Summary

City Law Practice (“CLP”) is a full-service law firm engaged in providing legal services under the laws of India (“Services”) with offices in India.

CLP owns and manages the website www.citylaw.co.in (“Website”). 

This Privacy Notice (“Policy”) describes the treatment of information provided or collected by CLP.

This Policy is published in compliance with the laws of the Republic of India (“applicable law”) including the  Information Technology Act, 2000 (“IT Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) and Information Technology (Intermediaries Guidelines) Rules, 2011 (“IT Intermediary Rules”). 

For the purposes of this Policy, the term “Platform” shall mean and include the Website and other digital platforms and service operated by us (or on our behalf) that may be displayed on various online, mobile or other platforms and environments, including those operated by third parties, which permits us to share information with all those who access it on the internet. 

We respect your privacy and are committed to protecting your personal data. We have measures in place to safeguard your personal data when we transfer it internationally. We take steps to minimise the amount of personal data we hold about you and to keep it secure. We delete your personal data when we no longer need it, and we have policies in place to govern when that is. You have a number of rights in relation to your personal data. For further details about how we process your personal data, please see the relevant Privacy Notice below. 

If you have any questions about how we use your data, please contact our Data Protection Officer at [email protected].

General 

By accessing or using our Platform or by otherwise giving us your information, you confirm that you have the capacity to enter into a legally binding contract and have read, understood and agreed to the practices and policies outlined in this Privacy Policy.

You hereby consent to our collection, use, sharing, and disclosure of your information as described in this Privacy Policy.

We may modify, add or delete from, this Privacy Policy from time to time, and your continued access to, or use of the Platform, will be deemed to be an acceptance of the said changes. If you do not agree with this Privacy Policy at any time, in part or as a whole, do not access/use the Platform or services provided through the Platform, or provide us with any of your information.

If you are accessing or using the Platform from any location outside India, you do so at your own risk, and will be solely liable for compliance with any local laws, as may be applicable.

Who are you?

This Privacy Notice applies to all current clients/users, former clients/users and potential clients/users of  CLP and anyone accessing or using the Platform, or otherwise engaging with us through email or other means (“you” and “your”).   

You should read this Privacy Notice so that you know what personal data we collect about you, how we collect it and what we do with it and how you can exercise your rights in connection with it: 

2. The data we collect about you

3. How we use your personal data and legal basis for doing so

4. Who we share your personal data with

5. International transfers

6. Data security

7. Retention of personal data

8. How to access your information and your other rights

9. Changes to this Privacy Notice

By using our Website/ Platform, you are hereby consenting to collection of your information by us. However, for the avoidance of doubt we do not  request you to share sensitive personal data or information.

Type of Information Collected and Manner Collection of Information 

We collect the following types of information about you, both through offline documentation that you may provide, as well as when you use our Platform or indirectly by using different technologies.

In order to access our Platform, you may be required to provide us with information in the nature of your name, email address, mobile number, the company/ organization you work for, title, designation, physical addresses (collectively, “User Information”).

We may also collect User Information when you visit any of our offices to enquire about, or avail our Services or attend any seminars, webinars, conferences or events organised by us. Further, we may collect User Information that you provide us with for attending meetings held at our offices such as accessibility and dietary requirements. Such User Information can imply or suggest a member’s health or other information which may include SPDI (as defined below). You agree and acknowledge that such information is only collected temporarily for the aforesaid limited purposes and consent to our collection thereof.

We may collect from you information which is not unique to you such as age, gender, current location details; and/or (ii) information about how you use the Platform and information about your mobile device and software including usage statistics, traffic data, your IP address, browser and operating system type, domain names, access times, locations, and details regarding the parts of the Platform that you access; and (iv) use of certain third party services on the Platform also requires us to collect such information as is considered necessary for that purpose. 

The SPDI Rules further define “Sensitive Personal Data or Information” (“SPDI”) of a person as Personal Information about that person relating to: (i) password; (ii) financial information such as bank account or credit card or debit card or other payment instrument details; (iii) physical, physiological and mental health conditions; (iv) sexual orientation; (v) medical records and history; (vi) biometric information; (vii) any detail relating to the above clauses as provided to body corporate for providing service; and (viii) any of the information received under above clauses by body corporate for processing, stored or processed under lawful contract or otherwise; provided that any information that is freely available or accessible in public domain or furnished under the Right to Information Act, 2005 or any other law for the time being in force shall not be regarded as sensitive personal information.

Each of the above have been defined collectively as  “Information”).

