Privacy Policy

1. Overview

This Privacy Policy ("Policy") describes how LexWiser ("we", "us", "our"), acting as a Data Fiduciary under the Digital Personal Data Protection Act, 2023, collects, processes, stores, shares, and protects the personal data of its clients, prospective clients, and website visitors ("you", "Data Principal").

This Policy is prepared and published in compliance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act") and all rules notified thereunder
• The Information Technology Act, 2000 ("IT Act")
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
• The Bar Council of India Rules on professional conduct and client confidentiality
• Applicable Indian anti-money laundering legislation and rules, to the extent applicable

By using our website lexwiser.in, submitting our contact form, communicating with us on WhatsApp or email, or engaging our legal services, you acknowledge that you have read and understood this Policy.

2. Who We Are: Our Role as Data Fiduciary

Under Section 2(i) of the DPDP Act, a "Data Fiduciary" is any person who alone or in conjunction with others determines the purpose and means of processing of personal data. LexWiser is the Data Fiduciary for all personal data collected through this website and in connection with our legal services.

Where we engage third-party service providers (e.g. web hosting, payment gateways) who process data on our instructions, those providers act as "Data Processors" under Section 2(k) of the DPDP Act. We remain responsible for ensuring they handle your data in accordance with this Policy and applicable law.

3. Consent Notice (Section 5, DPDP Act 2023)

The DPDP Act requires every Data Fiduciary to provide a clear, standalone notice to the Data Principal before or at the time of collecting personal data. This section constitutes that notice.

This notice is written in plain English. If you require this notice in Hindi or any other Scheduled language, please contact us at hello@lexwiser.in and we will provide it.

4. Consent and Withdrawal (Section 6, DPDP Act 2023)

4.1 How We Obtain Consent

Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, and must be signified by a clear affirmative action. We obtain consent through the following affirmative acts:

• Submitting our contact / enquiry form on lexwiser.in
• Sending us a message on WhatsApp or email
• Calling us or accepting our call to discuss a legal matter
• Signing an engagement letter or client agreement
• Providing documents to us for the purpose of legal advice or representation

We do not treat silence, inactivity, pre-ticked boxes, or continuing to browse our website as consent to process your personal data.

4.2 Granularity and Specificity of Consent

Your consent is sought separately for each distinct purpose. Consent given for one purpose does not authorise us to process your data for a different purpose. For example:

• Consent to handle your trademark matter does not extend to using your contact details for marketing
• Consent to process your GST registration does not authorise sharing your financial data with any third party not involved in that matter

4.3 Withdrawing Your Consent

You may withdraw your consent at any time and it must be as easy to withdraw as it was to give, per Section 6(4) of the DPDP Act. To withdraw consent:

• Email us at hello@lexwiser.in with subject: "Withdraw Consent: [Your Name]"
• We will acknowledge within 48 hours and process within 15 days
• Withdrawal does not affect the lawfulness of processing already carried out before the withdrawal
• If you withdraw consent during an active legal engagement, we may be unable to continue providing legal services. We will advise you accordingly before acting on any withdrawal

4.4 Consent for Sensitive Personal Data

Where we process Sensitive Personal Data or Information ("SPDI") as defined under the SPDI Rules 2011 (such as financial information, health records, or information relating to criminal proceedings), we obtain your explicit written consent before collection. This consent is obtained separately from general consent and specifies the exact category of SPDI being collected and the specific purpose.

5. Legitimate Uses Without Consent (Section 7, DPDP Act 2023)

Section 7 of the DPDP Act permits processing of personal data for certain "Legitimate Uses" without requiring consent. We rely on these in the following situations:

We do not rely on legitimate use as a blanket override to avoid obtaining consent. Legitimate use is invoked only where the specific statutory condition is genuinely met.

6. Personal Data We Collect

6.1 Data You Provide Directly

• Identity Data: Full name, father's/spouse's name (where relevant to your matter), PAN, Aadhaar number (only where legally required, e.g. for certain MCA/GST filings)
• Contact Data: Email address, mobile number, WhatsApp number, postal address
• Business Data: Business name, CIN/LLPIN/PAN of entity, GSTIN, business address, nature of business
• Matter Data: Nature of legal query, facts of your matter, documents, correspondence, instructions
• Financial Data: Payment reference numbers, invoice details (we do not store credit/debit card numbers)
• Communication Data: Emails, WhatsApp messages, call records, and notes of in-person consultations
• Sensitive Personal Data (SPDI): Financial statements, health-related data, criminal proceedings-related data. Collected only with explicit written consent and only where strictly necessary for your matter

6.2 Data Collected Automatically

• Technical Data: IP address, browser type and version, device type, operating system, time zone, referring URL
• Usage Data: Pages visited, links clicked, time on site, navigation patterns
• Cookie Data: Session identifiers and preference data (see Section 16)

We do not collect any data not listed above. We do not collect biometric data, social media data, or political/religious affiliation data.

