Privacy Policy

Medhas Law ("we", "us", "our" or "the Firm") is a global technology law firm with offices in India, the United States and Canada. We are committed to protecting the personal information of individuals who interact with us through our website, enquiries, consultations, legal engagements and other digital communications.

This Privacy Policy describes how we collect, use, store, disclose and protect personal information in connection with the operation of our website at www.medhaslaw.com and through our legal practice. It applies wherever we process personal information and is intended to inform you of your rights and our obligations in relation to that information.

By accessing our website or submitting information to us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please refrain from using our website or submitting personal information to us.

This Privacy Policy applies to:

• Visitors to the Medhas Law website, including all pages, subpages and digital resources hosted at www.medhaslaw.com;
• Prospective clients who submit enquiries, appointment requests, contact forms or consultation requests through our website or by other means of digital communication;
• Clients who engage Medhas Law for legal services, to the extent such engagement involves processing of personal information through our website or digital systems;
• Individuals who communicate with us by email, telephone or other electronic means in connection with our services; and
• Any other person whose personal information is processed by us in connection with the operation of this website.

This policy does not govern information processed solely in connection with active client-matter files, which may be subject to separate engagement terms, retainer agreements and professional conduct obligations applicable to the jurisdictions in which we practise.

Depending on how you interact with our website and services, we may collect the following categories of personal information:

• Identity Information: Your full name and, where relevant and voluntarily provided, identification details necessary for the purpose of a legal consultation or engagement.
• Contact Information: Email address, telephone number and postal address, where provided by you in connection with an enquiry, consultation request or correspondence.
• Enquiry and Matter Information: Details of your legal matter, the nature of your enquiry, and any background information you voluntarily submit through our website forms, emails or appointment requests.
• Professional and Business Information: Where relevant to your enquiry or proposed engagement, the name and nature of your business, your professional role or the commercial context of your matter.
• Documents Voluntarily Submitted: Any documents, records or attachments you choose to provide in connection with a consultation request or legal enquiry. We caution you against submitting sensitive documents through general website forms.
• Technical Information: IP address, browser type and version, device type and operating system, pages visited, referral URLs, session duration and other usage data collected automatically through website analytics and standard server logs.
• Cookie Data: Information stored or retrieved through cookies and similar technologies as described in Section 7 of this policy.

We collect only information that is reasonably necessary for the stated purposes. We do not seek to collect sensitive personal information (such as health data, financial account credentials or government identification numbers) through our general website forms.

We collect personal information through the following means:

• Website Forms: Contact forms, appointment request forms, consultation enquiry forms and other interactive features on our website through which you voluntarily submit personal information.
• Email Communications: Correspondence sent directly to our email addresses, including enquiries, documents and follow-up communications.
• Telephone Calls: Conversations initiated by you or by us in connection with an enquiry or legal matter, to the extent information is recorded or noted for follow-up purposes.
• Direct Written Communications: Letters, messages and other written communications addressed to our offices.
• Automatic Collection via Website Technologies: Standard web technologies including server logs, session data and browser-based tools that collect technical information about how visitors interact with our website.
• Cookies and Similar Technologies: As described in Section 7 of this policy.

We do not purchase personal information from third-party data brokers or marketing databases.

We process personal information only for legitimate purposes, which include:

• Responding to Enquiries: To review, assess and respond to legal enquiries, questions and information requests submitted through our website or by other means of communication.
• Scheduling Consultations: To arrange, confirm and manage appointment requests and consultations with members of our legal team.
• Providing Legal Services: To deliver legal advice, representation and related professional services to clients who formally engage the Firm, subject to applicable professional conduct rules and engagement terms.
• Client Communication and Matter Administration: To communicate with clients regarding the progress and administration of legal matters, billing and professional obligations.
• Legal, Regulatory and Professional Compliance: To meet applicable legal obligations, court orders, regulatory requirements and professional conduct standards in India, the United States and Canada.
• Website Security and Improvement: To monitor the security of our website, detect and prevent unauthorised access, analyse usage patterns and improve the functionality and user experience of our digital platforms.
• Fraud Prevention: To identify, investigate and prevent fraudulent or abusive use of our website or communications channels.

We do not use personal information collected through this website for direct marketing purposes without appropriate consent where required by applicable law.

