In short
- We never sell your data, and we do not use it for anything beyond the engagement you asked us to perform, apart from the newsletter and service updates you can opt out of at any time.
- Analytics is off until you say yes. No tag script loads and no event is recorded before then.
- We keep financial and engagement records for 8 years because tax law requires it, and delete everything else once its purpose is met.
- You can access, correct, export or erase your data by emailing us — we acknowledge within 48 hours and finish within 30 days.
Who we are
Legal Munshi LLP ("Legal Munshi", "we", "us") is the Data Fiduciary for the personal data described in this notice. We decide why each piece of data is processed and how, and we are responsible for complying with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Rules made under it.
Registered office: A1, First Floor, Gole Ka Mandir Rd, above Galav Max Lab, Morar Enclave, Gwalior, Madhya Pradesh 474006, India. Our privacy and grievance contact is [email protected], and our phone line is +91 75664 41515. We are not a government department or authority, and nothing in this policy should be read as a claim that we act on behalf of one.
What we collect, and exactly why
We collect the narrowest amount of information each task actually needs. If a field is optional, it is marked as optional at the point we ask for it, and you can leave it blank without affecting the rest of your order.
| Data | What it covers | Why we hold it |
|---|---|---|
| Identity & contact | Name, email, mobile or WhatsApp number, business name | Create your account, answer your enquiry, and contact you about your engagement |
| Business & KYC | Entity name and type, PAN, GSTIN, registered address, director or partner details | Prepare and file your application with the correct authority |
| Engagement documents | Certificates, identity proofs, address proofs and forms you upload | Verify eligibility, draft the application and complete the filing you asked for |
| Order & payment | Services ordered, package chosen, invoice, payment status and ledger entries | Deliver the service, raise GST invoices and meet tax and accounting obligations |
| Technical | Browser and device type, IP address, pages visited, and the responses you give to our forms | Keep the platform secure, prevent abuse, and understand aggregate usage |
| Communications | Emails, messages and support conversations about your order | Answer you, record what was agreed, and resolve a dispute later if there is one |
Consent and lawful basis
Where we rely on consent, we process your data on the basis of the consent you give when you submit an enquiry, create an account, place an order or contact us. The notice shown at that point tells you what is being collected and why. You can withdraw your consent at any time by writing to [email protected].
Withdrawal is prospective. It does not undo processing we have already carried out, and in some cases we will not be able to continue an engagement at all, because a filing cannot proceed without the data the authority requires. Where we process data to comply with a legal obligation — tax records, for example — that processing continues on that separate lawful basis whether or not you withdraw consent.
We do not use your documents for any purpose beyond the engagement you asked us to perform, and we do not sell personal data to anyone.
There is one other use, and we would rather name it than let you find it. If you give us an email address for the newsletter, or tick to hear about a service, we will send that. It is a separate opt-in, it is not bundled into an order, and you can stop it with one reply. We do not add an order customer's address to that list without them asking.
Analytics, and when it runs
We do not run analytics by default. If analytics is configured for this deployment, a consent prompt appears the first time you visit, and no analytics script is loaded and no event is recorded until you choose to allow it. Choosing "only necessary" records a refusal, and we then load no third-party script at all.
If you allow it, measurement is limited to aggregate page views and the interactions that tell us which services and calculators are useful — the service page viewed, the calculator used, the fact that an enquiry form was submitted. Nothing about your identity is sent to the measurement provider.
We do not send your name, email address, mobile number, document contents, PAN, GSTIN or payment details to any analytics provider, and we do not build advertising audiences or retarget you elsewhere on the internet.
You can change your decision whenever you like by clearing this site's local storage in your browser, which returns you to the consent prompt.
Your rights as a Data Principal
The DPDP Act gives you the following rights over the personal data we hold about you. You do not need a lawyer to use any of them.
- Right to access — ask for a summary of the data we process about you, the categories of Data Fiduciaries we have shared it with, and a description of the processing.
- Right to correction and erasure — ask us to correct inaccurate or misleading data, complete data we hold as incomplete, or erase data we no longer have a lawful reason to keep.
- Right to withdraw consent — withdraw a consent you previously gave, with the consequences described in the section above.
- Right to nominate — nominate another person to exercise these rights if you die or become incapable.
- Right to grievance redressal — complain about how we have handled your data, and escalate to the Data Protection Board of India if you are not satisfied with our response.
How to exercise a right
Write to [email protected] from your registered email address, or use our contact form, stating which right you wish to exercise and the account, order or email address it relates to. We may ask you to verify your identity first, so that we do not hand your data to somebody else.
We acknowledge every request within 48 hours and complete verified requests within 30 days. If the law allows a longer period, we will tell you why before it expires.