7. How We Collect Your Data

• Contact Form: Submissions on lexwiser.in covering name, phone, email, service required, and a brief query description
• WhatsApp: Messages and documents you send to our WhatsApp number
• Email: Emails you send to hello@lexwiser.in
• Telephone: Information shared during calls with us
• In-Person / Office Visit: Documents and information provided at our office
• Physical Documents: Documents sent by courier or handed over personally
• Third-Party Referrals: Where a referee provides your name and phone number to introduce you to us. We will inform you of this at first contact
• Automatic Collection: Via cookies and server logs when you visit lexwiser.in
• Government Portals: Publicly available data from MCA, IP India, GST portals, accessed only where relevant to your legal matter

8. Purpose of Processing

Under the DPDP Act, personal data must be processed only for a lawful purpose for which consent has been given or which constitutes a Legitimate Use. The table below sets out every purpose for which we process your data:

We will never process your data for a purpose other than those listed above without first obtaining fresh, specific consent from you.

9. Data Minimisation and Quality (Sections 8(3) and 8(4), DPDP Act)

Under Section 8(3) of the DPDP Act, a Data Fiduciary must ensure that personal data processed is complete, accurate, and consistent with the purpose of processing. Under Section 8(4), personal data must be collected only to the extent necessary for the specified purpose ("data minimisation").

We implement data minimisation and quality as follows:

• Our contact form collects only: name, phone, email, service required, and a brief description of your query. No other fields are mandatory
• We do not ask for Aadhaar, PAN, or financial information at the enquiry stage. These are collected only when required to perform a specific service
• We do not collect information about your caste, religion, political affiliation, sexual orientation, or any other sensitive data unrelated to your legal matter
• If you provide us with more information than strictly necessary, we will use only what is relevant and flag the excess to you
• We update or correct your data promptly upon your request or upon discovering an inaccuracy (see Section 17, Your Rights)

10. Storage and Security Safeguards (Section 8(5), DPDP Act)

Section 8(5) of the DPDP Act requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. We implement the following:

• TLS Encryption: All data transmitted between your browser and lexwiser.in is encrypted using TLS 1.2 or higher
• Access Controls: Access to personal data is strictly limited to persons directly handling your matter on a need-to-know basis
• Password Protection: Electronic client files are stored in password-protected environments
• Secure Communications: Sensitive documents are transmitted via password-protected email or secure sharing links. We avoid plain WhatsApp for highly sensitive material wherever possible
• Physical Security: Physical files are stored in locked cabinets; our office premises are secured
• No Public Networks: Client data is never accessed or transmitted over unsecured public Wi-Fi
• Vendor Security: Our hosting provider (Bluehost) maintains industry-standard security certifications. We ensure all third-party processors with whom we share data have appropriate security safeguards
• Internal Policy: All persons with access to client data are trained on confidentiality obligations and bound by professional secrecy obligations under Bar Council of India Rules

11. Personal Data Breach (Section 8(6), DPDP Act)

A "personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data (Section 2(s), DPDP Act).

Our obligations in the event of a breach:

• Under Section 8(6) of the DPDP Act, we are required to notify the Data Protection Board of India and each affected Data Principal of any personal data breach in the manner and within the timeframe prescribed by the rules under the Act
• Notification to you will include: the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures we have taken or propose to take to address the breach
• We maintain an internal incident response procedure to detect, contain, and report data breaches promptly
• If you believe your data held by us has been compromised, please notify us immediately at hello@lexwiser.in. We will investigate and respond within 48 hours

12. Retention and Erasure (Section 8(7), DPDP Act)

Under Section 8(7) of the DPDP Act, a Data Fiduciary must erase personal data as soon as it is reasonable to assume that the specified purpose is no longer being served, and retention is not required for compliance with any law.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with you. We conduct periodic data audits to ensure timely deletion.

13. Sharing Your Personal Data

We do not sell, rent, or trade your personal data to any third party. We do not share your data with advertisers, marketing agencies, or data brokers.

We may share your personal data in the following limited and controlled circumstances:

13.1 With Your Express Consent

Where you have given explicit consent, for example by instructing us to share documents with a co-counsel, forensic expert, chartered accountant, or any other professional engaged on your behalf.

