Privacy policy

Last updated: 18 September 2026

Who we are

DAA Legal is a firm of advocates practising at Fort, Mumbai 400 001, Maharashtra, India. Under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), DAA Legal is the Data Fiduciary for personal data collected through this website. This policy is written to comply with the DPDP Act and the rules made under it as they come into force, and, where they still apply, with the Information Technology Act, 2000 and the SPDI Rules, 2011.

Questions and requests may be sent to info@daa-legal.com. The firm's contact for privacy matters is Meghna Arvind, Managing Partner.

What we collect

• Careers form: your name, telephone number, email address, the position applied for, years of experience, a LinkedIn profile URL and cover note (both optional), and your CV.
• Correspondence you initiate: the content of any email or call you send us.
• Technical data: when a form is submitted, the server records the IP address it came from and the time of submission. Our hosting provider also keeps standard server access logs.

Cookies. DAA Legal sets no cookies of its own and uses no analytics or advertising trackers. The embedded Google Map on the Reach us and About pages may set Google's cookies when it loads. The only thing stored in your browser is a flag in local storage recording that you have acknowledged the Bar Council of India notice, so that it is not shown again. It contains no personal data and is never sent to us, so no cookie banner is needed. If analytics are ever added, this policy will be updated first.

Why we use it and the lawful basis

Personal data sent through this website is used only to consider your application, and to answer correspondence you begin; to run a conflict check before the firm accepts a matter, a record of which is kept as professional rules require; to assess a job application; and to detect misuse of the forms and keep a reliable record of what was received.

The lawful basis is your consent, given by ticking the acknowledgement box before sending the careers form, together with the fact that you have volunteered the data for a purpose you have specified, which the DPDP Act treats as a legitimate use. Where the firm must keep a record by law or under Bar Council rules, that obligation is an additional basis. You may withdraw consent at any time by writing to us; withdrawal does not affect processing already carried out, and the firm may retain what it is legally required to keep.

How your data is handled

When you submit a form, its contents are sent by email to the firm's mailbox over an encrypted SMTP connection. A copy of each submission is also written to a protected log on the web server, which is not accessible from the internet, so that no enquiry is lost if email delivery fails. CVs travel as email attachments only and are never stored on the web server. Access to the mailbox and the log is limited to members of the firm who need it.

How long we keep it

• Enquiries: up to 24 months from receipt, unless a matter is opened, in which case the firm's file-retention policy and professional obligations apply.
• Job applications: up to 12 months, so that you may be considered for a later opening, unless you ask us to delete your application sooner.
• Server logs: retained by the hosting provider for a limited period for security purposes.

Data no longer needed for the purpose it was collected for is deleted or anonymised.

Who we share it with

The firm does not sell personal data, share it for marketing or use it for profiling. It is shared only with service providers who process data on the firm's behalf, namely its web-hosting and email provider, which may store data on servers inside or outside India and is bound to act only on the firm's instructions; with the firm's own professional advisers where necessary; and where disclosure is required by law, by a court, tribunal or regulator, or is needed to protect the firm's legal rights.

Security

The site is served over HTTPS, so data you send is encrypted in transit. Submissions are relayed over encrypted SMTP; the forms carry spam protections; CVs are checked for type and size before acceptance; the submission log is blocked from web access; and the receiving mailboxes are restricted to authorised persons. No payment information is collected. No method of transmission or storage is entirely secure, but the firm takes the reasonable safeguards the DPDP Act requires and will notify the Data Protection Board of India and affected persons of any personal data breach as the Act and its rules prescribe.

Your rights under the DPDP Act

As a Data Principal you have the right to:

• Access: a summary of the personal data the firm holds about you and how it has been processed;
• Correction and erasure: have inaccurate or incomplete data corrected or updated, and have data erased once it is no longer needed, subject to retention required by law or professional rules, such as conflict-check records;
• Withdraw consent: as easily as it was given;
• Grievance redressal: a response to any complaint about the handling of your data within the period prescribed under the Act and its rules; and
• Nominate: name another person to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights, email info@daa-legal.com from the address you gave us, with “Privacy request” in the subject line. The firm may ask you to verify your identity first. If you are not satisfied with the firm's response, you may complain to the Data Protection Board of India.

Children

This website and its forms are intended for persons aged 18 and above; the firm does not knowingly collect a child's personal data through them. If you believe a child has sent us personal data, please contact us and it will be deleted. Where a matter concerns a child, the information is provided by a parent or lawful guardian in the course of an engagement and is held under the firm's duties of confidentiality.

Third-party links and services

The site uses a small number of third-party services, each governed by its own privacy policy: Google Maps, embedded on the Contact page, which may collect data when the map loads; Google Fonts, from which your browser requests the site's typefaces, so Google may see your IP address; and LinkedIn, to which the profile links lead. The firm is not responsible for the privacy practices of these services.

Changes to this policy

This policy may be updated from time to time, for instance when the rules under the DPDP Act change or a new service is added to the site. The date at the top of this page shows when it was last revised; material changes will be highlighted here.

Contact

For any question about this policy or the firm's handling of your personal data, write to info@daa-legal.com, or by post to the address above, marked for the attention of Meghna Arvind. Please also read our disclaimer, which sets out the terms on which the information on this website is provided.