Privacy Policy
Privacy Policy
Website: https://shahandassociates.in/
Last Updated: 7 November 2026
1. Introduction
Shah & Associates respects the privacy of visitors accessing its website and recognises the importance of protecting personal information submitted through its online communication channels.
This Privacy Policy explains how information may be collected, used, stored, disclosed and protected when visitors access shahandassociates.in or submit information through its website forms and published contact channels.
This policy applies to information handled through the Website. Separate terms, engagement arrangements and professional confidentiality obligations may apply to information received during an accepted professional engagement.
2. Website Operator and Privacy Contact
Website: https://shahandassociates.in/
Website Operator: Shah & Associates
General Privacy Contact:
Email: adv.bhimshah@gmail.com
Telephone: 8010355090
For privacy-related requests and grievances, please use the designated contact details set out in Section 14 below.
3. Information We May Collect
The information collected depends on how visitors interact with the Website.
A. Information voluntarily provided by visitors
When visitors use a contact form or another published communication channel, the following information may be provided:
-
Full name.
-
Telephone or mobile number.
-
Email address.
-
Preferred contact method.
-
Selected area of practice or enquiry category.
-
General description of the matter or enquiry.
-
Other information voluntarily included in the communication.
Visitors are encouraged to provide only the information reasonably necessary for the stated enquiry.
B. Technical and website information
When visitors access the Website, certain technical information may be recorded automatically through the hosting service, WordPress installation, security tools or other enabled website technologies.
Depending on the tools installed, this may include:
-
Internet Protocol (IP) address.
-
Browser and device information.
-
Operating system.
-
Website pages accessed.
-
Date and time of access.
-
Referring webpage.
-
Security and server log information.
-
Cookie and similar technology information.
The precise technical information collected depends on the Website’s actual configuration.
C. Sensitive personal information
Visitors should not submit passwords, bank-account credentials, card information, medical records, biometric information, detailed financial records or other sensitive personal information through general website enquiry forms.
In particular, legal and tax matters may involve confidential documents and sensitive information that require appropriate handling and access controls.
Where sensitive personal data or information is collected, it must be handled in accordance with applicable legal requirements, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, where applicable.
4. Purposes for Which Information May Be Used
Information submitted through the Website may be used for the following purposes:
-
To receive and understand general website enquiries.
-
To respond to information requests submitted voluntarily by visitors.
-
To communicate concerning the specific enquiry received.
-
To maintain and administer the Website.
-
To monitor website functionality and troubleshoot technical problems.
-
To protect the Website against unauthorised access, malicious activity and misuse.
-
To maintain necessary administrative and communication records.
-
To comply with applicable legal, regulatory or professional obligations.
Information should not be used for an unrelated purpose without an appropriate legal basis or permission where required.
5. Collection and Consent
Information is collected only for purposes connected with the operation of the Website and its communication functions.
Where sensitive personal data or information is collected and the SPDI Rules apply, the applicable requirements concerning lawful purpose, necessity and consent will be followed.
Visitors should be informed about:
-
The information requested.
-
The purpose of collection.
-
The intended recipients, where applicable.
-
The identity and contact particulars of the collecting organisation.
-
Any relevant consequences of not providing information.
Where written or electronic consent is required under applicable law, it must be obtained before the relevant sensitive information is collected.
Visitors may choose not to provide optional information. Where the information is necessary for a particular request, the absence of that information may prevent the Website operator from addressing the request.
6. Cookies and Similar Technologies
The Website may use cookies, server logs or similar technologies to support website functionality, security, visitor preferences and, where enabled, website analytics.
Depending on the technologies installed, cookies may be used for:
-
Basic website operation.
-
Security and protection against unauthorised activity.
-
Remembering visitor preferences.
-
Website performance measurement.
-
Analytics and usage reporting.
-
Third-party embedded services.
The actual cookies and providers used depend on the WordPress theme, plugins and external services installed on the Website.
Visitors may manage cookies through available browser settings. Where consent is required for a particular non-essential technology, the applicable consent mechanism should be provided before that technology is activated.
A separate cookie notice or cookie-preference mechanism may be provided where appropriate.
7. Sharing and Disclosure of Information
Shah & Associates does not intend to disclose personal information indiscriminately.
Information may be shared only where reasonably required for the relevant purpose and permitted under applicable law.
This may include:
A. Website and technical service providers
Limited information may be made available to authorised service providers that support the Website, such as:
-
Website hosting providers.
-
Website maintenance and technical-support providers.
-
Email and communication service providers.
-
Website security and backup providers.
-
Form-processing and spam-prevention services.
-
Analytics, mapping or embedded communication providers, where used.
Such access should be limited to what is necessary for the relevant service.
B. Authorised professional personnel
Where relevant to an enquiry or accepted professional matter, information may be shared with the appropriately authorised professional associated with the relevant legal or taxation matter.