13.2 For Performance of Your Legal Matter

• Government Authorities: IP India (Trade Marks Registry), Ministry of Corporate Affairs (MCA21), GST Network, Income Tax Department, and other competent authorities, to the extent required to file your application or comply with their requirements
• Courts and Tribunals: As required for filing plaints, applications, replies, or any court document on your behalf
• Opposing Parties: Only to the extent legally required and unavoidable in the course of legal proceedings

13.3 Legal and Regulatory Obligations

• Where required by a court order, summons, or direction of a statutory authority
• Where required under Indian anti-money laundering legislation to report to the Financial Intelligence Unit (FIU-IND)
• Where required by the Bar Council of India or any disciplinary authority
• To enforce our Terms of Service or protect our rights in a legal dispute

13.4 Data Processors (Service Providers)

• Web Hosting via Bluehost (US): Stores our website and contact form data under contractual data processing obligations
• Email Infrastructure: Our email provider processes contact form submissions forwarded to hello@lexwiser.in
• Payment Gateway (if applicable): Payments processed directly by the gateway under its own privacy policy. We do not receive or store card or bank account numbers
• Analytics (if applicable): Anonymised, aggregated usage data only. No personally identifiable data is shared with analytics providers

All our Data Processors are contractually bound to: (a) process data only on our written instructions; (b) maintain appropriate security measures; (c) not sub-process without our authorisation; and (d) delete or return data upon termination of services.

14. Cross-Border Data Transfers (Section 16, DPDP Act)

Section 16 of the DPDP Act empowers the Central Government to restrict transfer of personal data to certain countries or territories. Our cross-border data flows are as follows:

• Web Hosting via Bluehost (USA): Contact form data and website data is stored on servers in the United States. Bluehost complies with applicable data security standards. We ensure this transfer is governed by contractual data processing terms
• WhatsApp (Meta Platforms, USA): Messages sent via WhatsApp are processed on Meta's global infrastructure. Please refer to WhatsApp's Privacy Policy for details
• Email: Emails may transit through servers in multiple jurisdictions as part of standard internet routing

We do not transfer your substantive legal matter data (case files, strategy, or confidential documents) to any overseas server or jurisdiction, except where required by the nature of your specific legal matter (for example, an international trademark filing).

As and when the Central Government notifies countries to which cross-border transfers are restricted under the DPDP Act, we will review and update our data transfer practices to remain compliant.

15. WhatsApp Communication

WhatsApp is our primary channel for client updates and document sharing. By messaging us on WhatsApp or providing your WhatsApp number in our contact form, you consent to receiving communications from us via WhatsApp.

• WhatsApp provides end-to-end encryption for messages. However, once messages are received, they are stored on the devices of both parties and on WhatsApp's servers. We cannot guarantee absolute security on third-party platforms
• We retain WhatsApp communications relating to your matter for the periods in Section 12
• Do not share PAN cards, Aadhaar copies, bank statements, or passwords over WhatsApp. Use encrypted email or hand over physical copies at our office instead
• You may opt out of WhatsApp communication at any time. We will switch to email or telephone upon your request
• WhatsApp is subject to Meta's Privacy Policy

16. Cookies

Our website uses cookies to function properly and to improve your experience. Under the DPDP Act, where cookies collect personal data, appropriate notice and consent are required.

To manage or disable cookies, adjust your browser settings. Note: disabling strictly necessary cookies may cause parts of the site to stop functioning. You may also opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on.

17. Your Rights as a Data Principal (Sections 11 to 14, DPDP Act)

Sections 11–14 of the DPDP Act confer the following rights on every Data Principal:

How to exercise your rights: Send a written request to hello@lexwiser.in clearly identifying yourself and specifying the right you wish to exercise. We may ask for proof of identity before actioning your request to protect against fraudulent requests.

18. Your Duties as a Data Principal (Section 15, DPDP Act)

The DPDP Act is the first Indian privacy law that imposes duties on Data Principals (individuals) in addition to rights. Section 15 requires every Data Principal to:

• Comply with applicable laws: Not provide false or misleading information while exercising rights or making requests
• Not impersonate: Not impersonate another person when providing personal data to a Data Fiduciary
• Not suppress material information: Not wilfully suppress any material information while seeking a service that requires authentic personal data
• Not register false or frivolous grievances: Not make complaints or grievances that are false, vexatious or frivolous
• Not make false claims: Not furnish false particulars or impersonate another person in the exercise of rights under the DPDP Act

Violation of Section 15 duties may attract civil penalties under Section 25 of the DPDP Act, up to ₹10,000 per violation as determined by the Data Protection Board. As your legal counsel, we also draw your attention to the fact that providing false information in the context of legal proceedings may constitute an offence under the Indian Penal Code and other applicable laws.

19. Children's Personal Data (Section 9, DPDP Act)

Section 9 of the DPDP Act imposes specific obligations on Data Fiduciaries when processing personal data of children (persons under 18 years of age).

19.1 Verifiable Parental Consent

Before processing any personal data of a child, we are required under Section 9(1) to obtain verifiable consent of the parent or lawful guardian of the child. We will not knowingly collect personal data from any child without such consent.

