restriction. A processor’s location or contract must be checked for the particular processing activity.

13. Contact Information

For general privacy queries you may also reach the firm at:

See also our contact page to reach a partner directly.

14. Updates to This Policy

We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices or applicable laws. Changes will be posted on this page; material changes will be communicated as required by applicable law.