Privacy Notice · Sangsiama Chambers

Who this notice is from

This website is operated by Lalrinngheti Sangsiama, Advocate, of Lalrinngheti Sangsiama Chambers, Aizawl, Mizoram, India. Questions about this notice, or about information held about you, should be sent to office@sangsiamachambers.com.

In the language of the Digital Personal Data Protection Act, 2023: Lalrinngheti Sangsiama Chambers is the Data Fiduciary — it decides why and how your personal data is handled — and you, the person the data is about, are the Data Principal. This notice is the notice that Act requires, and it is written in the plainest words the subject allows rather than in the Act's own. The chambers uses no Consent Manager: consent is given to the chambers directly, on the form, and there is no intermediary between you and it.

Why this notice is longer than most

A person putting a matter to a chambers may be describing a dispute, an investigation, a commercial position or a family situation. That information is sensitive by its nature, and some of it is sensitive to the person's safety. It is treated accordingly. This notice sets out exactly what happens to it rather than reserving a general right to do as the chambers pleases with it.

What is collected

When you simply read the site

Nothing is collected about you. There is no analytics service, no advertising network, no social-media tracking, no fingerprinting and no cookie set for reading any page. Nothing is loaded from a third-party server; the fonts and images are served from this website itself.

When you use the intake form

The form asks for, and the chambers stores:

your name, email address, telephone or WhatsApp number, city, State and country;
whether you are an individual or an organisation, and the organisation's name;
the language you prefer to correspond in;
the description of the matter you write, and the outcome you say you are seeking;
any deadlines you mention, and whether proceedings have begun, before which forum, and when the next date is;
the names you give of parties on the other side and of others materially involved — these are collected specifically in order to run a conflict check, and are used for nothing else;
which acknowledgements you ticked;

Alongside that, and automatically, the chambers stores:

the date and time of the submission;
your browser's user-agent string;
a one-way hash of your IP address — not the address itself. The hash is used to limit abuse of the form. It cannot be turned back into an IP address, and the address is not written to any log kept by the chambers.

Two cookies are set while you use the intake form, and neither is used for analytics or advertising. The first holds a random value used to confirm that the form you submit is the form this website gave you; it protects against a third-party site submitting the form on your behalf, contains nothing about you, and expires within six hours. The second carries your part-finished answers from one step of the form to the next, so that nothing you have typed is put in a web address or lost between pages. It is readable only by this website's server, not by scripts on the page, it is deleted when the form is submitted, and it expires within two hours in any event. If you sign in to the client portal, a further cookie holds your session for as long as you remain signed in.

If you save an enquiry to come back to

The intake form lets you put a part-finished enquiry down and pick it up later. This happens only if you press “Save and continue later”; nothing is stored this way otherwise.

If you do, everything you have written so far — including the description of the matter and the names you have given for the conflict check — is stored on the chambers' behalf by Supabase, in Mumbai, against the email address you gave, and a link is sent to that address. The link contains a random value; only a one-way cryptographic digest of it is stored, so the record cannot be turned back into a working link by anyone who reads it. The link works once: using it returns your answers to the form and erases them from the store at the same moment. Anything not picked up is deleted 14 days after it is saved.

A saved enquiry has not been submitted to the chambers and is not read by it. Because the link is what opens it, treat it as you would a password: anyone who has it can read and send what you had written, so please do not forward it.

Why it is collected

To run a conflict check. The chambers cannot consider a matter until it has established that it is not already acting for, or has not previously acted for, someone on the other side. This is a professional obligation, not a preference.
To decide whether the chambers can act, and to tell you the answer.
To carry out the work, if the chambers accepts the matter and you accept its proposal.
To keep the records a legal practice is required to keep, including records of matters declined and of conflict checks performed.
To protect the form from abuse. That is the sole purpose of the hashed IP address.

Your information is not used for marketing. You will not be added to a mailing list. The chambers will not contact you about anything other than the matter you submitted.

On what basis

You give the information by filling in a form and pressing send, having read what it will be used for; that is your consent, and it is specific to the purposes listed above. Some of what follows does not rest on consent and could not: a record that a conflict check was carried out, the record of an engagement you accepted, and anything a court or a professional rule requires the chambers to keep are kept because the law and the rules of the profession require them, and withdrawing consent does not remove them.

You may withdraw your consent at any time, as easily as you gave it, by writing to the address below. The chambers will then stop using your information for anything that rested on consent, and will tell you what it must keep and why. Withdrawing consent does not make anything already done unlawful.

