Privacy notice
Last updated:
Who is responsible
Adv. Prisca Fernandes, Advocate, Mumbai (“I”, “me”) decides why and how the personal data sent through this website is used. For the purposes of India’s Digital Personal Data Protection Act, 2023 (DPDP Act) I am the Data Fiduciary, and for visitors in the EU or UK if the GDPR applies, I am the controller. Contact: Email address (shown when JavaScript is enabled): advprisca at gmail [dot] com, +91 98923 75027.
What is collected
When you send a consultation request: your name, phone/WhatsApp number, email address (optional), the area of practice, an optional brief summary (up to 280 characters), the page language, a reference number and the time you gave consent. Nothing else is collected through the form. Please do not include confidential details, details of other people, health information or documents; details can be discussed on the call.
Why it is used
Only to respond to your request: to contact you, send you an automatic confirmation of receipt (if you gave an email address), arrange the first consultation by phone call and keep a record of the request. Your details are not used for marketing or newsletters, are not sold, and are not used to profile you.
Legal basis
Your consent, given by ticking the box on the form (DPDP Act, section 6). If the GDPR applies to you: steps taken at your request before a possible engagement (Art. 6(1)(b)) and your consent (Art. 6(1)(a)).
Service providers
The website is hosted by Cloudflare, which also runs the form handler and the Turnstile spam check. Requests and the confirmation email are sent through Resend (an email-delivery service) to my work email, [email protected] (Google). If enabled, a minimal copy (name, phone, email, area, reference; not the summary) is stored in a Google Sheet in my own Google account. If you choose WhatsApp, Meta (WhatsApp) processes your message under its own terms. Cloudflare (hosting and the form handler) and Resend act as processors on my instructions. Google (Gmail), Meta (WhatsApp) and Cloudflare (for the Turnstile check, see www.cloudflare.com/turnstile-privacy-policy) act as independent providers, not on my instructions. These providers may process data outside India, including in the United States and the EU. Section 16 of the DPDP Act allows transfer outside India unless the Government restricts a country; no country has been restricted so far.
How long it is kept
If a request does not lead to a consultation, the request and its emails are deleted 12 months after they are received. This period is not shorter than the one-year minimum for keeping records of processing under Rule 8(3) of the DPDP Rules, 2025, which applies from 13 May 2027. If it does lead to a consultation, it becomes part of the matter file and is kept as long as professional and legal obligations require.
Your rights
You may ask for a summary of your data and how it is used, its correction, completion, updating or erasure, and you may withdraw your consent at any time, by replying to the confirmation email or writing to Email address (shown when JavaScript is enabled): advprisca at gmail [dot] com. Withdrawing is as easy as giving consent and does not affect what was done before. After withdrawal your request is not processed further, except where a law requires a record to be kept. You may nominate another person to exercise these rights on your behalf. If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, and may complain to your local data-protection authority.
Grievances
Please write first to Email address (shown when JavaScript is enabled): advprisca at gmail [dot] com (grievance contact: Adv. Prisca Fernandes). A reply will be sent within 30 days (the DPDP Rules, 2025 allow at most 90 days, Rule 14(3)). You must use this grievance route first; if you are not satisfied with the reply, you may complain to the Data Protection Board of India under the DPDP Act, 2023. The Board’s complaint process is not yet operational; the provisions on complaints apply from 13 May 2027.
Cookies and storage
This website sets no cookies of its own and uses no advertising, analytics or tracking tools. Your browser stores one small setting locally: the date you accepted the disclaimer, so it is not shown on every visit. After you send a request, a short summary (reference, area) is kept in your browser tab only so the confirmation page can show it; it disappears when you close the tab. When the form’s spam check (Cloudflare Turnstile) loads, Cloudflare may process technical data such as your IP address and may store a small item in your browser on its own domain (challenges.cloudflare.com) to tell humans from bots, under its own privacy terms (www.cloudflare.com/turnstile-privacy-policy).
Children
If you are under 18, please ask a parent or lawful guardian to send the request for you. Requests concerning a person under 18 should be sent by a parent or lawful guardian.
Security
The website uses HTTPS and strict security headers. Email and messaging services cannot be guaranteed to be fully secure, which is another reason to keep the first message brief. If a personal data breach occurs, I will inform the people affected and the Data Protection Board of India as the DPDP Act, section 8(6) and Rule 7 require.
Changes
This notice may be updated. The date at the top shows the latest version.