Privacy Policy
Last Updated: 15 September 2026
Version: 3.0
Notice under the DPDP Act 2023
This Privacy Policy explains how Corpus Juris Legal, a unit of Unified Chambers & Associates (“we”, “us”, “the firm”), collects, uses, shares, stores and protects personal data when you visit www.corpusjurislegal.com (the “Website”), contact us, subscribe to our updates, apply to work with us, or engage us for legal services.
It is our notice to you as a Data Principal under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025. It also describes our practices under section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”). Please read it with our Cookie Policy and Legal Disclaimer.
1. Who We Are — the Data Fiduciary
Corpus Juris Legal, a unit of Unified Chambers & Associates, is the Data Fiduciary for the personal data described in this Policy: we decide why and how it is processed.
Data Fiduciary: Corpus Juris Legal (a unit of Unified Chambers & Associates)
Principal office: Jeevan Bharati Tower, 1st Floor, Connaught Place, New Delhi – 110001
Email: legal@corpusjurislegal.com
Phone: +91 84008 60008
Questions and grievances: our Grievance Officer — see section 11
2. Personal Data We Collect
2.1 Data you give us
- Enquiries: through our contact form — your name, company, designation, email address, phone number, the service you are interested in and your message — or by email, phone or WhatsApp.
- Newsletter and legal updates: your email address and, if you choose to give them, your name, company and areas of interest.
- Job and internship applications: the CV, covering letter, writing samples, academic records and referee details you email to us.
- Correspondence: anything you include in emails, letters, calls or messages to the firm.
2.2 Data collected automatically
- Hosting and security logs: when you load a page, our hosting provider processes technical data such as your IP address, browser and device type, the page requested and the time of the request, to deliver and secure the Website.
- Analytics — only if you click “Accept All”: Google Analytics 4, which sets cookies and records the pages you view, how you reach and use them, your device and browser, and your approximate location; and Vercel Web Analytics and Speed Insights, which measure page views and page performance without cookies. If you decline, none of these tools loads.
- Choices stored in your browser: your cookie choice and your acknowledgement of our Bar Council of India notice are kept in your browser's local storage, as our Cookie Policy explains.
2.3 Data in client matters
When you engage us, we process the personal data a matter needs — which can include identity and contact details, financial and corporate records, and information about other people involved, such as counterparties, employees or witnesses. That processing is also governed by our engagement letter and our professional duty of confidentiality.
3. Why We Use Your Data, and on What Basis
The DPDP Act allows personal data to be processed with your consent (section 6) or for certain legitimate uses (section 7). We use your data for these purposes only:
Responding to your enquiry, including checking for conflicts of interest before we advise
Basis: Data you voluntarily provide for this purpose (section 7(a), DPDP Act). You may tell us at any time that you do not want us to use it.
Advising and representing clients
Basis: Your consent and the terms of our engagement letter, together with the processing the law requires of us.
Sending the newsletter and legal updates you sign up for
Basis: Consent (section 6). Unsubscribe at any time.
Website analytics (Google Analytics 4, Vercel Web Analytics and Vercel Speed Insights)
Basis: Consent, given by clicking "Accept All" on our cookie banner. Nothing loads if you decline.
Considering job and internship applications
Basis: Data you voluntarily provide for this purpose (section 7(a)).
Operating and securing the Website (hosting and security logs)
Basis: Needed to deliver the pages you request and to meet our security obligations under the Information Technology Act 2000 and CERT-In directions.
Complying with law, court orders and lawful requests; keeping tax and accounting records; establishing, exercising or defending legal claims
Basis: Legal obligations and orders (section 7(d) and (e)); processing necessary to enforce legal rights or claims (section 17(1)(a)).
We do not sell personal data, and we do not use it to make automated decisions about you.
4. Consent and How to Withdraw It
Where we rely on consent, we ask for it separately and for a stated purpose. You can refuse and still use the Website. You can withdraw consent at any time:
- Analytics: open Cookie Settings in the website footer and choose Decline. Google Analytics stops at once and its cookies are deleted from your browser; Vercel's analytics are no longer loaded.
- Newsletter: use the unsubscribe link in any email, or write to legal@corpusjurislegal.com.
- Anything else: write to our Grievance Officer (section 11).
Withdrawal does not affect processing that took place before it. Once you withdraw, we stop processing the data concerned, and have our processors stop, within a reasonable time — unless the law requires or permits us to keep it.
5. Who We Share Personal Data With
- Our parent firm: enquiries and newsletter sign-ups submitted through the Website are emailed to legal@corpusjurislegal.com with a copy to legal@unifiedchambers.com, the inbox of Unified Chambers & Associates. The parent firm handles them under the same confidentiality obligations and this Policy.
