Privacy Policy

Who is responsible for your information

NRI Legal Services Ltd, a company registered in England and Wales (No. 08100465), registered office Stanmore Business Centre, Howard Road, HA7 1BT, London, is the controller of your personal information and your point of contact, handling your information in the United Kingdom. The India-admitted advocates who carry out the legal work handle your information in India. For most of your matter we determine jointly how your information is used; for some activities each of us decides separately. You can exercise your rights with us and we coordinate behind the scenes. For any data question, contact [data protection contact, email].

What we collect

We collect the information you give us and the information we generate or obtain in the course of your matter. This includes your identity and contact details (name, address, email, telephone, passport, Aadhaar, PAN, OCI or PIO details); details of your family and heirs where relevant; property, financial and banking details relevant to your matter; the documents and correspondence that make up your matter; and, where the matter requires it, special category data such as health information, and information relating to criminal allegations or proceedings. We also collect basic technical data when you use our website, as set out in our Cookie Policy.

Why we use it and our lawful bases

We use your information to assess your enquiry, to provide and manage our services, to communicate with you and keep you updated, to handle payments, and to meet our legal and regulatory obligations. Our lawful bases under data protection law are: the performance of our contract with you; our legitimate interests in running and developing our practice, balanced against your rights; your consent, where we ask for it; and compliance with legal obligations. Where we process special category data or data about criminal matters, we do so only where necessary for your matter and on a valid additional condition, and we maintain the appropriate policy document required under the Data Protection Act 2018.

How we share it

We keep your information confidential to your matter. We share it only with the people who need it to deliver your matter: our own teams, the India-admitted advocates of our associate practice who carry out your legal work, and, where your matter needs advice on tax, on the law of your home country, or on another specialism, the independent, locally regulated professionals we coordinate for you, who advise you directly. We may also share information with third parties such as banks, courts, revenue authorities, valuers, notaries and translators where necessary to your matter, and where we are required to by law. We do not sell your information, and we do not share it for anyone else’s marketing.

Artificial intelligence and confidentiality

Your information is never entered into, processed by, or disclosed to any public or third party artificial intelligence service, and is never used to train any artificial intelligence system. Where we use technology to work more efficiently, it operates only within our own secure systems, and a qualified person always reviews the result before anything is sent to you or acted upon.

Sending information to India

Because your legal work is carried out in India, your information is transferred to the India-admitted advocates there. That transfer is protected by a formal International Data Transfer Agreement incorporating the safeguard issued by the United Kingdom Information Commissioner, with the EU Standard Contractual Clauses applied to any processing subject to EU GDPR. This means your information keeps its legal protection when it crosses the border. A summary of the safeguard is available on request.

How long we keep it

We keep your information only for as long as we need it for your matter and to meet our legal, tax and regulatory obligations, after which we securely delete or anonymise it. Our retention periods by category are set out in our Data Retention and Deletion Schedule, available on request.

How we protect it

We apply appropriate technical and organisational measures, including access controls that limit access to the people working on your matter, encryption in transit and at rest, secure storage, staff confidentiality obligations, and a breach response procedure. No method of transmission or storage is completely secure, so while we protect your information carefully, you share it with us at your discretion.

Your rights

You have rights over your personal information, including to access it, to have it corrected or erased, to restrict or object to certain processing, to data portability where it applies, and to withdraw consent where we rely on it. Exercising these rights is subject to our legal and professional obligations, including the need to retain certain records and to preserve legal privilege. To exercise any right, contact us using the details in section 1. If you are not satisfied with how we handle your information, you may complain to the United Kingdom Information Commissioner’s Office, and, in India, to the relevant authority under the Digital Personal Data Protection Act 2023.

Changes to this policy

We may update this policy from time to time. The version number and date above show the current version.

[Client to confirm before launch: named data protection contact, ICO registration reference, retention periods, and whether a Data Protection Officer is appointed.]