Legal
Privacy Policy
This policy explains what personal data this website collects, why we hold it, who else sees it, how long we keep it, and what you can require us to do about it.
01Scope of this policy
This policy applies to personal data collected through this website: the enquiry form, the alert list, and the records our hosting provider keeps when a page is served.
It does not govern client matters. Once an engagement is in place, the personal data and documents you give us are handled under the terms of the engagement letter, our obligations of professional confidentiality, and the statutory and regulatory duties that attach to tax, corporate and forensic work. Where this policy and an engagement letter differ, the engagement letter governs the matter it covers.
02Who is responsible
Guardian Strategies LLP decides why and how personal data collected through this website is processed. Under the Digital Personal Data Protection Act 2023 we are the Data Fiduciary; under the UAE Personal Data Protection Law and the EU General Data Protection Regulation the equivalent term is Controller.
| Entity | Guardian Strategies LLP |
| Registered office | registered office address |
| LLPIN | LLP identification number |
| sivasankaran@guardianlegal.org | |
| Telephone | +91 90033 58801 |
| Offices | Chennai (headquarters), Bangalore, Kozhikode, Kolkata, Delhi, Mumbai, Surat, Chandigarh and Dubai |
03What we collect
What you give us The enquiry form asks for your name, email address and a description of your question. It also offers optional fields for your telephone number and organisation, the office nearest to you, and a category describing what your matter starts with. Everything you type into the message field is collected with it.
The alert list collects your email address, and nothing else.
What is recorded automatically Our hosting provider keeps standard server logs when a page is requested. These typically include the IP address making the request, the browser and operating system it reports, the page requested, and the date and time. We use these only to keep the site running and secure. We do not use them to build a profile of you.
What we do not collect
- We do not collect special or sensitive categories of personal data through this website, and we ask you not to send them through the enquiry form.
- We do not buy personal data, and we do not enrich what you give us from third-party sources.
- We do not use automated decision-making or profiling that produces legal or similarly significant effects.
04Cookies and tracking
This website sets no cookies.
There is no analytics package, no advertising pixel, no tag manager, no session recording and no cross-site tracking of any kind. Nothing is written to your browser's local or session storage. That is why you are not asked to dismiss a cookie banner: there is nothing to consent to.
No third party is involved in delivering the page. The typefaces are served from this website rather than from an external font service, so your browser requests nothing from anyone but us, and no IP address or browser detail is disclosed to a font provider.
If we later add analytics, a chat widget or any other tracking technology, we will publish the change here and ask for consent where consent is required before it is switched on.
05Why we hold it, and on what basis
| What | Why | Basis |
|---|---|---|
| Enquiry details | To read your question, decide whether we can act, run conflict-of-interest checks, and reply to you. | Your consent, given when you send the form. Where an engagement follows, the further processing is necessary to perform that contract and to take steps at your request before entering it. |
| Email address on the alert list | To send you regulatory alerts and notes. | Your consent, which you may withdraw at any time. |
| Server logs | To keep the site available, diagnose faults, and identify abuse. | Our legitimate interest in operating a secure website. |
| Records of enquiries and engagements | To meet professional, tax, anti-money-laundering and record-keeping obligations, and to establish or defend legal claims. | Compliance with legal obligations, and our legitimate interest in maintaining a defensible record. |
06Confidentiality and privilege
Do not send privileged or confidential material before an engagement is in place.
An enquiry sent through this website does not create a professional relationship, and the protections that attach to a formal engagement do not yet apply to it. Until we have confirmed that we can act, completed conflict checks and issued an engagement letter, describe the situation rather than the detail.
Once an engagement is in place, everything you tell us is held under our professional obligations of confidentiality and, where the law provides for it, privilege. Those obligations continue after the matter closes.
07Who else sees it
We do not sell, rent or trade personal data. It is disclosed only in these circumstances.
- Within the firm. To the partners and staff who need it to answer your question or run your matter, across our Indian and UAE offices.
- Service providers acting on our instructions. Our website host, our email provider, and, where used, the form-handling and mailing-list providers that deliver your enquiry and our alerts. They act only on our instructions and may not use your data for their own purposes.