Access should be restricted to persons who require the information for the relevant purpose and are subject to applicable professional confidentiality obligations.
C. Legal and regulatory requirements
Information may be disclosed where required by law, a valid court order, a competent authority or another applicable statutory requirement.
Where sensitive personal data or information is involved, the applicable disclosure conditions under the SPDI Rules will be followed.
D. No unrelated disclosure
Information should not be published or disclosed for unrelated promotional purposes.
Where prior permission or consent is required by applicable law for disclosure, that permission or consent must be obtained.
8. Storage, Retention and International Transfers
Information may be stored using the Website’s hosting infrastructure, business email systems, security tools, backups and other authorised systems.
Personal information should be retained only for as long as reasonably required for the purpose for which it was collected or as required by applicable law and professional record-keeping obligations.
Sensitive personal data or information should not be retained longer than necessary for its lawful purpose, subject to other legal retention requirements.
If information is transferred to another service provider or stored outside India, the applicable conditions governing such transfers must be followed.
Where the SPDI Rules apply, transfers of sensitive personal data or information are subject to the prescribed requirements, including equivalent data-protection standards and the permitted necessity or consent conditions.
The actual hosting location and any international service providers should be confirmed and reflected in this policy before publication.
9. Security of Personal Information
Reasonable administrative, technical and organisational safeguards should be maintained to protect personal information against:
-
Unauthorised access.
-
Unauthorised disclosure.
-
Accidental loss or destruction.
-
Improper modification.
-
Misuse or other security risks.
Security measures should be proportionate to the nature of the information and the risks involved.
These measures may include access restrictions, authentication controls, software updates, security monitoring, protected data transmission and appropriate backup arrangements.
No method of electronic transmission or storage can be guaranteed to be completely secure.
Visitors should avoid sending highly sensitive or confidential legal and financial information through unsecured general website forms.
10. Accuracy, Review and Correction of Information
Where visitors have provided personal information, they may request that the information be reviewed and that inaccurate or incomplete information be corrected, subject to applicable law and technical feasibility.
The SPDI Rules, where applicable, provide for review and correction of personal information supplied by the individual.
Requests may be made through the privacy contact details published below.
11. Withdrawal of Consent and Deletion Requests
Where consent has been provided for the collection or processing of sensitive personal data or information under the applicable SPDI requirements, visitors may submit a written request to withdraw that consent.
A request for deletion or removal of information will be considered in accordance with applicable law, the original purpose of collection and relevant professional or legal retention obligations.
Information that must be retained for an ongoing professional engagement, statutory requirement, court proceeding or other lawful obligation may not be eligible for immediate deletion.
12. Children’s Information
This Website is not specifically designed for children.
Persons below the age of 18 should not independently submit personal information through the Website unless the submission is made with appropriate parental or guardian involvement and in accordance with applicable legal requirements.
Where information relating to a child is received inadvertently, the Website operator should assess the circumstances and take appropriate steps in accordance with applicable law.
The requirements of the Digital Personal Data Protection Act, 2023 relating to children’s personal data will be implemented as the relevant provisions come into force.
13. Third-Party Websites and Embedded Services
The Website may contain links to or integrations with third-party platforms, which may include Google Maps, WhatsApp, external government portals, social-media platforms and other services.
When visitors use these services or follow external links, their information may be processed under the respective third party’s terms and privacy policy.
Shah & Associates does not control the independent privacy practices of external websites or services.
Visitors should review the relevant provider’s privacy terms before interacting with an external service.
14. Privacy Grievance Officer
For privacy-related complaints, discrepancies, requests for correction or other grievances concerning information processed through the Website, visitors may contact the designated Grievance Officer.
Name: Mr. Bheem Shah
Designation: Privacy & Grievance Officer
Email: adv.bhimshah@gmail.com
Grievances will be addressed expeditiously and within the applicable statutory period. Where Rule 5(9) of the SPDI Rules applies, the grievance must be redressed within one month of receipt.
15. Future Updates Under the Digital Personal Data Protection Act, 2023
India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are subject to phased commencement.
This Privacy Policy will be reviewed and updated to reflect the commencement of the applicable obligations and rights under that framework.
The relevant rights, procedures and safeguards will be applied in accordance with the provisions and rules that are legally in force at the relevant time.
16. Changes to This Privacy Policy
This Privacy Policy may be revised to reflect changes in website functionality, information collected, third-party service providers, legal requirements or data-protection practices.
Any revised version will be published on this page along with its updated date.
Visitors are encouraged to review this page periodically.
17. Contact Information
For general questions about this Privacy Policy or the handling of information through the Website:
Shah & Associates
Email: adv.bhimshah@gmail.com
Telephone: 8010355090
Office Address: G/F-70, Shyam Nagar, Okhla Phase-III, near Govindpuri Metro Station, New Delhi 110019
