Privacy Policy

Last updated: [date of publication, set at go-live]

1. About this policy

BRB Legal ("BRB Legal", "we", "us") is a law firm with its office at Z-29, Block Z, Hauz Khas, New Delhi – 110016, India.

This policy explains how we collect, use, share and protect personal data when you visit www.brb-legal.com (the "Website"), write to us through it, or complete one of the legal health checks linked from it.

It is published under Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"). It is also written to give the notice required by the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025, as their provisions come into force.

This policy does not cover personal data we receive in the course of acting for a client. That information is governed by our terms of engagement and by our professional duty of confidentiality.

2. The personal data we collect and why

Where it comes from	What we collect	Why we use it
The contact form on our Contact page	Your name, email address, organisation (if you give it), topic and anything you write. The form opens a message in your own email app; the Website itself does not store it	To reply to you and, if you ask us to act, to run a conflict check before we take instructions
Emails and calls to the firm	Your name, contact details and what you tell us	As above
Our legal health checks (IP, DPDP readiness and contracts), which run on Google Forms	Your email address; your name and phone number, if you choose to give them; and your answers to the questions	To prepare your written report and send it to you; to call you, if you gave us a number, to clarify an answer before we finalise the report; to keep a record of the assessment we provided; and, only if you tick the optional box in the form, to produce anonymised, aggregated findings that identify no one
Your visit to the Website	Technical data such as your IP address, browser and device type, the pages you view and the site you came from, which our hosting provider records, and the browser storage described in section 10	To run and secure the Website

We do not ask for, and you should not send us through the Website, any sensitive personal data or information, such as passwords, bank or card details, health information, biometric data or information about sexual orientation.

3. Writing to us does not make you our client

Sending us a message, or completing a health check, does not create a lawyer–client relationship. We take on a matter only after a conflict check and once terms of engagement have been agreed. Until then, please do not send us confidential information about a matter.

4. The basis on which we use your personal data

Consent. When you submit a form or write to us, you consent to our using the personal data you give us for the purpose described in section 2. You can withdraw your consent at any time by writing to the Grievance Officer (section 12). Withdrawal is as easy as giving consent. It does not affect anything we did before you withdrew it, but it may mean we cannot complete your request.
Data you give us voluntarily for a specific purpose. Where you send us personal data for a particular purpose and have not told us you do not consent to its use, we use it for that purpose, as Section 7 of the DPDP Act permits.
Legal obligations. We may process personal data where the law, a court or a competent authority requires it.

We do not sell personal data, and we do not share it with anyone for advertising.

We share personal data only with:

Service providers who process it for us, under their own security and confidentiality commitments: instructions; and
- Wix.com Ltd., which hosts the Website and serves its images;
- Google, through Google Workspace, which hosts our health-check forms and processes the responses on our
- Microsoft, through Microsoft 365, which provides our email service.
Authorities, where the law or an order of a court or tribunal requires us to disclose it.

6. Where your data is stored

Our service providers may store and process personal data on servers outside India. Such transfers are made in accordance with Indian law, including the SPDI Rules and, once in force, Section 16 of the DPDP Act, which permits transfers except to countries the Central Government restricts.

7. How long we keep it

We keep personal data only for as long as we need it for the purpose for which it was collected:

Enquiries that do not lead to an engagement: 12 months from our last exchange with you.
Health-check answers and reports: 12 months from the date we send you the report. Anonymised, aggregated findings (section 2) contain no personal data and may be kept indefinitely.
Technical data collected by Wix, which hosts the Website: in line with Wix's own retention policies.

We may keep personal data for longer where the law requires it, or where it is needed to establish, exercise or defend a legal claim. When the period ends, or if you withdraw your consent, we erase or anonymise it unless the law requires us to keep it.

8. How we protect it

We follow reasonable security practices, as required by the SPDI Rules and the DPDP Act. These include:

encrypted (HTTPS) connections to the Website;
access to personal data limited to the people at the firm who need it; and
service providers that maintain recognised security standards.

If a personal data breach affects you, we will inform you, the Data Protection Board of India and any other authority, as the law requires.

9. Your rights

You have the right to:

ask for a summary of the personal data we hold about you and of how we are using it;
ask us to correct, complete or update it;
ask us to erase it, where we no longer need it or you withdraw your consent;
withdraw your consent at any time;
nominate another person to exercise these rights for you in the event of your death or incapacity; and
have a grievance about our handling of your personal data addressed by us.

To exercise any of these rights, write to the Grievance Officer (section 12). For a health check, you can also withdraw your consent through the link in the email that carries your report. We will reply within one month of receiving your request. If you are not satisfied with our response, you may complain to the Data Protection Board of India once the relevant provisions of the DPDP Act are in force.

If your health-check answers have already been included in anonymised, aggregated findings, we cannot separate them out again, because nothing in those findings links back to you.

10. Cookies and browser storage

The Website does not use advertising cookies, and the firm does not add any analytics or tracking service of its own.

Disclaimer. When you accept the disclaimer, your browser stores that choice (in its local storage) so that the disclaimer is not shown on every page. Nothing is sent to us.
Background photographs. To show a different photograph on each visit, your browser keeps a short list of the photographs it has just shown (in its session storage, which is cleared when you close the tab). It contains no information about you and is not sent to us.
Language. If you use the language button to read the Website in another language, Google Translate sets a cookie (googtrans) to remember your choice, and the text of the page is sent to Google to be translated. Google is not contacted unless you choose a language other than English.
Hosting. Wix, which hosts the Website, adds its own scripts to every page. They set cookies that keep the Website secure and working (client-session-bind and server-session-bind, which last for your visit, and bSession, which lasts 30 minutes), keep an access token for Wix's services in your browser's local storage, and send Wix basic information about each page visit, such as the page viewed and your browser, which Wix uses to provide visit statistics. Wix handles this information under its own privacy policy.

You can block or delete cookies and browser storage in your browser settings. Some parts of the Website may not work properly without them.

11. Children

The Website is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please write to the Grievance Officer and we will delete it.

12. Grievance Officer

Questions, requests and complaints about this policy or your personal data should go to:

Grievance Officer, BRB Legal
Address: Z-29, Block Z, Hauz Khas, New Delhi – 110016
Email: info@brb-legal.com
Phone: +91 11 4058 2711

13. Other websites

The Website links to other websites, including Google Forms (which runs our legal health checks), Wikimedia Commons, LinkedIn, Instagram and X. Those websites have their own privacy policies, and we are not responsible for how they handle personal data.

14. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Significant changes will be highlighted on the Website.

15. Translations and governing law

If this policy is shown in another language through the language button, the English version prevails. This policy is governed by the laws of India, and the courts at New Delhi have jurisdiction.