- Data Processors: Google provides our email (Google Workspace), through which enquiries, sign-ups and correspondence are sent and stored, and — only if you accept analytics — Google Analytics 4. Vercel hosts the Website, processes form submissions and the technical logs needed to deliver it, and — only if you accept analytics — provides Vercel Web Analytics and Speed Insights. They process personal data on our behalf under their data processing terms.
- WhatsApp: if you choose to message us on WhatsApp, that service is provided by WhatsApp under its own terms and privacy policy.
- Co-counsel and experts: on a client matter, we may share relevant data with co-counsel, experts or other professionals engaged on it, under duties of confidentiality.
- Courts, tribunals and authorities: where the law or an order requires disclosure, including to regulators and law enforcement agencies.
- Successors: if the firm's practice is reorganised or transferred, to the successor, with the protections of this Policy.
6. Processing Outside India
Our email, website hosting and analytics providers (Google and Vercel) operate infrastructure that may be located outside India, including in the United States, so your personal data may be processed outside India.
The DPDP Act permits such transfers except to countries or territories restricted by the Central Government by notification, and we will comply with any restriction. We use only providers that are bound to protect personal data to at least the standard Indian law requires.
7. How Long We Keep It
Enquiries that do not lead to an engagement: up to three years from our last contact with you.
Client matter files: for the engagement and up to seven years after the matter concludes, or longer where the law requires — for example, for tax records or while a claim is pending.
Newsletter: until you unsubscribe.
Job and internship applications: until the recruitment decision and for up to twelve months afterwards, so we can consider you for other openings, unless you ask us to delete them sooner.
Analytics: Google Analytics event data is kept for the retention period set in our account, which is not more than 14 months. Google Analytics cookies expire after up to two years unless you delete them or withdraw consent.
Hosting and security logs: for the period our hosting provider keeps them and any longer period required by CERT-In directions.
When a retention period ends, we erase the data or make sure it can no longer identify you.
8. Your Rights as a Data Principal
Access
Ask for a summary of the personal data we process about you, the processing we carry out, and the other Data Fiduciaries and Data Processors we have shared it with (section 11).
Correction and erasure
Ask us to correct, complete or update your personal data, or to erase data we no longer need for the purpose it was collected for, unless the law requires us to keep it (section 12).
Withdraw consent
Withdraw any consent you have given, as easily as you gave it (section 6(4)). See section 4 below.
Grievance redressal
Complain to our Grievance Officer about how we have handled your personal data (section 13).
Nominate
Nominate another individual to exercise your rights if you die or become incapable of doing so (section 14).
To exercise a right, write to our Grievance Officer (section 11). We may ask you to confirm your identity first. We will acknowledge your request promptly and respond within 30 days.
Some rights are limited where the law allows — for example, where we process data to enforce legal rights or claims (section 17(1)(a) of the DPDP Act), or where disclosure would breach legal professional privilege or our duty of confidentiality to a client.
The DPDP Act also asks Data Principals to give authentic information and not to make false or frivolous complaints (section 15).
9. How We Protect It
We maintain reasonable security practices and procedures, including:
- TLS encryption for all data sent to and from the Website;
- access to personal data limited to the people who need it for their work;
- established service providers that maintain their own security programmes;
- procedures for handling security incidents.
If a personal data breach occurs, we will inform affected Data Principals and the Data Protection Board of India as the DPDP Act and Rules require, and report cyber security incidents to CERT-In within the time it prescribes.
10. Children
The Website and our services are not directed at anyone under 18. The DPDP Act requires verifiable parental consent before a child's personal data is processed; if we learn that we hold a child's data without it, we will delete it. If you believe we do, please contact our Grievance Officer.
11. Grievance Officer and the Data Protection Board
Questions, requests and grievances about your personal data go to our Grievance Officer:
Grievance Officer
Corpus Juris Legal (a unit of Unified Chambers & Associates)
Jeevan Bharati Tower, 1st Floor, Connaught Place, New Delhi – 110001
Email: legal@corpusjurislegal.com (subject line: “Grievance Officer”)
Phone: +91 84008 60008
We will acknowledge your grievance promptly and respond within 30 days of receiving it.
The Data Protection Board of India has been established under the DPDP Act. If you are not satisfied with our response, you may complain to the Board after using our grievance process, in the manner set out in the DPDP Act and the DPDP Rules, 2025.
12. The Law That Applies
The DPDP Act's obligations on Data Fiduciaries are being brought into force in phases. Until they fully commence, section 43A of the Information Technology Act, 2000 and the SPDI Rules continue to apply to us, and we follow both regimes.
13. Third-Party Links
The Website links to other websites, such as Google Maps and WhatsApp. We are not responsible for their privacy practices; please read their policies.
14. Changes to This Policy
We will post any changes on this page and update the date at the top. If a change affects processing that relies on your consent, we will ask for your consent again where the law requires. We will not treat your continued use of the Website as consent.