The legal basis for processing personal information and the privacy laws applicable to any given interaction depend on the jurisdiction in which you are located and the nature of your engagement with us. The following frameworks are relevant to our operations:

India: The Digital Personal Data Protection Act, 2023 ("DPDPA") received Presidential assent and was published in the Official Gazette. The operative provisions of the DPDPA will apply upon commencement notifications issued by the Central Government pursuant to the Act. Where applicable, and to the extent operative rules and notifications have been issued, we endeavour to process personal data of data principals in India in a manner consistent with the lawful purposes and consent requirements contemplated by the DPDPA. The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 may also apply to the collection of sensitive personal data or information through our Indian operations.

United States: No single comprehensive federal privacy law currently governs the processing of personal information by private firms in the United States in all contexts. Various sector-specific federal laws and state-level privacy statutes may apply depending on the nature of information processed and the state of residence of the individual. Where applicable, we endeavour to comply with relevant requirements of applicable United States law.

Canada: The Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation may apply to personal information collected through our Canadian operations or in relation to individuals in Canada. We endeavour to handle such information in accordance with applicable Canadian privacy requirements.

We process personal information on one or more of the following bases, as applicable in the relevant jurisdiction: (a) the consent of the individual; (b) the performance of or steps preliminary to a contract or engagement; (c) compliance with a legal obligation; (d) our legitimate interests in operating a law firm website and providing professional legal services, where such interests are not overridden by the rights and interests of the individual; or (e) other lawful bases recognised under applicable law.

Our website may use cookies and similar technologies to support its operation. A cookie is a small text file placed on your device by a website you visit. The following types of cookies may be used:

• Strictly Necessary Cookies: Cookies required for the basic operation of the website, including session management, security and form functionality. These cannot be disabled without impairing website functionality.
• Preference Cookies: Cookies that remember your preferences and settings to improve your experience on return visits.
• Analytics Cookies: Where analytics tools are implemented on this website, they may use cookies to collect anonymous or aggregated information about how visitors use the site, including pages visited and time spent. Such information is used to improve the website and is not used to identify individual users.

You can manage or disable cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of this website.

We do not use third-party advertising networks or behavioural targeting cookies on this website. Where the use of cookies changes materially, this policy will be updated accordingly.

We do not sell personal information to third parties. We disclose personal information only where reasonably necessary and in accordance with applicable law, including in the following circumstances:

• Authorised Personnel: Personal information is accessible to employees, advocates and legal professionals within the Firm who require it to perform their professional functions and who are bound by professional confidentiality obligations.
• Service Providers: We engage trusted third-party service providers to support our website hosting, email infrastructure, IT systems and related services. Such providers are authorised to use personal information only to the extent necessary to provide those services to us.
• Professional Advisers and Consultants: Where necessary, information may be shared with external legal counsel, professional advisers or consultants engaged to assist the Firm, subject to appropriate confidentiality obligations.
• Courts, Regulators and Government Authorities: We may disclose personal information where required by law, court order, regulatory authority, bar council or government direction, or where disclosure is necessary to protect the legal rights of the Firm or its clients.
• With Consent: With the express consent of the individual or where otherwise lawfully authorised.

Any third-party service providers with whom we share personal information are required to maintain appropriate confidentiality and security measures consistent with applicable law and the terms of their engagement with us.

Medhas Law takes appropriate steps to protect the confidentiality of communications and information received in connection with legal enquiries and engagements. The Firm's advocates and legal professionals are subject to professional conduct obligations and rules of confidentiality applicable in their respective jurisdictions of practice.

Legal professional privilege (also referred to as attorney-client privilege in common law jurisdictions) may protect communications made in confidence between a client and their legal adviser for the purpose of obtaining or providing legal advice. The existence, scope and enforceability of privilege depends on applicable law, the nature of the communication and the circumstances of the engagement.

Important Notice: The submission of information through a general website enquiry form, contact form or appointment request form does not, by itself, establish an advocate-client relationship, create legal professional privilege or impose a duty of confidentiality on the Firm. A formal engagement is established only upon execution of a written retainer agreement or formal acceptance of instructions by the Firm. Prospective clients are advised to exercise caution in submitting sensitive legal information through general website channels prior to the establishment of a formal engagement.

We retain personal information for only as long as is reasonably necessary to fulfil the purposes for which it was collected, including:

• Responding to and following up on enquiries and consultations;
• Meeting applicable legal, regulatory and professional obligations;
• Maintaining records required by applicable law or bar council requirements;
• Resolving disputes and enforcing agreements; and
• Preserving evidence in connection with potential or actual legal proceedings.

Retention periods vary depending on the nature of the information, the jurisdiction and the applicable legal or professional requirements. Where personal information is no longer required, we take reasonable steps to securely delete or anonymise it. Where we are required by applicable law to retain certain records for a specified minimum period, we comply with those requirements.

