Privacy Policy

Legal Space Services handles documents that people care about — marriage papers, identity documents, affidavits, agreements. We treat that information the way we would want ours treated. This policy sets out exactly what we do with it, in plain language.

1. Who we are and what this policy covers

Legal Space Services, established on 6 June 2021 at New Delhi, India, is the Data Fiduciary for the personal data described in this policy. That means we decide why and how your personal data is processed, and we are answerable for it.

This policy covers this website and every service you order through it, by phone, by WhatsApp or at our office. It does not cover any other website you reach through a link from here.

2. The law we follow

• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 made under it;
• the Information Technology Act, 2000, in particular Section 43A, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, under which this policy is published; and
• the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020.

3. What personal data we collect

We collect only what a particular piece of work actually needs. Nothing on this website requires you to give us data that the work does not need.

4. Why we process your personal data

We do not use your personal data for behavioural profiling, and we do not use it to build advertising audiences.

5. Consent, and how to withdraw it

Where we rely on your consent, that consent is free, specific, informed, unconditional and unambiguous, and is given by a clear affirmative action — filling in and submitting a form, ticking a box, or telling us in writing to go ahead.

You may withdraw your consent at any time by writing to info@legalspaceservices.in. Withdrawing is as easy as giving it. When you withdraw, we stop processing your data for the purpose you withdrew, and we erase it unless a law requires us to keep it.

6. Who we share your data with

We do not sell, rent, trade or licence personal data. We share it only in these situations, and only to the extent needed:

• The advocate or professional handling your matter — the particulars they need to advise you or to act for you. They are independent and are separately responsible for the data we pass them.
• Government offices, courts and registries — where the application you have asked us to make has to be filed, in the form that office prescribes.
• Service providers who work for us — our website hosting provider, our email provider and our payment gateway. They may process data only on our instructions, only for our purposes, and are bound to keep it confidential and secure.
• Where the law requires it — in response to a lawful order or notice from a court, a Bar Council, a police or tax authority, or any other authority empowered by law.
• To establish or defend a legal claim, where it is necessary to do so.

We do not transfer personal data outside India except where a service provider we use stores data outside India, and then only to a country not restricted by the Central Government.

7. How long we keep your data

When a retention period ends, or when you validly ask us to erase your data and no law requires us to keep it, we erase it and we ask any processor acting for us to do the same.

8. How we protect your data

• the website is served over HTTPS, so what passes between your device and our server is encrypted in transit;
• passwords are stored only as a one-way cryptographic hash — nobody at Legal Space Services, including the owner, can read your password;
• access to a matter file is limited to the staff member handling it and to the owner, and every login is recorded;
• the advocate area is a separate login realm — an advocate can see only their own clients and their own orders, and can never see another advocate's or a staff member's data;
• database access is restricted, and forms are protected against cross-site request forgery;
• original documents are returned to you, and we keep only what a process requires.

No system can be guaranteed to be completely secure. We do not claim any certification we do not hold. What we undertake is to use reasonable security practices proportionate to the data we hold, and to tell you promptly if something goes wrong.

9. Your rights over your personal data

Under the Digital Personal Data Protection Act, 2023 you have the following rights. There is no charge for exercising any of them.

To exercise a right, write to our Grievance Officer at the address at the bottom of this page, from the email address or phone number we have on file for you, telling us clearly what you want. We may ask you a question or two to be sure it is really you — that protects you as much as us. We respond within 90 days, and usually much sooner.

You have a corresponding duty not to impersonate anybody, not to suppress material information where the law requires it to be given, and not to file a false or frivolous complaint.

10. Children and persons with disability

This website and our services are meant for people aged 18 years or above. We do not knowingly collect personal data of a child except where a service you have engaged us for genuinely requires it — for example a birth certificate application, where the parent or lawful guardian gives verifiable consent and supplies the details.

We do not undertake behavioural monitoring of children and we do not direct any advertising at children. Where a person has a lawful guardian, we act on the verifiable consent of that guardian. If you believe a child's data has reached us without proper consent, tell us and we will erase it.

11. If there is a personal data breach

If a personal data breach occurs, we will inform each affected person and the Data Protection Board of India without delay, and will give the Board the detailed report the law requires within the prescribed period. What we tell you will include what happened, what data was involved, what we have done about it, and what you should do to protect yourself.

12. Cookies and website analytics

This website uses only the cookies it needs to work — chiefly a session cookie that keeps you logged in, and a security token that protects forms against cross-site request forgery — and, if enabled, a basic analytics cookie that tells us in aggregate which pages are read. We do not use advertising cookies and we do not sell any data to advertisers. Our Cookie Policy explains this in full, including how to switch cookies off.

13. Payments

Payments are handled by a payment provider regulated by the Reserve Bank of India. Card numbers, UPI PINs, net banking passwords, CVVs and OTPs are entered on that provider's page and are never seen by, transmitted to, or stored on, our systems. We receive only the amount, the date, the mode and a transaction reference so we can issue a receipt.

14. Staff and advocate logins

Staff members and listed advocates have their own logins to our internal system. For those users we additionally hold employment or listing records, login times, and a record of the work done through the system. This is used to run the business, to keep the system secure and to account for work; it is not shared outside the organisation except where the law requires. Staff and advocates have the same rights over their personal data as anybody else.

15. Changes to this policy

We may update this policy when the law changes or when we change how we work. The version in force is always the one on this page, with the date shown at the top. Where a change materially affects how we use data we already hold, we will tell you before it takes effect.

16. Grievance Officer and the Data Protection Board

If you have any concern about how your personal data has been handled, write to our Grievance Officer. We acknowledge within 24 hours and resolve within 15 days, as the IT Rules, 2021 require, and we answer a request to exercise a right under the Digital Personal Data Protection Act, 2023 within 90 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India. You must ordinarily approach us first, because the Board expects you to have exhausted the Data Fiduciary's own grievance process. Our full escalation ladder is set out on the Grievance Redressal page.

Other legal documents