Privacy Policy

Legal Reserve is a legal consultancy operated by Roshan Singh, Advocate, with offices in New Delhi and Ahmedabad, India. References to Legal Reserve, we, us or our in this Policy refer to this practice. For the purposes of the Digital Personal Data Protection Act, 2023 (the DPDP Act), Legal Reserve is the Data Fiduciary in respect of personal data collected through this website and our services.

We collect personal data that you voluntarily provide to us, including: • Name and contact details (email address, phone number) • Organisation name and designation • Nature of your legal enquiry or matter • Correspondence and communications with us • Technical data such as IP address, browser type, and pages visited (collected automatically) We do not collect sensitive personal data as defined under the DPDP Act unless strictly necessary and with your explicit consent.

We collect personal data through: • Contact and enquiry forms on our website • Email and telephone communications • In-person meetings and consultations • Automatic collection via cookies and server logs when you visit our website

We process your personal data for the following purposes: • Responding to your legal enquiries and providing legal services • Managing our client and prospective client relationships • Sending relevant legal updates and newsletters (only with your consent) • Complying with our legal and regulatory obligations • Improving our website and services The legal basis for processing is your consent, the performance of a contract or pre-contractual steps, and our legitimate interests in operating a legal practice.

Where we rely on consent as the basis for processing, we will obtain your consent clearly and specifically before processing your data for that purpose. Withdrawing consent: You may withdraw your consent at any time, as easily as you gave it, by emailing us at [email protected] with the subject line Withdraw Consent. Withdrawal does not affect the lawfulness of processing done before withdrawal.

We use your personal data only for the purposes for which it was collected. We do not sell, rent or trade your personal data to third parties. We may share your data with: • Professional advisors and co-counsel where necessary for your matter • Technology service providers who assist us in operating our website and practice management systems, under appropriate data processing agreements • Regulatory or law enforcement authorities where required by law

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting or reporting requirements. For client matter files, we retain data for a minimum of seven years after the conclusion of the matter, in accordance with professional obligations. Enquiry data from non-clients is retained for up to two years.

Under the DPDP Act, you have the following rights: • Right to access: obtain information about the personal data we hold about you • Right to correction: request correction of inaccurate or incomplete data • Right to erasure: request deletion of your personal data, subject to our legal retention obligations • Right to grievance redressal: raise a complaint with our Grievance Officer • Right to nominate: nominate another individual to exercise your rights in the event of your death or incapacity To exercise any of these rights, please contact our Grievance Officer at [email protected].

In accordance with the DPDP Act, we have appointed a Grievance Officer to address data protection concerns. Name: Roshan Singh Designation: Founder and Corporate Counsel, Legal Reserve Email: [email protected] Address: New Delhi — 110078 You may raise a grievance by writing to the Grievance Officer. We will acknowledge your grievance within 48 hours and endeavour to resolve it within 30 days.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These include: • Encrypted communications (SSL/TLS) • Access controls limiting data access to authorised personnel • Regular review of our data handling practices In the event of a personal data breach that is likely to result in harm to you, we will notify you and the Data Protection Board of India as required under the DPDP Act.

Our website uses cookies to improve your browsing experience and to collect analytical data about website usage. You may control cookie settings through your browser. Disabling cookies may affect the functionality of certain parts of our website. We do not use cookies for targeted advertising.

Our primary operations and data storage are based in India. Where we use third-party service providers who may process data outside India, we ensure such transfers comply with Section 16 of the DPDP Act and applicable rules, and that appropriate safeguards are in place.

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at [email protected] and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. We will post the updated Policy on our website with a revised effective date. We encourage you to review this Policy periodically. Material changes will be communicated to you by email where we hold your contact details.

This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Any dispute arising in connection with this Policy shall be subject to the jurisdiction of the courts at New Delhi.