Privacy Policy

The following terms have the meanings set out below. Statutory definitions are cross-referenced to the Digital Personal Data Protection Act, 2023 (“DPDP 2023”).

• Personal Data: Any information that identifies or can reasonably identify you — including name, phone number, email address, device ID, location, or combinations thereof.
• Data Principal: You — the individual whose personal data is being processed (Section 2(j), DPDP 2023).
• Data Fiduciary: LAWL — the entity that determines the purpose and means of processing your personal data (Section 2(i), DPDP 2023).
• Processing: Any operation on personal data: collection, storage, use, sharing, transfer, or deletion (Section 2(t), DPDP 2023).
• Consent: A free, specific, informed, unconditional, and unambiguous indication signified by a clear affirmative action (Section 6, DPDP 2023). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
• Consent Manager: A registered intermediary through whom a Data Principal may give, manage, review, or withdraw consent (Section 6(7), DPDP 2023). If LAWL integrates with a Consent Manager, details will be disclosed in the consent notice at the point of data collection.
• Certain Legitimate Uses: Specific circumstances under Section 7 of DPDP 2023 where personal data may be processed without explicit consent. See Section 4 of this Policy.
• Professional: An independent advocate, CA, or CS registered on the LAWL platform. Professionals are not employees, partners, or agents of LAWL.
• Child: An individual who has not completed 18 years of age (Section 2(f), DPDP 2023).
• Company: LAWL (Legal Automation Work Flow Labs LLP) (LLPIN: ACV-1779).

2.1 Information You Provide Directly

• Account and profile: name, email address, phone number, password (hashed and salted, never stored in plaintext), city/state, language preference, and profile settings.
• Consultation and service requests: matter type, description of your situation, documents you upload, preferred contact times, and any other details you voluntarily share with LAWL or an assigned Professional.
• Professional onboarding (advocates, CAs, CSs): identity and KYC documents, bar enrolment or ICAI/ICSI registration number, practice areas, educational qualifications, contact details, and payout information (processed via our payment partners under separate data processing agreements).
• Payments: billing name, contact details, and transaction references. Full card or bank account numbers are processed exclusively by our PCI-DSS compliant payment partners. LAWL does not store, log, or transmit full payment instrument numbers.
• Support and communications: emails, in-app messages, chat transcripts, feedback forms, and survey responses.
• Instant Professional Dispatch: your precise GPS coordinates, collected only when you actively activate this feature and only with your explicit prior permission. Used solely to identify and dispatch a nearby Professional. You may withdraw location access at any time via your device settings; doing so will disable this feature only.

2.2 Data Collected Automatically

• Usage and device data: pages visited, features used, session timestamps, IP address, device type, operating system, and browser or app version.
• Coarse location: derived from IP address for regional analytics and platform improvement only. This is distinct from precise GPS location used for Instant Professional Dispatch.
• Cookies and similar technologies: session identifiers, preference tokens, and analytics signals. See Section 9 and our standalone Cookie Policy.
• Diagnostics and logs: performance metrics, error logs, and security signals (e.g., anomalous login patterns). Retained for 12 months on a rolling basis.

2.3 Data Received From Third Parties

• Payment and KYC partners: transaction status, limited identifiers, and identity verification signals transmitted to LAWL under data processing agreements.
• Registration verification bodies: bar council records, ICAI membership data, or ICSI records used to verify Professional credentials.
• Analytics partners: aggregated and de-identified insights on platform usage and feature adoption, received only where you have consented to analytics cookies. LAWL does not receive individually identifiable data from analytics partners.

We process personal data only for clear, documented purposes. LAWL charges a dynamic platform fee to users for facilitating access to Professionals; the applicable fee is disclosed to you at the point of booking before you confirm a transaction. This Policy will be updated if new services are introduced that involve new categories of data processing.

• Delivering the Services: account creation and management; matching you with suitable Professionals; processing bookings, orders, and payments; sending booking confirmations, reminders, and service updates.
• Safety and platform integrity: detecting fraud, spam, abuse, and policy violations; protecting users and Professionals; enforcing our Terms & Conditions; maintaining secure and reliable operations.
• Communication: transactional messages (booking confirmations, case updates, payment receipts) and, where you have explicitly consented, newsletters and educational content. You may opt out of non-transactional communications at any time.
• Platform improvement: internal analytics, A/B testing, and product research conducted on aggregated or de-identified data. Individually identifiable data is not used for A/B testing without consent.
• Legal and regulatory compliance: meeting tax, accounting, and reporting obligations; responding to lawful authority requests; resolving disputes; cooperating with Bar Council of India, ICAI, ICSI, the Data Protection Board of India, or other regulatory proceedings as required by law.