- Professional advisers and co-counsel. Where a matter requires it, and with your knowledge.
- Authorities and regulators. Where we are compelled by law, court order or regulatory demand, or where disclosure is required to comply with anti-money-laundering or reporting obligations. Where we are permitted to tell you, we will.
- A successor. If the practice is reorganised, merged or transferred, subject to the same protections and to our professional obligations.
08How long we keep it
| Record | Retained for |
|---|---|
| Enquiries that do not become engagements | 24 months from your last contact with us, then deleted |
| Alert list membership | Until you unsubscribe, plus 12 months of the record of your consent |
| Engagement and matter records | 8 years from the close of the matter, or longer where professional standards, tax law, anti-money-laundering rules or an ongoing dispute require it |
| Server logs | As set by our hosting provider, ordinarily no more than 12 months |
Where a retention period has expired but the data is still needed to establish, exercise or defend a legal claim, or to meet a statutory duty, we keep only what is necessary for that purpose and delete the rest.
09Transfers outside India
We operate in India and the United Arab Emirates, so a matter touching both jurisdictions will involve personal data moving between them. Some of our service providers also store data outside India.
Where personal data leaves India we transfer it consistently with the Digital Personal Data Protection Act 2023 and any restrictions notified by the Central Government under it. Where data originating in the European Economic Area or the United Kingdom is transferred, we rely on an approved transfer mechanism, ordinarily the Standard Contractual Clauses, together with any additional measures the circumstances require.
10Security
We apply reasonable technical and organisational safeguards to the personal data we hold: access limited to those who need it, encryption of the site in transit, controlled and logged access to firm systems, confidentiality obligations on everyone who works with us, and periodic review of the providers we rely on.
No system is perfectly secure, and we do not claim otherwise. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as the Digital Personal Data Protection Act 2023 requires, and we will meet equivalent obligations under any other law that applies to the affected data.
11Your rights
Under the Digital Personal Data Protection Act 2023, and to the extent they apply to you, under the UAE Personal Data Protection Law and the EU or UK General Data Protection Regulation, you may ask us to do the following.
- Tell you what we hold. A summary of the personal data we process about you, what we do with it, and who we have shared it with.
- Correct it. Complete, correct or update anything inaccurate or out of date.
- Erase it. Delete personal data we no longer need for the purpose it was collected for, unless we are required to keep it.
- Withdraw consent. Where we rely on your consent, you may withdraw it at any time, and as easily as you gave it. Withdrawal does not affect processing already carried out.
- Nominate someone. Nominate an individual to exercise these rights on your behalf in the event of your death or incapacity.
- Complain. Raise a grievance with us, and escalate it if you are not satisfied.
- Portability and objection. Where the GDPR applies to your data, receive it in a portable form and object to processing based on legitimate interests.
Write to the Grievance Officer below to exercise any of these. We will respond within the period the applicable law allows, and in any event without undue delay. We may need to verify your identity first, and we will tell you if a professional or statutory obligation prevents us from acting on part of a request.
12Complaints
If something about the way we handle your data concerns you, raise it with our Grievance Officer. We would rather hear it directly and fix it.
P. S. Sivasankaran
Grievance Officer and Founder Partner
If you are not satisfied with our response, you may complain to the Data Protection Board of India. If you are in the United Arab Emirates, you may complain to the UAE Data Office. If you are in the European Economic Area or the United Kingdom, you may complain to your national supervisory authority.
13Children
This website is intended for businesses and professional advisers and is not directed at children. We do not knowingly collect the personal data of anyone under 18 through it. The Digital Personal Data Protection Act 2023 treats anyone under 18 as a child, and requires verifiable parental consent before their data is processed. If you believe a child has sent us personal data through this site, tell us and we will delete it.
14Changes to this policy
We review this policy periodically and whenever the way we handle personal data changes. The effective date and version at the top of the page tell you which text is current. Where a change materially affects your rights, we will say so prominently, and where the law requires fresh consent we will ask for it rather than relying on a silent update.
15Contact
Questions about this policy, or about anything else in how we handle personal data, go to sivasankaran@guardianlegal.org, or by post to our registered office at registered office address.