You can also view and update most of your account details yourself from your dashboard, and download any document stored in your vault, without contacting us at all.
How long we keep it
We keep personal data only as long as the purpose it was collected for requires it, for statutory record-keeping, or to resolve a dispute — whichever of those is longest. When that period ends, we delete it or irreversibly anonymise it.
The table below is the default we apply. Where a specific law or authority requires a longer period for a particular record, that longer period wins.
We are telling you plainly how this is applied: deletion at the end of a retention period is carried out on a scheduled basis by a person, not by an automatic job running in this website. A deletion request made under your rights is actioned immediately when you make it — you do not have to wait for a schedule. If you want a particular item removed sooner, write to us and say so.
| Category | Retained for | Why |
|---|---|---|
| Enquiry that becomes no order | 12 months | So we can reconnect if you come back, and answer a repeat question without starting over |
| Account and profile data | Life of the account, then 12 months | To provide the dashboard, and to honour a deletion request in full afterwards |
| Engagement and tax records | 8 years | Indian company, tax and professional record-keeping requirements |
| Uploaded documents | Life of the account, plus 8 years | Needed to evidence what was filed, on your request or an authority's |
| Payment and ledger entries | 8 years | Accounting and tax audit requirements |
| Support conversations | 24 months | To resolve a recurring issue and to evidence what was agreed |
| Server and access logs | 90 days | Security investigation and abuse prevention |
Who else sees your data
We share the minimum necessary, and only with parties who need it to deliver what you asked for or to meet a legal duty.
| Recipient | What they receive | Why |
|---|---|---|
| Government departments and portals | The minimum fields the authority requires for your filing | To file and complete your application |
| Payment processor (Razorpay) | Order amount, and the payment itself | To collect payment. Card and UPI credentials are handled by them and never stored by us |
| Email provider | Your email address and the content of the message | To send confirmations, document requests and updates |
| Professional reviewers | The documents and facts needed to review your case | Chartered accountants, company secretaries and advocates bound by confidentiality |
| Hosting and storage | Everything, encrypted in transit | To run the platform. Currently our own servers; see the note below |
| Analytics provider | Aggregate page and interaction events, with no identifiers | Only if you consent. See "Analytics, and when it runs" |
Where your data is stored
Your personal data is stored and processed in India. We do not transfer your personal data to another country. Where a technology provider we use stores or processes data outside India, that provider acts only for the purpose set out in the table above, under contractual safeguards, and only as the DPDP Act permits.
One thing stated plainly: on this deployment, uploaded documents are held on our own application server rather than in a third-party object store. Access is still restricted to authenticated requests with an ownership check, but if that changes we will update this section before it changes in practice.
Security safeguards
Documents you upload are stored in an access-controlled vault and are served only through authenticated endpoints after an ownership check. Staff access is restricted on a need-to-know basis, and sensitive changes are recorded in an audit log with the person and time who made them.
We apply encryption in transit, scrypt password hashing with a per-user salt, 30-day session expiry with server-side revocation, and least-privilege staff roles. No system is perfectly secure, but these are reasonable safeguards to prevent a personal data breach, as the DPDP Act requires.
A password reset link is never written to our application logs, in any configuration. Where our email provider is unavailable the message is not delivered at all, and you will need to request a new link — which is deliberate, because a live reset token sitting in a log file is a worse outcome than a failed delivery.
On a personal data breach we notify the Data Protection Board of India and every affected Data Principal, in the manner and within the timelines the DPDP Act prescribes.
Children's data
Our services are for adults acting in a business or professional capacity. We do not knowingly collect personal data from anyone under 18, and we do not do behavioural monitoring or targeted advertising directed at children. If you believe a child has given us data, write to us and we will delete it.
Grievance Officer
Grievance Officer: Privacy Desk, Legal Munshi LLP. Email: [email protected]. Phone: +91 75664 41515. Postal: A1, First Floor, Gole Ka Mandir Rd, above Galav Max Lab, Morar Enclave, Gwalior, Madhya Pradesh 474006, India.
We acknowledge every grievance within 48 hours and resolve it within 30 days. These are commitments we hold ourselves to rather than deadlines a system measures for us, so if we are going to miss one we will tell you before the deadline rather than after it. If you are not satisfied with the outcome, you may escalate the matter to the Data Protection Board of India.
Changes to this policy
We review this policy every twelve months, or sooner if the law or our practice changes. The review date at the top of this page is the last time it was reviewed. Where a change materially affects how we process your data, we will tell you through the platform or by email before it takes effect.
To exercise any right described on this page, write to [email protected] or use the contact form. We acknowledge every privacy request within 48 hours and resolve verified requests within 30 days.