SD Partners – Advocates & Solicitors Effective Date: 14th February 2026 Last Updated: 14th February 2026

1. INTRODUCTION AND SCOPE

SD Partners – Advocates & Solicitors (“SD Partners”, “Firm”, “we”, “us”, or “our”) is committed to protecting and respecting the privacy of individuals who visit our website at www.sdpartners.in (the “Website”) and who interact with us through various channels. This Privacy Policy (“Policy”) explains how we collect, use, process, store, share, and protect your personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDPA”), the Information Technology Act, 2000 (“IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and other applicable data protection laws of India.

By accessing or using this Website, or by providing your personal data to us through any means, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. Where applicable, we will seek your specific, informed, and unambiguous consent before processing your personal data, in accordance with the DPDPA.

This Policy applies to all personal data processed by SD Partners, whether collected through the Website, email communications, contact forms, event registrations, newsletter subscriptions, or any other interaction with the Firm.

2. DEFINITIONS

For the purposes of this Policy, unless the context otherwise requires:

“Data Fiduciary” means SD Partners, being the entity that determines the purpose and means of processing personal data, as defined under Section 2(i) of the DPDPA.

“Data Principal” means the individual to whom the personal data relates, including a person who provides consent on behalf of a child or a person with disability, as defined under Section 2(j) of the DPDPA.

“Data Processor” means any person or entity that processes personal data on behalf of SD Partners, as defined under Section 2(k) of the DPDPA.

“Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under Section 2(t) of the DPDPA.

“Processing” means any operation or set of operations performed on personal data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, use, alignment, combination, indexing, disclosure, sharing, restriction, erasure, or destruction, as contemplated under the DPDPA.

“Sensitive Personal Data or Information” or “SPDI” shall have the meaning ascribed to it under Rule 3 of the SPDI Rules and includes, inter alia, passwords, financial information, health data, sexual orientation, biometric information, and medical records.

3. DATA FIDUCIARY INFORMATION

SD Partners acts as the Data Fiduciary (as defined under Section 2(i) of the DPDPA) with respect to the personal data collected through or in connection with this Website.

Data Fiduciary Details: Name: SD Partners – Advocates & Solicitors Email: admin@sdpartners.in

We have not been designated as a Significant Data Fiduciary under Section 10 of the DPDPA as of the date of this Policy. Should such designation occur, we shall update this Policy and comply with the additional obligations prescribed thereunder, including the appointment of a Data Protection Officer and an independent data auditor.

4. PERSONAL DATA WE COLLECT

4.1 Categories of Personal Data

Depending on how you interact with us, we may collect and process the following categories of personal data:

(a) Identity and Contact Information: Name, designation, organisation, email address, telephone number, postal address, professional qualifications, and bar enrolment details (where applicable).

(b) Communication Data: Records of correspondence, including emails, messages sent through our contact forms, feedback, and inquiries.

(c) Technical and Usage Data: Internet Protocol (IP) address, browser type and version, operating system, device information, time zone setting, referral URL, pages visited, date and time of access, duration of visit, clickstream data, and other diagnostic and analytics data.

(d) Cookies and Tracking Data: Information collected through cookies, pixel tags, web beacons, and similar technologies (see Section 10 below).

(e) Event and Subscription Data: Information provided when registering for seminars, webinars, conferences, or when subscribing to our newsletters, alerts, or publications.

(f) Professional and Transactional Data: Information relating to professional engagement, including matters under discussion, fee-related data, and billing information (collected only within the context of a formal client engagement).

4.2 Special Categories of Data

SD Partners does not ordinarily collect SPDI as defined under Rule 3 of the SPDI Rules through this Website. In the event that SPDI is required in the context of a professional engagement, such data shall be collected with your explicit, informed consent and processed in accordance with the SPDI Rules and the DPDPA, including the provisions relating to purpose limitation and data minimisation.

4.3 Children’s Data

SD Partners does not knowingly collect personal data from children (individuals below the age of 18 years). In accordance with Section 9 of the DPDPA, before processing any personal data of a child, we shall obtain verifiable consent from the parent or lawful guardian of such child in the prescribed manner. We shall not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If we become aware that we have inadvertently collected personal data of a child without verifiable parental consent, we shall take immediate steps to erase such data.

5. LEGAL BASIS AND PURPOSE OF PROCESSING

5.1 Lawful Basis

We process your personal data on one or more of the following lawful bases under the DPDPA and applicable Indian law:

(a) Consent (Section 6, DPDPA): Where you have given clear, specific, informed, and unambiguous consent for processing your personal data for one or more specified purposes.

(b) Legitimate Uses (Section 7, DPDPA): Where processing is necessary for certain legitimate uses as prescribed under the DPDPA, including:

•(i) Processing for the purposes specified by the Data Principal voluntarily;

•(ii) Processing by the State or any instrumentality thereof for subsidies, benefits, services, certificates, licences, or permits;

•(iii) Processing for compliance with any judgment or order issued under Indian law;

•(iv) Processing for responding to a medical emergency involving a threat to life or health;

•(v) Processing for employment-related purposes; and

•(vi) Processing in the public interest, including prevention and detection of fraud.

(c) Contractual Necessity: Where processing is necessary for the performance of a contract to which you are a party (e.g., a letter of engagement for legal services).

(d) Legal Obligation: Where processing is necessary for compliance with a legal obligation to which SD Partners is subject under applicable Indian laws.

5.2 Purposes of Processing

We process your personal data for the following purposes:

(a) To respond to your inquiries, requests, and communications;

(b) To provide legal services pursuant to a formal engagement;

(c) To send newsletters, legal updates, publications, event invitations, and other communications (with your consent, where required);

(d) To administer and improve the Website, including personalisation, analytics, and diagnostics;

(e) To comply with legal and regulatory obligations, including those under the Advocates Act, 1961, the Bar Council of India Rules, anti-money laundering laws, and taxation laws;

(f) To protect our legitimate interests, including fraud prevention, security, and enforcement of our legal rights;

(g) To maintain internal records and administrative functions; and

(h) For any other purpose with your specific consent.

6. DATA RETENTION

6.1 Retention Principles

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. In determining the appropriate retention period, we consider the nature and sensitivity of the personal data, the purposes of processing, applicable legal and regulatory requirements (including limitation periods), and our legitimate business interests.

6.2 Retention Periods

(a) Contact and Communication Data: Retained for a period of 3 (three) years from the date of last interaction, or such longer period as may be required for the purpose of responding to ongoing inquiries or legal obligations.

(b) Client Engagement Data: Retained for a minimum period of 8 (eight) years from the date of conclusion of the relevant engagement, in accordance with the Limitation Act, 1963, applicable taxation laws, and professional obligations.

(c) Technical and Usage Data: Retained for a period of 2 (two) years from the date of collection, or as required for security and analytics purposes.

(d) Newsletter and Subscription Data: Retained until you withdraw your consent or unsubscribe from our communications.

6.3 Erasure

Upon expiry of the applicable retention period, or upon receipt of a valid erasure request (subject to legal exemptions), personal data shall be securely erased or anonymised in accordance with Section 8(7) of the DPDPA, which requires that personal data no longer needed for its specified purpose and not subject to a legal retention requirement must be erased.