While other Information will be collected when you access or use our Platform, we collect User Information only from you with your prior consent unless there are other legal grounds for doing so, as further specified in this Privacy Policy. Where you provide us with User Information of third parties, we understand that you have obtained consent of such third parties, and have sufficient rights, approvals and licenses to provide such information to us.

We collect User Information only from you with your prior consent unless there are other legal grounds for doing so, as further specified in this Privacy Policy. Where you provide us with User Information of third parties, we understand that you have obtained consent of such third parties, and have sufficient rights, approvals and licenses to provide such information to us.

We understand that all Personal Information provided by you to us is provided voluntarily. Collection, use and disclosure of Personal Information requires your express consent, unless there are other legal grounds available to us to collect such information as further specified in this Privacy Policy. By using or accessing the Platform or otherwise providing us with Your Personal Information, where applicable, you are providing us with your consent to our use, collection, retention, transfer and disclosure of the Personal Information in accordance with the terms of this Privacy Policy. In the event of a change in the law applicable to data protection in India, you hereby expressly consent to our continued use, storage, collection and disclosure of your Information including Personal Information to the fullest extent permitted under such applicable law. We may reach out to you for obtaining additional consents and approvals as required under the amended law and You will be required to comply with such requests. Should you choose to not provide us with such additional consents and approvals, we may have to discontinue your access to the Platform.

We do not collect your information for any other purposes except to facilitate learning. Being a responsible law firm, we are wholly committed to following the laws of the Republic of India, and the guidelines applicable to advocates as set out by the Bar Council of India. The information collected by us is not intended to make any inducements towards you, nor to solicit any work or invite work, nor can it under any circumstances be said to be us advertising ourselves to you. 

You may choose to not provide us with or withdraw any or all information included under Personal Information, but in the event that you do so, we may be unable to allow you to access the Platform or otherwise avail services for the provision of which your information is being collected or processed.

How we use your personal data and legal basis for doing so 

We may use your information for the following purposes:

Action

Reason

Legal basis

Responding to enquiries

Our website allows you to request information about our services using an electronic enquiry form.

Contact information is required in each case, together with details of other personal data that is relevant to your service enquiry.

This information is used to enable us to respond to your requests.

We are using your data with your consent to respond to your enquiry. and to communicate information to you, including notifications of any alerts, or any updates to the Platform;

To contact you from time to time to record your valuable feedback on our Platform, as they currently stand, and/or any potential services that may be offered in the future;

Fulfilment of services

We collect and maintain personal data that you voluntarily submit to us to enable us to provide our services.  In order to do this, we need to enter your data onto our systems. 

Legitimate interest.

Fulfilment of services

It is necessary for us to process your information to perform our obligations in accordance with any contract that we may have with you.  This includes recording how much time we spend on your matter(s) and taking payment information.

We have a contract with you.

Fulfilment of services

We need to ensure that we provide the best client service that we can to you or others.

It is in our legitimate interest or a third party’s legitimate interest to use your personal data this way.

Resolving complaints or disputes

We need to be able to resolve any complaints or disputes with you.

Legitimate interest.

Legal compliance

We use your personal data to comply with our legal obligations, including anti-money laundering, conflicts and our regulatory and statutory obligations.

It is our legal obligation to use your personal data to comply with any legal obligations imposed upon us.

Marketing communications

For clients and prospects, we use your personal data to send you information about our services which may be of interest to you.  We may also conduct surveys to improve our services. 

It is in our legitimate interest to use your personal data for marketing purposes and you can unsubscribe at any time. 

Internal books and records 

For Our internal operational purpose such as record keeping, accounting and compliance with applicable taxation laws

Our business requirements – legitimate interests

Action

Reason for processing – legitimate interest

Managing our global business and marketing strategies (including recording and reporting on our business development activities).

We need to have business development and marketing strategies.

Purchasing, maintaining and claiming against our insurance policies.

We need to protect our business.

Continuously reviewing and improving our services and developing new ones.

We use your feedback to improve our services. 

Obtaining legal advice, establishing, defending and enforcing our legal rights and obligations in connection with any legal proceedings or prospective proceedings.

We need to understand our obligations and establish and defend our legal rights. 

Monitoring and producing statistical information regarding the use of our platforms, and analysing and improving their functionality.

We need to ensure that our website and other platforms are working properly.

Maintaining the security of our systems, platforms, premises and communications, including detecting and preventing threats. 

We need to ensure that our premises and our platforms are secure.