19.2 No Tracking or Behavioural Monitoring of Children

Under Section 9(3), a Data Fiduciary must not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. We do not engage in any such activities. Our website contains no advertising and we do not use profiling cookies.

19.3 Minors as Parties to Legal Matters

Where a minor is a party to a legal matter (e.g. a child's custody matter, a minor's property dispute, or a case involving a juvenile), we:

• Deal exclusively with the minor's parent, natural guardian, or court-appointed guardian
• Obtain explicit written consent from the guardian before collecting any data relating to the minor
• Collect only the minimum data necessary for the specific legal matter
• Apply the highest standard of confidentiality to data relating to minors

19.4 If You Believe a Child's Data Has Been Submitted

If you believe a child under 18 has submitted personal data to us without parental consent, please contact us immediately at hello@lexwiser.in. We will investigate and delete the data promptly.

20. Attorney-Client Privilege and Professional Confidentiality

Over and above this Privacy Policy, all information shared with us in the context of a legal engagement is protected by:

• Section 126 of the Indian Evidence Act, 1872: No barrister, attorney, pleader or vakil shall at any time be permitted to disclose any communication made to him in the course of his employment as such barrister, pleader, attorney or vakil, by or on behalf of his client
• Rule 17, Bar Council of India Rules: An advocate shall not commit a breach of the obligations imposed by Section 126 of the Indian Evidence Act
• Rule 36, Bar Council of India Rules: Prohibition on communicating with the opposite party without the consent of their advocate

Attorney-client privilege belongs to you as the client, not to us. We will:

• Assert privilege over your confidential communications to the fullest extent permitted by law before making any disclosure
• Never waive privilege on your behalf without your express, informed consent
• Resist any subpoena, notice, or order requiring disclosure of privileged communications until all legal avenues to protect privilege have been exhausted
• Inform you immediately if we receive any direction that requires or risks disclosure of your confidential information

Please note: privilege does not apply where you seek our assistance in carrying out a crime or fraud. In such circumstances, we are obligated to decline instructions and, where required by law, to report to the appropriate authority.

21. Third-Party Links and Services

Our website may link to government portals (MCA21, IP India, GST Portal, Income Tax e-filing), WhatsApp, and other third-party services. Once you leave lexwiser.in, this Privacy Policy does not apply. We encourage you to read the privacy policies of any third-party website you visit. We are not responsible for their content or privacy practices.

22. Changes to This Policy

We may update this Policy to reflect changes in the law (including rules notified under the DPDP Act), our practices, or our services. The "Last Updated" date at the top of this page always reflects the most recent revision.

For material changes, particularly changes that expand how we use your data or reduce your rights, we will notify you by displaying a prominent notice on our website and by emailing you if you are an existing client, at least 15 days before the change takes effect.

Your continued use of our services after notification of a material change constitutes acceptance of the revised Policy. If you do not accept the revised Policy, you may withdraw consent and discontinue using our services.

23. Grievance Officer (Section 13, DPDP Act and SPDI Rule 5(9))

Rule 5(9) of the SPDI Rules 2011 and Section 13 of the DPDP Act require every Data Fiduciary to designate a Grievance Officer. Our designated Grievance Officer is:

Process for raising a grievance:

1. Email the Grievance Officer at hello@lexwiser.in with subject "Privacy Grievance: [Your Name]"
2. Include: your full name, contact details, nature of your grievance, and the specific right or provision you believe has been violated
3. We will acknowledge within 48 hours
4. We will provide a substantive response and resolution (or reasoned explanation) within 30 days of receipt
5. If we require additional time due to complexity, we will notify you of the expected resolution date

24. Data Protection Board of India (Sections 18 to 27, DPDP Act)

The DPDP Act establishes the Data Protection Board of India ("DPB") as an independent adjudicatory body with powers to investigate complaints, issue directions, and impose financial penalties on Data Fiduciaries.

You may approach the Data Protection Board if:

• You have submitted a grievance to our Grievance Officer and are not satisfied with the response, or have not received a response within 30 days
• You believe we have violated any provision of the DPDP Act in relation to your personal data

Penalties under the DPDP Act (Schedule):

Note: The Data Protection Board is yet to be formally constituted as of the date of this Policy. Once operational, complaints may be filed through the mechanism prescribed by the Central Government.

25. Contact Us

For any questions about this Privacy Policy or how we handle your data:

---

This Privacy Policy is governed by the laws of India. Any disputes arising under or in connection with this Policy shall be subject to the jurisdiction of the courts in Delhi, India, and to the authority of the Data Protection Board of India under the DPDP Act, 2023.

© 2026 LexWiser. All rights reserved. This Policy was last reviewed on 04 August 2026.