On this page
This policy explains what personal data VERMANCO collects through this website, why it is collected, how it is used and protected, how long it is kept, and the choices and rights available to you. For the purposes of the Digital Personal Data Protection Act, 2023, VERMANCO is the Data Fiduciary for personal data collected through this website.
The policy is written to align with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The Act was enacted in August 2023; the Rules were notified in November 2025, and the Act and the Rules are being brought into force in phases, with most obligations taking effect in May 2027. Until then, other applicable law continues to apply, including the Information Technology Act, 2000 and the rules made under it.
Personal data we collect
Information you provide
- Contact form and email: your name, email address, telephone number (optional), the subject and the content of your message.
- Consultation requests: your name, email address and telephone number, the area of practice concerned, a brief description of the matter, including the names of the other parties involved (which the form asks for, so that we can check for conflicts of interest), your preferred chamber, and preferred dates and times.
- Judgment research submissions: your name, email address, telephone number, postal address (optional) and state, the level of court concerned, a description of your case, and any document you upload.
- Correspondence: anything you send us by email, telephone, a messaging service or post in connection with an enquiry. Messages sent through a third-party messaging service are also subject to that service's own terms and privacy policy.
Information collected automatically
- Technical information such as IP address, browser type, device type, pages visited and the date and time of access, recorded in server logs for security and to keep the website functioning properly.
- A record, stored in your own browser, that you have acknowledged the Bar Council of India disclaimer, so that it is not shown on every visit. This website does not use advertising cookies.
Information about other people
Case details and documents often contain personal data of other people, such as family members, opposite parties or witnesses. Please share only what is necessary for the purpose, and only where you are entitled to share it. We handle such information with the same care as your own.
Please do not send passwords, banking credentials or card details through this website. Where an identity document is relevant, mask numbers (such as an Aadhaar number) that are not needed.
Why we use it
- To respond to your enquiry and to arrange and conduct consultations.
- To check for conflicts of interest before discussing a matter in detail.
- To carry out judgment research you have requested and to share the research note with you.
- To communicate with you about your enquiry, request or matter.
- To meet our legal and professional obligations, and to establish, exercise or defend legal claims.
- To keep this website secure and functioning properly.
We do not sell personal data, and we do not use it for marketing. Consistent with the Bar Council of India Rules, we do not send unsolicited promotional communications.
Consent and its withdrawal
Where we rely on your consent, it is given when you submit a form or write to us after being shown this policy, and it extends only to the purposes described here. You may withdraw consent at any time by writing to legal@vermanco.com. Withdrawal does not affect processing carried out before it, and we may be unable to continue with a request that depends on the data concerned. Some processing may continue where the law permits or requires it without consent, for example to comply with a legal obligation.
Who we share it with
- Advocates and staff of the firm who need the information to deal with your enquiry or matter, all of whom are bound by confidentiality.
- Service providers who host this website or deliver form submissions and email to the firm, acting as Data Processors on our instructions and under contractual obligations of confidentiality and security.
- Courts, tribunals and authorities, where you have instructed us to act and disclosure is part of that work, or where the law requires it.
Some service providers may store or process data on servers outside India. Any such transfer is made in accordance with the Digital Personal Data Protection Act, 2023, including any restrictions notified by the Central Government.
How long we keep it
We keep personal data only for as long as it is needed for the purpose for which it was collected, and then erase it, unless a longer period is required by law. In particular:
- Enquiries and research submissions that do not lead to an engagement are erased once they have been dealt with and are no longer needed for any follow-up, subject to any minimum period for which records and logs must be kept under the Digital Personal Data Protection Rules, 2025 or other law.
- Where the firm acts for you, your file is kept for as long as our professional obligations and the applicable limitation periods require.
- Server logs are kept for the period needed for security purposes and any minimum period required by law.
How we protect it
We take reasonable security safeguards to protect personal data, including encryption of data in transit to and from this website, restricted access to submissions, and contractual obligations on our service providers. If a personal data breach occurs, we will inform affected persons and the Data Protection Board of India as the law requires.
Your rights
Subject to the Act and the Rules, you may:
- obtain a summary of the personal data we hold about you and of the processing carried out, and the identities of those with whom it has been shared;
- ask us to correct, complete or update inaccurate or incomplete data;
- ask us to erase data that is no longer needed, unless we are required by law to retain it;
- withdraw consent you have given;
- nominate another individual to exercise your rights in the event of death or incapacity; and
- have a grievance about our handling of your personal data addressed.
Some of these rights take effect as the relevant provisions of the Act and the Rules come into force; we aim to honour reasonable requests now. We may need to verify your identity before acting on a request. The Act also places duties on Data Principals, including not to impersonate another person, not to suppress material information and not to file false or frivolous grievances.
Children
This website is intended for adults. If a matter concerns a child (a person under eighteen), the enquiry should be made by a parent or lawful guardian. We do not knowingly collect personal data directly from children.
Grievances and requests
To exercise your rights, withdraw consent or raise a grievance, write to legal@vermanco.com with the subject line "Data protection request", or by post to VERMANCO, Chamber No. 303, Street No. 8, Surajpur District Court, Gautam Budh Nagar, Noida, Uttar Pradesh 201306. We will acknowledge your request and respond within a reasonable period, and in any event within ninety days.
Once the relevant provisions of the Act are in force, if you are not satisfied with our response, you may complain to the Data Protection Board of India. The Act requires you to use our grievance process first.
Changes to this policy
We may update this policy to reflect changes in the law or in our practices. The date at the top of this page shows when it was last updated.