Privacy Policy

This policy explains what we collect through the site, why we collect it, who we share it with, how long we keep it and the rights you have under the Digital Personal Data Protection Act, 2023.

It covers this website, our consultation and enquiry forms, the service deck download and our legal alerts. Personal data we process while acting on an engagement is also governed by the engagement letter and by the professional and statutory obligations that apply to a law firm.

Consultation and enquiry forms

Your name, email address, phone number, company name, jurisdiction, funding stage, the service you are interested in, and the message you write to us.

Service deck requests

Your name, email address and company name, so we can send you the deck and follow up if you ask us to.

Legal alerts

The email address you give us when you ask to receive our regulatory updates, and your name if you provide it.

Technical and usage data

IP address, device and browser type, pages viewed, referring link and approximate location derived from your IP address, together with the consent choice you record on our cookie banner.

What we ask you not to send

Please do not submit identity documents, bank details or other sensitive personal data through the website forms. If we need KYC or corporate documents, we will ask for them through a secure channel once an engagement begins.

To respond to you

To answer your enquiry, arrange a consultation, and understand which practice area your matter relates to. This processing follows from your request to be contacted.

To send what you asked for

To deliver the service deck, and to send legal alerts where you have asked to receive them. You can withdraw that consent at any time.

To run and protect the site

To keep the site secure, prevent abuse and spam, and understand aggregate usage so we can improve the content and structure.

To meet legal and professional obligations

To run conflict checks, keep the records a law firm is required to keep, and respond to regulators, courts or lawful requests where an engagement or the law requires it.

We use a small number of cookies and browser storage entries: your cookie-banner choice, session security for logged-in areas, and aggregate analytics about which pages are read.

You can block or delete these through your browser. Some parts of the site may behave differently if you do. We do not run third-party advertising or cross-site tracking pixels, and we do not sell data to advertisers.

Inside the firm

Our lawyers, staff and supervised interns who need the information for the purpose it was collected, all bound by confidentiality.

Service providers

Providers who host the site, deliver email, store documents, process payments and measure aggregate traffic, each under a contract that limits them to acting on our instructions.

Where an engagement requires it

Counterparties, banks, authorised dealers, merchant bankers, valuers and professional advisers, but only as needed for the matter you have engaged us on.

Where the law requires it

Regulators, courts, law enforcement or a professional body, where we are legally obliged to disclose, or to establish or defend a legal claim.

A successor entity

If our practice is reorganised or merged, information may transfer to the successor, which remains bound by this policy.

What we never do

We do not sell personal data, and we do not share enquiry details with investors, other clients or third parties for their own marketing.

Our service providers and some of the people who support our systems may process data outside India. Under the DPDP Act, transfers are permitted to all countries except those the Government notifies as restricted, and we remain responsible for the data after it leaves India.

Where data is transferred, we rely on contracts that require a comparable standard of protection. Engagement files are transferred only where the matter itself requires it, for example a filing in a foreign jurisdiction.

Enquiries that do not become matters

We keep enquiry records while the conversation is live and for a limited period afterwards so the discussion can be picked up again, then delete or anonymise them.

Service deck requests and alerts

Kept until you unsubscribe or ask us to remove them, after which we keep only the minimum record needed to honour your request.

Engagement records

Kept for as long as the law and applicable professional rules require, and until the limitation period for any related claim has expired.

Access is limited to the people who need it. Data is encrypted in transit, systems sit behind access controls, and providers are selected with security in mind.

No website or email channel is completely secure. That is why we ask you not to send identity documents, bank details or other sensitive material through site forms, and why we use a secure channel once an engagement begins.

• Give you a summary of the personal data we hold about you and how we process it
• Correct, complete or update information that is inaccurate
• Erase data we no longer need, where no legal or professional retention obligation applies
• Withdraw consent, for example by unsubscribing from legal alerts
• Raise a grievance about how your data has been handled
• Nominate another person to exercise these rights in the event of your death or incapacity

How to exercise them

Email hello@startuptru.com describing the right you want to exercise. We aim to respond within 30 days and may ask you to verify your identity before we act. Some requests will be limited by the records a law firm is required to keep.

We send legal alerts only where you have asked for them. Every alert includes an unsubscribe link, and you can also email us at any time to stop receiving them. Leaving an alert list does not affect correspondence about a matter we are handling for you.

The site is intended for founders, companies and their advisers, and is not directed to children under 18. We do not knowingly collect their personal data. If you believe a child has provided us with data, contact us and we will delete it.

We will update this policy when our practices or the law change. The date at the top of this page shows the latest version, and material changes will be flagged on the site.

Privacy contact

Startup Tru Legaltech LLP, New Delhi, India. Email hello@startuptru.com. We aim to respond to privacy requests and grievances within 30 days.