Last Updated: 16 May 2026
Aran Law Firm (“we,” “us,” or “our”) is committed to protecting the privacy and personal data of every individual who visits our website at https://aranlaw.in (the “Website”). This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the Digital Personal Data Protection Act, 2023 (“DPDPA 2023”) and the Information Technology Act, 2000 (“IT Act”).
1. Data Fiduciary Information
Name: Aran Law Firm (Aran Law Associates)
Address: 84, A Wing, Murugesan Naicker Complex, Greams Road, Thousand Lights, Chennai – 600 010, Tamil Nadu, India
Phone: +91 89396 52266
Email: [email protected]
Under Section 2(i) of the DPDPA 2023, we are a Data Fiduciary as we determine the purpose and means of processing your personal data.
2. Information We Collect
2.1 Information You Provide Directly
When you use our contact form, enquiry form, or reach out to us via WhatsApp or phone, we may collect your name, phone number, email address, city, and any details you include in your message. This data is collected with your consent (Section 6, DPDPA 2023) for the purpose of responding to your legal enquiry.
2.2 Information Collected Automatically
When you browse our Website, certain technical data is collected automatically through cookies and similar technologies. This includes your IP address, browser type and version, device information, pages visited, time spent on pages, referring URL, and approximate geographic location derived from your IP address.
2.3 Cookies and Tracking Technologies
Our Website uses the following cookies and tracking technologies:
Cloudflare (Essential): We use Cloudflare for security, DDoS protection, and content delivery. Cloudflare may set cookies such as __cf_bm and cf_clearance for bot detection and security verification. These are strictly necessary cookies and do not require consent under DPDPA 2023.
Cloudflare Turnstile (Essential): Our contact form uses Cloudflare Turnstile CAPTCHA to prevent spam submissions. This processes limited technical data to verify you are a human visitor.
Google Analytics / Site Kit (Analytics): We use Google Analytics (via Google Site Kit) to understand how visitors interact with our Website. This may set cookies such as _ga and _gid. Analytics cookies are used with your consent to improve our content and user experience.
WP Rocket (Performance): We use WP Rocket for website caching and performance optimisation. WP Rocket may set functional cookies to deliver cached content efficiently.
3. Purpose and Legal Basis for Processing
We process your personal data for the following purposes, each with a lawful basis under the DPDPA 2023:
Responding to enquiries: When you submit the contact form or call us, we process your data to respond to your legal query. Lawful basis: Consent (Section 6).
Website security: We process technical data to protect our Website from malicious attacks, bot traffic, and security threats. Lawful basis: Legitimate use (Section 7(b) — reasonable purpose for security of the Website).
Website analytics: We analyse aggregated visitor data to improve our Website’s content, structure, and performance. Lawful basis: Consent (Section 6).
Legal compliance: We may process data where required by applicable law, court order, or regulatory direction. Lawful basis: Section 7(e) — compliance with law.
4. Data Sharing and Third-Party Processors
We do not sell, rent, or trade your personal data. We may share data with the following categories of Data Processors (Section 8, DPDPA 2023) who process data on our behalf:
Cloudflare, Inc. (USA) — Website security, CDN, and DNS services.
Google LLC (USA) — Website analytics via Google Analytics and Google Site Kit.
Formidable Forms — Contact form processing plugin (data remains on our server).
Hosting provider — Our web hosting provider stores Website data on servers located in India or Singapore.
Where data is transferred outside India, we ensure that the recipient provides a degree of protection equivalent to the DPDPA 2023, in line with any rules notified by the Central Government under Section 16.
5. Data Retention
We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected:
Contact form submissions: Retained for up to 3 years from the date of submission, or until the matter is concluded, whichever is later.
Analytics data: Aggregated and anonymised analytics data may be retained indefinitely. Identifiable analytics data is retained for up to 26 months in Google Analytics.
Server logs: Technical server logs are retained for up to 90 days.
Upon expiry of the retention period, or upon a valid erasure request, we will delete or anonymise your personal data in accordance with Section 8(7) of the DPDPA 2023.
6. Your Rights Under the DPDPA 2023
As a Data Principal, you have the following rights under the DPDPA 2023:
Right to Access (Section 11): You may request a summary of the personal data we process about you and the processing activities undertaken.
Right to Correction and Erasure (Section 12): You may request correction of inaccurate or incomplete personal data, or erasure of data that is no longer necessary for the purpose for which it was collected.
Right to Grievance Redressal (Section 13): You have the right to lodge a grievance with us regarding any data processing concern. We will respond within 30 days.
Right to Nominate (Section 14): You may nominate an individual to exercise your rights in the event of your death or incapacity.
To exercise any of these rights, please contact us at the details provided in Section 1 above. We may request verification of your identity before processing your request.
7. Children’s Data
Our Website is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided personal data to us, please contact us immediately so we can delete the data in accordance with Section 9 of the DPDPA 2023.
8. Data Security Measures
We implement reasonable security safeguards to protect your personal data against unauthorised access, disclosure, alteration, or destruction, as required under Section 8(4) of the DPDPA 2023. These include SSL/TLS encryption (HTTPS) across the entire Website, Cloudflare Web Application Firewall (WAF) and DDoS protection, access controls limiting data access to authorised personnel, regular security audits and software updates, and secure hosting with automated backups.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices or applicable law. The “Last Updated” date at the top of this page indicates when the policy was most recently revised. We encourage you to review this page periodically. Continued use of the Website after any changes constitutes acceptance of the updated policy.
10. Grievance Officer
In accordance with the IT Act, 2000 and DPDPA 2023, the Grievance Officer for data-related concerns is:
Name: Arul. A
Designation: Grievance Officer, Aran Law Firm
Address: 84, A Wing, Murugesan Naicker Complex, Greams Road, Thousand Lights, Chennai – 600 010
Phone: +91 89396 52266
Email: [email protected]
Grievances will be acknowledged within 48 hours and resolved within 30 days from the date of receipt.
11. Governing Law and Jurisdiction
This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000. Any disputes arising from or related to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Chennai, Tamil Nadu.
This Privacy Policy was last reviewed and updated on 16 May 2026.
© 2026 Aran Law Firm. All rights reserved.