Privacy Policy & Data Protection Charter.
LLM International Legal Support Services, an international operating division of LLM Advocates, maintains institutional compliance with the European Union General Data Protection Regulation (EU GDPR), the United Kingdom Data Protection Act 2018 (UK GDPR), and the Digital Personal Data Protection Act, 2023 (DPDP Act, India).
This document establishes our statutory pre-collection disclosures, lawful processing bases, cross-border transmission protocols, 30-day operational retention horizons, and enforceable rights for data subjects and data principals across all ten jurisdictions we support.
Data Fiduciary Identity & Statutory Designations
LLM Advocates Operations Desk
Corporate Support Division & Global Liaison Desk.
Jurisdiction: Global Operations Headquarters, New Delhi, India.
Corporate Portal: international.llmadvocates.com
EU & UK GDPR Lead
Direct oversight of European and British cross-border transfers, Article 30 records, and data subject access requests (DSARs).
Direct Inquiries: dpo@llmadvocates.com
DPDP Act 2023 Statutory Officer
Designated pursuant to Section 6(2) and Section 13 of the Digital Personal Data Protection Act, 2023 for immediate complaint resolution.
Direct Liaison: grievance@llmadvocates.com
Lawful Grounds for Personal Data Processing
We do not process personal or corporate data without a verified lawful ground codified under applicable international law:
- 1. Pre-Contractual Steps at Inquirer Request (GDPR Art. 6(1)(b) & DPDP Act Sec. 6(1)): Processing business contact names, corporate email addresses, and organizational affiliations submitted via our scoping portal is necessary to evaluate legal support feasibility, conduct conflict clearance checks, and formulate a formal Statement of Work (SOW).
- 2. Explicit Affirmative Consent (GDPR Art. 6(1)(a) & Art. 7; DPDP Act Sec. 6): All intake forms require affirmative, unbundled, unticked consent prior to transmission. Consent may be revoked at any time without retroactive penalty.
- 3. Legitimate Security Interests (GDPR Art. 6(1)(f) & DPDP Act Sec. 8(5)): Maintaining infrastructure integrity, rate-limiting spam requests, defending against cyber attacks, and executing anti-bot honeypot filters.
- 4. Statutory Accounting & Legal Compliance (GDPR Art. 6(1)(c)): Preserving commercial audit trails and financial transaction histories where required by revenue authorities and anti-money laundering (AML) laws.
Categories of Information Collected
In adherence to the principle of Data Minimization (GDPR Art. 5(1)(c) and DPDP Act Sec. 8(2)), we collect only the minimum data elements necessary to perform institutional scoping:
A. Professional Identifiers: Name, professional title, corporate email, law firm / corporate entity name.
B. Project Scoping Metadata: Target jurisdiction (e.g., UK, US, Australia), service discipline, estimated document volume, and non-confidential factual requirements.
C. Technical Logs: IP address, user-agent string, submission timestamp (UTC), and TLS connection handshake verification.
D. Strict Non-Collection of Sensitive Personal Data: We do NOT collect special category personal data (biometrics, political beliefs, trade union memberships, genetic data) via public web forms. Privileged attorney-client case materials are strictly restricted until an encrypted repository (AES-256) is deployed under an executed NDA.
Cookie Policy & Tracking Technologies (ePrivacy, GDPR & DPDP)
In accordance with Directive 2002/58/EC (ePrivacy Directive), GDPR Article 7, and the India Digital Personal Data Protection Act, 2023, we deploy transparent cookie management with unbundled, granular affirmative consent controls. We maintain strict non-tracking integrity: we do not sell personal data, do not engage in behavioral cross-site retargeting, and do not embed third-party surveillance scripts.
| Cookie / Storage Key | Category | Purpose & Statutory Legal Ground | Duration |
|---|---|---|---|
| llm_cookie_consent_v1 | Strictly Necessary | Stores your cookie consent preferences and granular category choices (GDPR Art. 6(1)(f) & DPDP Sec. 4). | 12 Months |
| llm_dpdp_lang | Functional | Remembers your chosen Eighth Schedule Indian language under DPDP Section 5(3) for statutory notices. | Persistent (Local) |
| llm_csrf / Anti-Bot Token | Strictly Necessary | Defends forms against automated Cross-Site Request Forgery (CSRF) and bot attacks (GDPR Art. 5(1)(f) security). | Session |
| llm_telemetry_perf | Analytics | Privacy-preserving, anonymized server latency and render timing telemetry (requires explicit consent). | Session |
30-Day Automated Retention Horizon
Under GDPR Article 5(1)(e) (Storage Limitation) and DPDP Act Section 8(7) (Data Erasure upon Fulfillment), personal data provided via web scoping requests is subjected to a strict operational lifecycle:
- Active Scoping Period (Days 1–30): Information is retained in an encrypted operations queue solely for conflict clearance and scoping correspondence.
- Automatic Purge Protocol (Day 31): If an inquiry does not mature into an executed engagement agreement, personally identifiable information is permanently wiped from our operational intake log (
/data/leads.jsonl). - Contracted Engagements: Data associated with executed Master Services Agreements is migrated to a siloed project vault governed by specific client retention schedules and professional bar recordkeeping obligations.
Cross-Border Transmission & Safeguards
Where personal data originating in the European Economic Area (EEA), United Kingdom, Canada, Australia, or Switzerland is processed across borders, LLM Advocates applies comprehensive statutory safeguards:
- Standard Contractual Clauses (SCCs): Implementation of European Commission approved Standard Contractual Clauses (Module 2 Controller-to-Processor and Module 1 Controller-to-Controller) supplemented by Transfer Impact Assessments (TIAs).
- UK International Data Transfer Addendum: Compliance with the UK Information Commissioner's Office (ICO) statutory Addendum to the EU Commission SCCs.
- Cryptographic In-Flight Transit: Mandatory ESMTP with TLS 1.3 / AES-256 cipher encryption across all server sockets and network relays.
- Access Segregation: Support personnel operate within virtual private server boundaries with multi-factor authentication (MFA) and strict role-based access control (RBAC).
Data Subject & Data Principal Rights
Instructing counsel and individual corporate contacts possess guaranteed rights under EU/UK GDPR (Arts. 15–22) and India DPDP Act 2023 (Secs. 11–14):
Grievance Mechanism & Supervisory Authorities
We operate a formalized two-tier dispute resolution process:
- Tier 1 — Internal Redressal: Submit grievances directly to our Grievance Redressal Officer at grievance@llmadvocates.com. We acknowledge receipt within 24 hours and resolve matters within thirty (30) calendar days.
- Tier 2 — Regulatory Escalation: If unsatisfied with our internal response, you retain the statutory right to lodge a complaint with your regional supervisory authority:
- United Kingdom: Information Commissioner’s Office (ICO) • ico.org.uk
- European Union (Ireland): Data Protection Commission (DPC) • dataprotection.ie
- Germany: Der Bundesbeauftragte für den Datenschutz (BfDI) • bfdi.bund.de
- India: Data Protection Board of India (DPBI) • New Delhi
- Australia: Office of the Australian Information Commissioner (OAIC) • oaic.gov.au
Exercise Your Privacy Rights
To file a Data Subject Access Request (DSAR), request rectification or deletion, or lodge a formal data governance inquiry, contact our operations desk.