Under DPDP 2023, personal data may be processed only on one of two grounds (Section 4): (a) consent of the Data Principal, or (b) one of the “certain legitimate uses” enumerated in Section 7. DPDP 2023 does not recognise a standalone “legitimate interests” ground; that concept is specific to the EU GDPR and does not apply in India. All of LAWL’s processing is mapped to one of the grounds set out below.

4.1 Consent (Section 6, DPDP 2023)

We rely on your consent for:

• Optional features: precise location sharing for Instant Professional Dispatch.
• Marketing and educational communications: newsletters, product updates, and educational content.
• Non-essential cookies: analytics and marketing cookie categories (see Section 9).

Consent must be free, specific, informed, unconditional, and signified by a clear affirmative action. We do not bundle consent for multiple purposes. You may withdraw consent at any time via account Settings > Privacy, or by emailing support@lawl.in.

4.2 Certain Legitimate Uses (Section 7, DPDP 2023)

We rely on the following enumerated legitimate uses where consent is not required:

• Section 7(a) — Voluntary provision by Data Principal: Where you have voluntarily provided your personal data to LAWL for a specified purpose — for example, completing a booking form, uploading a document to request a service, or initiating a support request.
• Section 7(d) — Legal proceedings and obligations: Processing necessary to respond to legal proceedings, comply with court orders, or fulfil obligations imposed by applicable law, including directions from the Bar Council of India, ICAI, ICSI, the Data Protection Board of India, the Reserve Bank of India, or any other competent authority.
• Section 7(g) — Safety and security: Processing necessary for fraud prevention, access control, platform security monitoring, and protection of the safety of users and Professionals.

Consistent with Rule 36 of the Bar Council of India Rules (2008 amendment, as in force), advocate profiles on LAWL display only: name, bar enrolment number and jurisdiction, contact information, educational qualifications, and areas of practice.

No rankings, star ratings, client testimonials, win-rate claims, case-outcome statistics, or promotional superlatives are permitted on any advocate profile. LAWL does not use personal data to solicit work on behalf of any advocate, nor does any advocate pay LAWL for preferential placement.

CA and CS profiles are maintained in compliance with equivalent ICAI and ICSI guidelines.

LAWL does not sell personal data. We share personal data only in the following circumstances:

• Assigned Professionals: When you book a consultation, select a Professional, or activate Instant Professional Dispatch, we share relevant matter details and contact information with the assigned Professional solely to deliver the requested service. That Professional is independently bound by their statutory and professional-body duties of confidentiality.
• Service providers (data processors): Cloud hosting, storage, analytics, email and SMS delivery, payment processing, KYC/identity verification, customer support tools, and security vendors who process data strictly on LAWL’s written instructions under data processing agreements.
• Legal and regulatory authorities: Where required by applicable law, court order, or directions from the Bar Council of India, State Bar Councils, ICAI, ICSI, the Data Protection Board of India, the Reserve Bank of India, or any other competent regulator. LAWL will, to the extent permitted by law, notify you of any such request before complying.
• Business transfers: In connection with a merger, acquisition, restructuring, or asset sale. LAWL will provide at least 30 days’ advance notice to affected users and ensure the successor entity is bound by the protections in this Policy before any transfer.

LAWL will never share personal data with Professionals or third parties for marketing, solicitation, or commercial profiling purposes.

LAWL does not currently offer AI-powered document drafting, case triage, legal-language translation, or any other AI-assisted legal or professional services. No content generated or processed through the LAWL platform constitutes legal, financial, or compliance advice. If AI-assisted features are introduced in the future, this Policy will be updated, and where DPDP 2023 requires fresh consent, it will be sought by affirmative action before any such feature is made available to you.

Consistent with Rule 36 and Rule 37 of the Bar Council of India Rules, LAWL does not use any automated or AI-based tool to provide legal advice, solicit clients on behalf of advocates, or enable the unauthorised practice of law.

We retain personal data only for as long as necessary for the purposes described in this Policy and as required or permitted by applicable law.

Secure disposal: When data is no longer required, we securely delete or irreversibly anonymise it using industry-standard methods. Anonymised or pseudonymised data that cannot reasonably be re-identified is not subject to this Policy.

Legal hold: Active dispute, regulatory investigation, or litigation may require retention beyond the periods above. LAWL will notify affected users where legally permissible.

We use cookies and similar technologies to maintain your session, remember preferences, analyse platform usage, and — where you consent — measure communication effectiveness. Our standalone Cookie Policy governs cookie use in full.