We implement reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss or destruction. These measures are designed to be appropriate to the nature of the information and the risks associated with its processing.

However, no method of transmission over the internet and no method of electronic storage is entirely secure. While we endeavour to protect the personal information we hold, we cannot guarantee absolute security of information transmitted to us electronically. Individuals transmit personal information to us at their own risk. We encourage you to refrain from transmitting sensitive personal or financial information through general website contact forms.

In the event of a security incident involving personal information that may require notification under applicable law, we will take appropriate steps in accordance with our legal obligations.

Medhas Law operates across multiple jurisdictions, including India, the United States and Canada. As a result, personal information collected through our website or in connection with our services may be accessed, processed or stored in jurisdictions other than the one in which you are located.

We use authorised service providers who may operate in jurisdictions outside your country of residence. Where personal information is transferred internationally, we endeavour to ensure that appropriate legal safeguards are in place in accordance with applicable law, which may include contractual protections or other mechanisms recognised under the relevant privacy framework.

By interacting with our website or submitting information to us, you acknowledge that your personal information may be transferred to, stored and processed in jurisdictions outside your own, subject to the safeguards described in this policy and as required by applicable law.

Depending on the jurisdiction in which you are located and the applicable privacy law, you may have certain rights in relation to your personal information. These may include:

• Right of Access: The right to request information about whether we hold personal information about you and, where applicable, to obtain a copy of that information.
• Right to Correction: The right to request that inaccurate or incomplete personal information we hold about you be corrected or updated.
• Right to Erasure or Deletion: The right to request deletion of personal information we hold about you, subject to applicable law and any overriding legal, professional or regulatory retention obligations.
• Right to Withdraw Consent: Where our processing of your personal information is based on your consent, the right to withdraw that consent at any time, without affecting the lawfulness of processing that occurred prior to withdrawal.
• Right to Object or Restrict Processing: The right to object to or request restriction of certain processing activities, subject to applicable legal exceptions.
• Right to Lodge a Complaint: The right to submit a complaint to the relevant data protection or privacy authority in your jurisdiction if you believe your privacy rights have been infringed.

These rights are not absolute and may be subject to conditions, limitations and legal exceptions under applicable law. The availability of a specific right depends on your jurisdiction and the circumstances of the processing. To exercise any available right, please contact us using the details provided in Section 17 of this policy. We will respond to verifiable requests in accordance with applicable law and within a reasonable time.

Our website may contain links to external websites, resources and platforms operated by third parties. These links are provided for reference or convenience and do not constitute an endorsement of the content, products, services or privacy practices of those third parties.

We have no control over, and accept no responsibility for, the privacy practices, security measures or content of external websites. Each third-party website is governed by its own privacy policy and terms of use. We encourage you to review the privacy policies of any third-party website you visit before submitting personal information to that website.

This website is not directed at or intended for use by children, and we do not knowingly design our website to collect personal information from minors. The legal services provided by Medhas Law are directed at adults who are of legal capacity to engage professional services and enter into binding legal arrangements.

If we become aware that personal information has been collected from a minor without appropriate legal authority or required parental or guardian consent, we will take reasonable steps to delete that information. Where applicable law requires specific protections or consents in relation to the processing of children's data, we endeavour to comply with those requirements.

We may update or revise this Privacy Policy from time to time to reflect changes in our practices, applicable law, regulatory guidance or the nature of our services. When we make material changes, the updated policy will be published on this page with a revised effective date prominently displayed.

We encourage you to review this Privacy Policy periodically to stay informed about how we handle personal information. Your continued use of our website following the publication of an updated policy constitutes your acknowledgement of the changes. Where required by applicable law, we will provide more prominent notice of material changes or seek fresh consent.

If you have any questions, concerns or requests relating to this Privacy Policy or the handling of your personal information, please contact us through the relevant office below. We will respond to privacy enquiries within a reasonable period and in accordance with applicable law.

India — Hyderabad Office

H.No.2-48/67, Plot No: 67,
Opposite The South India Shopping Mall,
Sri Shyam Nagar, Telecom Nagar,
Gachibowli, Hyderabad,
Telangana 500032

+91 91428 46846

legaldesk@medhaslaw.com

United States — East Brunswick, NJ

77 Milltown Road, Suite C2,
East Brunswick, NJ 08816

+1 609 786 0357

support@medhaslaw.com

Canada — Mississauga, ON

50 Burnhamthorpe Road West,
#401, Room No: 30,
Mississauga, ON L5B 3C2

support@medhaslaw.com