How it is stored and secured

The website is served only over an encrypted connection (HTTPS).
Enquiries and matters are held in a private database hosted in Mumbai, India. It is a database used by this practice and nothing else.
Access is enforced by the database itself, not only by the website. Each record carries rules saying who may read it, and those rules are applied to every single query. A client can reach their own matters and no others; information marked internal to the chambers cannot be returned to a client at all.
The names you give for the conflict check are held separately and are readable only by the chambers. They are never shown to another client, and they are not returned to you through the website after you have submitted them.
Documents are stored privately. Stored files have no public address, cannot be reached by guessing a URL, and are stored under names generated by the server — the name you gave a file is kept only as a label, never used to build the address it is stored at.
Every file is checked by its contents rather than its name, and only ordinary document and image formats are accepted (PDF, Word, Excel, PowerPoint, OpenDocument, RTF, plain text, and images (JPEG, PNG, TIFF, HEIC)), at most 6 at a time and 10.0 MB each.
Documents are never sent by email and never attached to one. They stay in private storage and are read through the secure portal.
Messages you send through the portal stay in the portal. A notification may tell the chambers that a message exists; it does not carry its contents.
Any email the chambers sends you about an enquiry carries your reference number and nothing about the matter, so that it can sit safely in an inbox or on a shared device.
Your reference is an identifier, not a key. There is no page on this website that will show a matter, a document or a proposal to anyone who merely types a reference — access always requires signing in to the address the chambers corresponds with.
Signing in uses a single-use link sent to your email address. There is no password to be guessed, reused or stolen.
The chambers keeps a record of who did what and when — enquiries received, conflict reviews recorded, proposals sent and accepted, matters opened. This exists so that the handling of your matter can be accounted for.

Who else sees it

The chambers does not sell, rent or share your information, and does not disclose it for anyone else's marketing. It may be seen by:

Vercel Inc., which hosts this website, as a processor acting on the chambers' instructions;
Supabase Inc., which provides the database, the sign-in service and the private document storage, also as a processor acting on the chambers' instructions. The data itself is held on servers in Mumbai, India;
Resend, Inc., the chambers' email provider, which delivers the acknowledgement of your enquiry to you and notifications to the chambers. Those emails carry your reference and the fact that something has happened; they never carry the contents of your matter;
a court, regulator or other authority, where the chambers is required by law or by professional rules to disclose it;
counsel, agents or experts instructed on your matter, but only after you have engaged the chambers and only so far as the work requires.

Your enquiry and matter information is held in India. Some of these providers are companies incorporated outside India and may handle limited operational data — the delivery of a sign-in email, or the serving of a web page — from outside the country. Where that is so, the transfer is limited to what is necessary for that purpose.

How long it is kept

Matters not taken on: the enquiry and everything attached to it are deleted 12 months after the chambers declines or closes it. The deletion is carried out by the database itself, on a schedule, not by anyone remembering to do it. What survives is the audit line recording that an enquiry with that reference was received and purged, and on what date; it holds no description, no party and no contact detail.
Matters taken on: the file is kept for 7 years after the matter closes, and then reviewed. That period is set so that the file outlasts the time in which a claim about the work could still be brought and the years for which the chambers' own tax and professional records must be produceable. Nothing in this system deletes a client file automatically; closing one is a decision the advocate takes, on a file the advocate has looked at.
An enquiry saved to come back to: deleted 14 days after it is saved, and erased the moment the link is used. Nothing is saved this way unless you ask for it.
The abuse-prevention hash: kept with the record, and deleted with it.
The record of what was agreed: where you accept an engagement, the record of exactly what you accepted and when is permanent. It is evidence of the terms of your own engagement, and it is not altered or removed.

These periods are settled and are the periods the system enforces. If they change, this page changes on the same day.

Your rights

As a Data Principal under the Act, you may:

ask what is held about you, and be told what it is, what it has been used for, and who else it has been shared with;
ask for it to be corrected, completed or brought up to date, if any of it is wrong or has changed;
ask for it to be erased, and have that done unless the chambers must keep it — see the paragraph below;
withdraw your consent, as set out above;
nominate another person to exercise these rights for you if you die or become unable to exercise them yourself;
have a grievance answered, before taking it anywhere else.

Write to office@sangsiamachambers.com, quoting your enquiry reference. There is no charge, and no form to fill in.

Deletion cannot always be complete. Where a matter has been taken on, where you accepted an engagement, where an invoice was issued, or where a record must be kept to show that a conflict check was carried out, the chambers is obliged to retain part of the record. If that applies you will be told which part and why — the chambers' own erasure procedure refuses to run silently in that situation and names the obstacle.

Grievances

Any complaint about how your information has been handled goes first to the chambers. The person answerable for it is Lalrinngheti Sangsiama, Advocate, reachable at office@sangsiamachambers.com. A grievance is answered within 30 days. This is a sole practice: that person is the advocate, and there is no larger organisation behind the title.

If the chambers' answer does not satisfy you, the Act gives you a complaint to the Data Protection Board of India. You are asked to come to the chambers first only because that is what the Act contemplates, not because it limits anything you may do afterwards.

Children

The intake form is not intended for use by children. Where a matter concerns a child, it should be submitted by a parent, guardian or other person entitled to act for them.

Changes to this notice

Any change will be published on this page, with the review date at the top updated. Material changes will not be applied retrospectively to information already submitted.

This notice describes what this website actually does, and it is read out of the same configuration the intake form and the portal are built from, so it cannot quietly fall out of step with them. It is approved for publication. It is not a substitute for the terms on which the chambers is engaged, which are agreed separately and in writing, nor for the Disclaimer.