• Essential cookies: required for login, session management, security tokens, and core functionality. These cannot be disabled without impairing service functionality.
• Functional cookies: remember user preferences (language, saved city, UI settings). Opt-in. Off by default.
• Analytics cookies: aggregate usage data for platform improvement. Opt-in. Off by default.
• Marketing cookies: campaign attribution and conversion measurement only. Opt-in. Off by default.

You can manage non-essential cookies via the consent banner displayed on first use, via Cookie Settings in the website footer, or via Settings > Privacy in the LAWL mobile app. Withdrawing cookie consent does not affect your ability to use core platform features.

• Encryption of personal data in transit (TLS 1.2 or higher) and at rest for sensitive records.
• Role-based access controls and audit logging for all internal systems handling personal data.
• Regular security assessments, penetration testing, and vulnerability reviews conducted by qualified security personnel.
• Payment data handled exclusively by PCI-DSS compliant partners. LAWL does not store, log, or process full card or bank account numbers.
• Incident response procedures aligned with DPDP 2023 Section 8(6) and the IT Act 2000. In the event of a personal data breach likely to result in harm, LAWL will: (a) notify the Data Protection Board of India within 72 hours of becoming aware; and (b) notify affected Data Principals in the prescribed manner.

If you suspect unauthorised access to your account or data, contact support@lawl.in immediately. LAWL will acknowledge your report within 24 hours and investigate promptly.

Under DPDP 2023, a “child” is an individual who has not completed 18 years of age (Section 2(f)). LAWL’s Services are designed for adults. We do not knowingly permit independent registration by users under 18.

• Age verification: LAWL collects date of birth at registration. Users who indicate they are under 18 are blocked from independent registration. Where other age signals suggest a user may be under 18, processing is suspended pending verification.
• Verifiable parental consent: Where a parent or legal guardian seeks to use the Services on behalf of a person under 18, the parent or guardian must affirmatively identify themselves as such and provide consent on the child’s behalf in the manner prescribed by DPDP 2023 Section 9(1) and Rule 10 of the DPDP Rules 2025.
• Prohibited processing: LAWL does not engage in tracking, behavioural monitoring, targeting, or advertising directed at children, regardless of parental consent (Section 9(3), DPDP 2023). This prohibition is absolute.

If you believe a child’s personal data has been processed without proper consent, contact support@lawl.in immediately.

DPDP 2023 grants the following rights to Data Principals (Sections 11–14). LAWL will respond to all requests within the timelines prescribed by law or, where no timeline is prescribed, within 30 days. To exercise any right, email support@lawl.in with the subject line “Privacy Request — [Right]” from your registered email address.

• Right of access (Section 11): Know whether LAWL processes your personal data; obtain a summary of the personal data being processed and the activities for which it is used.
• Right of correction (Section 12): Request correction of inaccurate, incomplete, or misleading personal data held by LAWL.
• Right of erasure (Section 12): Request erasure of personal data that is no longer necessary for the purpose for which it was collected, or where consent has been withdrawn, subject to retention obligations under applicable law and any active legal hold.
• Right of grievance redressal (Section 13): Raise a complaint with our Grievance Officer (see Section 14). If your complaint is not resolved within 30 days, or you are dissatisfied with the outcome, you may escalate to the Data Protection Board of India once operationalised.
• Right to nominate (Section 14): Nominate another individual to exercise your data rights in the event of your death or incapacity. To register a nominee, email support@lawl.in with the subject line “Nominee Registration”.

LAWL primarily processes and stores personal data within India. Where data is transferred to service providers located outside India (for example, for cloud hosting, email delivery, or analytics), LAWL implements appropriate contractual safeguards, including standard contractual clauses or equivalent mechanisms recognised under DPDP 2023 and any transfer regulations issued by the Central Government under Section 16 of DPDP 2023.

LAWL does not transfer personal data to jurisdictions specified as restricted under DPDP 2023 regulations without the safeguards required by law. A list of the countries to which personal data is currently transferred is available on request from grievance@lawl.in.

We may update this Policy from time to time to reflect changes in our Services, technology, or applicable law. The “Last Updated” date at the top of this Policy shows the date of the most recent revision.

For material changes, LAWL will:

• Provide prominent notice via an in-app banner or email at least 15 days before the changes take effect; and
• Where DPDP 2023 requires fresh consent, seek that consent by means of a clear affirmative action before the change takes effect.

Continued use of the Services after the effective date of a material change does not constitute consent to that change. Where DPDP 2023 mandates a fresh affirmative action, we will require it.

This Policy should be read together with LAWL’s Terms & Conditions and Cookie Policy, all of which are available at www.lawl.in. In the event of any conflict between this Policy and a specific service-level agreement or addendum, the more protective provision for the Data Principal shall apply.

If you do not agree with this Policy, please discontinue use of the Services. You may contact us at support@lawl.in with any questions.