---

1. Data fiduciary

The Data Fiduciary (as defined under the DPDP Act) for this Website is:

2. Personal data we collect

We collect personal data only for lawful purposes and only to the extent necessary for those purposes. The categories of data we collect depend on how you interact with the Website:

When you contact us or request a meeting: Name, email address, mobile number, subject matter of inquiry, and any information you provide in the message field.

When you subscribe to newsletters: Name and email address. We publish multiple newsletters (Global Legal Updates, FutureAI, and others) and will use your email only for the newsletters you have subscribed to.

When you purchase digital content (eBooks, study materials): Name, email address, billing address, and payment details. Payment processing is handled by Razorpay; we do not store your credit card or bank account details on our servers.

When you apply for a position: Name, email, mobile number, qualifications, CV, Bar Council details, and any other information you submit through the application form.

Automatically collected data: When you browse the Website, our servers and third-party analytics services (such as WordPress.com/Jetpack analytics) automatically collect your IP address, browser type, pages visited, time spent on each page, referring URL, and device information. This data is collected through cookies and similar technologies.

3. Purpose of data collection

We process your personal data for the following purposes: responding to your inquiries and scheduling consultations; delivering newsletters and legal updates you have subscribed to; processing purchases of eBooks and digital content, and delivering licensed content to you; evaluating employment applications; improving the Website’s content, functionality, and user experience; complying with legal obligations, including requirements under Indian law; and protecting the rights, property, or safety of the Firm, its users, or others.

4. Lawful basis for processing

Under the DPDP Act, we process your personal data on the basis of your consent (provided when you submit a form, subscribe, or make a purchase), for the performance of a contract (such as delivering eBook licences), and for compliance with legal obligations. You may withdraw your consent at any time by contacting us at info [at] pkpandya [dot] com, subject to the consequences of such withdrawal as provided under law.

5. Data sharing and disclosure

We do not sell, rent, or trade your personal data. We may share your data with: payment processors (Razorpay) for completing transactions; email service providers for delivering newsletters; website hosting and analytics providers (WordPress.com/Automattic); professional associates such as chartered accountants and law firms, only to the extent necessary to service your matter and with your knowledge; and government, regulatory, or judicial authorities when required by law, court order, or legal process.

6. Cookies

The Website uses cookies — small text files placed on your device — to enable core functionality, remember your preferences, and understand how visitors use the site. We use necessary cookies (required for the Website to function), analytics cookies (to understand traffic patterns and improve content), and functional cookies (to remember your preferences such as cookie consent choices). You can manage your cookie preferences through the cookie banner displayed on your first visit, or through your browser settings. Our detailed cookie inventory is available on our Cookie Policy page.

7. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Contact form submissions and meeting requests are retained for two years from the date of last communication. Newsletter subscription data is retained until you unsubscribe. Purchase records are retained as required by applicable tax and accounting regulations. Employment application data is retained for one year from the date of submission, unless the application results in engagement. When retention is no longer necessary, data is securely deleted or anonymised.

8. Data security

We implement reasonable security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. The Website is served over HTTPS (SSL/TLS encryption). Payment processing is handled by PCI-DSS compliant third-party processors. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights under the DPDP Act

As a Data Principal under the DPDP Act, you have the right to: access a summary of the personal data we hold about you and the processing activities carried out; correct inaccurate or incomplete personal data; erase your personal data where it is no longer necessary for the purpose for which it was collected; withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal; and nominate another individual to exercise your rights in the event of your death or incapacity. To exercise any of these rights, contact us at info@pkpandya.com. We will respond within a reasonable time, and in any event within the timeframe prescribed under the DPDP Act and rules made thereunder.

10. Children’s data

This Website is not directed at individuals below the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verifiable parental consent as required under the DPDP Act, we will take steps to delete such data promptly.

11. Third-party links

The Website may contain links to third-party websites, including Substack, YouTube, LinkedIn, WhatsApp, Telegram, TaxGuru, and Razorpay. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party site you visit through links on our Website.

12. Cross-border data transfers

The Website is hosted on WordPress.com (Automattic Inc., USA). Your data may therefore be transferred to and processed in jurisdictions outside India. Such transfers are made in accordance with the provisions of the DPDP Act regarding transfer of personal data outside India, and we ensure that adequate safeguards are in place.

13. Grievance redressal

If you have any concerns or complaints regarding the processing of your personal data, you may contact:

We will acknowledge your complaint within 48 hours and endeavour to resolve it within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India as established under the DPDP Act.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The “Last updated” date at the top of this page indicates when the policy was most recently revised. We encourage you to review this page periodically. Continued use of the Website after any changes constitutes acceptance of the updated policy.