1. About this policy
This policy explains how personal data is handled in the ARTIS Law House practice-management system (the "System"). It applies to everyone who signs in to the System and to the clients, parties and other people whose details are recorded in it.
2. Who is responsible
ARTIS Law House (the "Firm") owns and controls all data in the System and is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). Nuvena Systems Private Limited ("Nuvena") builds and maintains the System for the Firm and acts only as the Firm's Data Processor: it handles data solely on the Firm's instructions and for the purposes in this policy.
3. Our commitments
- Data in the System is used only to run the System for the Firm.
- Your data is never sold, rented, traded or shared for anyone else's purposes.
- It is not used for advertising, marketing, profiling, analytics products or to train artificial-intelligence models.
- The System contains no advertising or analytics trackers.
- Nuvena staff do not read client matters, documents or communications. Technical access to the servers is limited to keeping the System running, secure and backed up, or to support the Firm has asked for, and only to the extent needed.
- Client information is treated as confidential and privileged, consistent with an advocate's duties of confidentiality.
4. What the System holds
- Account details of Firm users: name, email address, mobile number, role, team and sign-in history.
- Work data entered by Firm users: matters, court cases, hearings, tasks, documents and drafts, notes, contacts and organisations, time, expenses, invoices and payments.
- Records about clients and other parties that the Firm needs for its legal work.
- Technical records created when the System is used: IP address, browser, pages requested and their times. These are used only for security, troubleshooting and capacity planning.
5. Why the data is used
- To provide legal services and run the Firm's practice: matters, hearings, deadlines, documents, billing.
- To sign users in, control who can see what, and keep an audit trail.
- To send sign-in codes and work notifications.
- To keep the System secure, prevent misuse and recover from failures.
- To meet the Firm's legal, professional and regulatory obligations.
The Firm processes client and party data for these purposes as permitted by the DPDP Act, including for legitimate uses such as compliance with law and the performance of legal services.
6. Where data is stored and how it is protected
- The System and its files are hosted on Amazon Web Services in Mumbai, India. Data is not deliberately transferred outside India; any provider that may process data elsewhere does so under its own safeguards.
- All connections use encrypted HTTPS.
- Stored documents and backups are encrypted.
- Access follows each user's role and organisation. Confidential matters need a one-time code, their protected text is encrypted, and every access to them is recorded.
- Passwords are stored only as secure hashes; sign-in codes expire within minutes and work once.
- Administrative actions are limited to the Firm's partners and authorised administrators.
7. Services that help run the System
The System relies on a small number of providers, only for the purposes listed:
- Amazon Web Services — hosting, file storage and backups (India).
- An email provider — to send sign-in codes and work notifications.
- Google — only if a user chooses to link their own Google Drive or Calendar.
- Microsoft Word — when a user chooses "Open in Word", the document opens in that user's own Word.
- Official court and registry websites — public case and trademark information is looked up there.
Some older parts of the System may load software libraries from public content networks; those networks receive your IP address and browser details with the request. Pages being redesigned load nothing from third parties.
8. Cookies and local storage
Only essential cookies are used: one keeps you signed in and one protects forms from forgery. The browser may also remember small display choices on your device. No advertising or tracking cookies are used, so there is nothing to opt out of.
9. How long data is kept
- Work data is kept for as long as the Firm uses the System, or for the period the Firm decides, including any period required by law or professional rules.
- Technical records are normally kept for no more than 30 days.
- Backups are kept for 7 days and then deleted automatically.
- When the Firm stops using the System, its data is returned to the Firm or deleted on the Firm's instruction.
10. Your rights
Subject to the DPDP Act and the Firm's legal and professional obligations, you may:
- ask what personal data about you is held and how it is used;
- ask for inaccurate or incomplete data to be corrected or completed;
- ask for data to be erased when it is no longer needed for its purpose or legally required;
- withdraw consent where processing relies on your consent;
- nominate another person to exercise these rights on your behalf;
- raise a grievance and, if it is not resolved, approach the Data Protection Board of India.
11. Data breaches
If a personal data breach occurs, the Firm will take steps to contain it and will inform affected people and the Data Protection Board of India as the law requires. Nuvena will tell the Firm without delay about any breach it becomes aware of.
12. Children
The System is for professional use by the Firm. It is not offered to children. Information about a minor is recorded only when the Firm's legal work requires it, with the safeguards the law requires.
13. Contact and grievances
For questions, requests or grievances about personal data, contact the Firm through your usual contact or via artislawhouse.com. The Firm's designated contact for data matters will respond within the time the law requires.
14. Changes to this policy
Any change to this policy will be published on this page with a new date.