Managing the proposed sale, restructuring, transfer or merging of any or all part(s) of our business, including responding to queries from the prospective buyer or merging organisation.

We need to be able to manage or sell parts of our business, if we choose to do so.

We may use social media platform such as LinkedIn, Twitter and Facebook. 

If you connect with us through any of these services, then such engagement will be subject to the terms of service and privacy policy of the relevant social media platform and you should review the same before connecting with us on such social media platform.

We have a legitimate interest in using your personal data for the above purposes.  We have balanced your rights and freedoms against our business needs.  Please inform us if you object to our processing or wish to opt out of receiving communications such as information regarding the Platform and/or any regulatory updates provided by us, you may do so by emailing us with “unsubscribe” at [email protected]

Our reason for processing your data

Action

Reason for processing – legitimate interest

Hosting you at our offices for seminars, workshops, events, etc and providing hospitality services.

Explicit consent for us to use either your health or religious information to provide refreshments.

Accidents or emergencies while you are at our office.

it is necessary for us protect your vital interests or when you are incapable of giving consent.

Providing you with legal advice and regulatory updates.

It is necessary for the establishment, exercise or defence of legal claims.

Investigating, evaluating, demonstrating, monitoring, improving and reporting on our compliance with our legal and regulatory requirements (such client verification checks).

Substantial public interest.

Complying with regulatory requirements involving steps being taken to establish the existence of any unlawful act, dishonesty, malpractice or other serious improper conduct.

Substantial public interest.

Responding to binding requests or search warrants or orders from courts, governmental, regulatory and/or enforcement bodies and authorities or sharing information (on a voluntary basis) with the same.

Substantial public interest.

Obtaining legal advice, establishing, defending and enforcing our legal rights and obligations in connection with, any legal proceedings, including prospective proceedings.

Substantial public interest.

Optimization of our website and blogs, and to protect it from attacks. 

Conducting other business development activities which serve the legitimate interests of the users to receive training in legal matters and know-how and serves our legitimate interests to develop our business and promote client relationships.

Who we share your personal data with

We may share personal data with a variety of the following categories of third parties as necessary:

Entity

Legal basis for sharing

Our professional advisers such as lawyers and accountants.

Legitimate interest.

Government or regulatory authorities or law enforcement. 

Legal obligation.

Professional indemnity or other relevant insurers.

Legitimate interest.

Regulators/tax authorities/corporate registries.

Legal obligation.

Third parties to whom we outsource certain services such as, without limitation, document processing and translation services, confidential waste disposal, IT systems or software providers, IT support service providers, document and information storage providers.

Legitimate interest.

Third parties engaged in the course of the services we provide to clients such as counsel, arbitrators, mediators, clerks, witnesses, cost draftsmen, court, opposing party and their lawyers, document review platforms and experts such as tax advisers or valuers.

Legitimate interest or a contractual requirement to provide our services.

Third party service providers / aggregators  to assist us with client insight analytics, such as Google Analytics.

Consent.

Please note this list is non-exhaustive and there may be other examples where we need to share personal data with other parties in order to provide our services as effectively as we can.

We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process personal data appropriately and according to our legal and regulatory obligations.

Further, we may appoint external data service providers / agents  where necessary to deliver the services (for example, accountants, barristers or other third party experts).  When doing so we will comply with our legal and regulatory obligations in relation to the personal data and put appropriate safeguards in place.

The Platform may contain links to third party websites and services (“Third Party Services”). We have no control over such Third Party Services, which are provided by persons or companies other than us. We are not responsible for any collection or disclosure of your information by such companies or persons thereof. Further, we are not liable for any loss or damage which may be incurred by you as a result of the collection and/or disclosure of your information via Third Party Services. We shall not be liable for any disputes arising from or in connection with such transactions between you and the aforementioned third parties. Such third party websites, and external applications or resources, accessible via the Platform may have their own privacy policies governing the collection, storage, transfer, retention and/or disclosure of our information that you may be subject to. We recommend that you exercise reasonable diligence, as you would in traditional offline channels and practice judgment and common sense before committing to any transaction or exchange of information, including but not limited to reviewing the third party website or application’s privacy policy. 

You may also submit your curriculum vitae (CV) to us through the appropriate mechanism provided for on the website. However, it is expressly clarified that submission of your CV does not mean that we shall review it, nor does it under any circumstance imply that we shall write back to you either rejecting your proposal to work for us, or accepting it. Replying to any CVs received will be at CLP’s sole discretion, and you explicitly agree that you shall have no right or remedy in that regard. Submission of a CV does not also mean any solicitation, inducement or offer to work with us or for us or for any person(s) (either legal or natural) on our behalf. In the event that you choose to submit your CV to us, you agree to the conditions set out in this paragraph.

