Privacy Policy

Who we are, and what this covers

For the purposes of the DPDP Act, Surekha QorLex Corporate Legal LLP is the data fiduciary responsible for personal data collected through this website. We are a corporate law firm registered in India, with our practice based in Bengaluru, Karnataka.

This policy applies to all personal information processed by us in connection with the site, whether you submit it directly or it is collected automatically as part of standard website operation. It does not cover personal information you may share with us through other channels (a phone call, an in-person meeting, or correspondence outside this site); those interactions are governed by our wider professional obligations as advocates.

What we collect, and why

The only information we actively collect from you is what you provide when you reach out via our contact form: your full name, work email address, the name of your company or organisation, and the message you write. We collect this so we can read your enquiry, respond to it, and (where it leads to a formal engagement) maintain a record of how the relationship began.

Our hosting environment automatically records standard technical information about each visit: the visitor’s IP address, browser type, the page accessed, and a timestamp. This is normal server access logging, used for security monitoring and to identify abuse such as spam or attempted intrusions. It is not combined with form data to build a behavioural profile.

We use Google Site Kit on this website, which integrates Google Analytics to help us understand how visitors find and use the site — for example, which pages are most read, and roughly where in the world visitors are connecting from. Google Analytics sets cookies in your browser and processes information such as your IP address, device, browser, and pages viewed on our behalf. We have IP anonymisation enabled where supported. We do not use advertising trackers or social-media tracking pixels on this website.

How long we keep it

We retain contact-form submissions for 36 months from the date of receipt. Where an enquiry leads to a formal engagement, the related correspondence becomes part of the engagement file and is retained in accordance with our professional obligations as advocates. Those obligations may extend the retention period beyond 36 months for matters governed by limitation periods, regulatory record-keeping rules, or the ongoing client relationship itself.

Server access logs are retained for a much shorter period, typically between 30 and 90 days, after which they are automatically rotated out by the hosting environment.

Aggregate website-usage data collected through Google Analytics is retained according to the data-retention setting configured within our Google Analytics property. Individual-level identifiers within Analytics are retained for the period set there and are then automatically deleted by Google.

Who else processes your information

Personal information you submit through this website is stored within the same WordPress installation that runs the site, on infrastructure operated by our hosting provider. We have a contractual relationship with that provider; the data is not shared with them for any purpose other than the technical operation of the website.

We use Google Site Kit, which connects this website to Google Analytics. Google LLC processes website-usage data of the kind described above on our behalf, in its capacity as a data processor. Information processed by Google Analytics may be stored on Google’s infrastructure, which includes servers located outside India. Google’s own privacy policy is available at policies.google.com/privacy.

We do not currently use a third-party email-delivery service to send transactional messages from this site (for example, acknowledgement of a contact-form submission). When that capability is added, we will update this policy to name the provider and explain what data is shared with them.

No personal information from this website is sold, shared, or transferred to advertisers, data brokers, or marketing platforms.

Cookies and tracking

This website uses the following kinds of cookies and similar browser storage:

Essential cookies

Used by the website platform and our hosting and security infrastructure to make the site work correctly — for example, to maintain a session, manage server-side caching, or block automated abuse. These are not used to follow you across other websites.

Disclaimer acknowledgement

The first time you visit, you are shown a disclaimer modal as required under the Bar Council of India rules on advocate advertising. When you acknowledge it, we record that acknowledgement in your browser’s local storage (under the key sq_disclaimer_accepted, with a 12-month time-to-live) so that the modal does not reappear on subsequent visits within the same browser. This stores only the fact and timestamp of acknowledgement; it does not identify you, and it is not transmitted to our servers.

Analytics cookies (Google Site Kit / Google Analytics)

We use Google Site Kit to integrate Google Analytics, which sets cookies in your browser (typically named _ga and _ga_*) to measure aggregate usage of the site — which pages are read, and how visitors arrive. These cookies are not used to build a profile of you for advertising purposes, and we do not deploy advertising cookies or social-media tracking pixels on this site.

Your choices

You can opt out of Google Analytics across all websites by installing Google’s official opt-out browser add-on, available at tools.google.com/dlpage/gaoptout. You can also block or delete cookies and clear local storage through your browser settings; doing so may cause the disclaimer modal to reappear on each visit and may affect other essential features of the site.

How we keep it secure

We protect personal information through standard technical and organisational measures: encrypted transmission (HTTPS) for all data sent between your browser and our servers; storage on infrastructure that provides encryption at rest at the disk level; access controls that limit who within the firm can read enquiry data; and timely updates to the website platform and its components to address known security advisories.

No system is perfectly secure. If we ever become aware of a personal-data breach affecting your information, we will notify you and the Data Protection Board of India in accordance with the timelines required by the DPDP Act and the rules issued under it.

Your rights as a data principal

Under the DPDP Act, you have the following rights over the personal data we hold about you. To exercise any of them, write to our grievance officer at the address below.

Right to information

You can ask us to confirm what personal data of yours we are processing, the purposes of that processing, and the identities of any third parties with whom we have shared it.

Right to correction and erasure

You can ask us to correct inaccurate or outdated information, or to erase personal data that is no longer needed for the purposes it was collected. This is subject to any legal or professional obligation we have to retain it (for example, where the data forms part of an active engagement file).

Right of grievance redressal

If you believe we have not handled your personal data in line with this policy or the DPDP Act, you can raise the matter with our designated grievance officer (contact details below). If we are unable to resolve it to your satisfaction, you have the right to approach the Data Protection Board of India.

Right to nominate

You can nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

Cross-border transfers

Personal information you submit through the contact form is stored on infrastructure operated by our hosting provider. We will update this policy if the storage region changes materially.

Website-usage data collected through Google Site Kit and Google Analytics is processed by Google LLC and may be stored on Google’s infrastructure outside India, including in the United States. Such transfers are made only where permitted under the DPDP Act and any rules issued under it.

If we add further services in the future that involve transferring personal data outside India (for example, an email-delivery provider with overseas servers), we will update this policy to name the provider and the destination country.

Children’s data

This website is intended for use by adults: typically founders, executives, in-house counsel, and procurement professionals seeking corporate legal services. We do not knowingly collect personal data from children (defined under the DPDP Act as anyone under the age of 18). If you believe we may have inadvertently received such data, please contact our grievance officer below and we will arrange for it to be deleted.

Updates to this policy

We may update this policy from time to time. The most recent version will always be available at this URL, with the “Last updated” date at the top reflecting the most recent revision. For material changes (for example, the addition of a new third-party processor, or a change to the categories of data we collect), we will note the change clearly within the updated policy.

Grievance officer and contact

If you have any questions about this policy, want to exercise your rights as a data principal, or believe we have not handled your personal data in line with the DPDP Act, please contact our grievance officer.

We will acknowledge receipt within three working days and substantively respond within the timelines required by the DPDP Act and the rules issued under it.

If, after engaging with us, you remain dissatisfied with how a matter has been handled, you have the right to approach the Data Protection Board of India, the regulator established under the DPDP Act.