6. Data security

We are committed to keeping the personal data provided to us secure and we have implemented appropriate information security policies, rules and technical measures to protect the personal data that we have under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss.

All of our partners, employees, consultants, workers and data processors (i.e. those who process your personal data on our behalf, for the purposes listed above), who have access to, and are associated with the processing of personal data, are obliged to respect the confidentiality of such personal data.

 Further, we shall not be responsible for any breach of security or for any actions of any third parties or events that are beyond our reasonable control including but not limited to acts of government, computer hacking, unauthorised access to computer data and storage device, computer crashes, breach of security and encryption, etc

7. Retention of personal data

By law, we have to keep basic information about our clients (including contact, identity, financial and file information) for a minimum of six years, and in some cases up to twelve years, after they cease being clients; of it being reasonable to assume that (i) the purpose for which that Personal Information was collected is no longer being served by the retention of such Personal Information; and (ii) retention is no longer necessary for any other reason including applicable law.

We, however, reserve the right to retain, store and use your Information including Personal Information for our business purposes, whether such Information has been deleted or not. After a period of time, our data may be anonymized and aggregated, and then may be held by us as long as necessary for us to provide Our Services effectively. 

Please note that your withdrawal of consent to use your Personal Information may result in us not being able to provide you with access to the Platform, or terminate any existing relationship that we may have with you.

8. How to access your information and your other rights

You have the following rights in relation to the personal data that we hold about you:

  • Your right of access: if you ask us, we will confirm whether we are processing your personal data and, if necessary, provide you with a copy of that personal data (along with certain other details).  If you require additional copies, we may need to charge a reasonable fee.
  • Your right to rectification: if the personal data that we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified.  If you are entitled to rectification and if we have shared your personal data with others, we will let them know about the rectification where possible.  If you ask us, where possible and lawful to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.
  • Your right to erasure: you can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable).  If you are entitled to erasure and if we have shared your personal data with others, we will let them know about the erasure where possible.  If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.
  • Your right to restrict processing: you can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you raise an objection with us.  If you are entitled to restriction and if we have shared your personal data with others, we will let them know about the restriction where it is possible for us to do so.  If you ask us, where it is possible and lawful for us to do so, we will also inform you who we have shared your personal data with so that you can contact them directly.
  • Your right to data portability: you have the right, in certain circumstances, to obtain personal data that you have provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
  • Your right to object: you can ask us to stop processing your personal data, and we will do so, if we are: 
    • relying on our own or someone else’s legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or
    • processing your personal data for direct marketing purposes.
  • Your right to withdraw consent: if we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
  • Your right to lodge a complaint with the Supervisory Authority: if you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, you can report it to the Supervisory Authority in your country.  We would, however, appreciate the chance to deal with your concerns before you approach the Supervisory Authority, so please contact us in the first instance.

Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the data, or where data may be exempt from disclosure due to reasons of legal professional privilege or professional secrecy obligations.

9. Changes to this Privacy Notice

To ensure that you are always aware of how we use your personal data, we will update this Privacy Notice from time to time to reflect any changes to our use of your personal data.  We may also make changes as required to comply with changes in applicable law or regulatory requirements.  Where it is practicable, we will notify you by email of any significant changes.  However, we encourage you to review this Privacy Notice periodically to be informed of how we use your personal data. 

Disclaimer

We cannot ensure that all of your Information including Personal Information will never be disclosed in ways not otherwise described in this Privacy Policy. Therefore, although we are committed to protecting your privacy, we do not promise, and you should not expect, that your Information or private communications will always remain private. As a user of the Platform, you assume all responsibility and risk for your use of the Platform, the internet generally, and the information you post or access and for your conduct on and off the Platform.

Indemnity

You agree and undertake to indemnify us in any suit or dispute by any third party arising out of disclosure of information by you to third parties either through our Platform or otherwise, and your use and access of websites, applications and resources of third parties. We assume no liability for any actions of third parties with regard to your Information or Personal Information which you may have disclosed to such third parties.

Grievance Officer and contact information

In accordance with the IT Act and rules made there under, the name and contact details of the Grievance Officer are provided below:

Mr. Ajit Mishra 

You may write to him at the address of our head office in India.