Privacy Policy

1. Data Fiduciary Information

This platform is operated by LLM Advocates ("we", "us", "our"), acting as the Data Fiduciary under Section 2(i) of the Digital Personal Data Protection Act, 2023 ("DPDP Act").

Entity Name	LLM Advocates
Platform	LLMASSURE (Consent Management Platform)
DPO Contact	dpo@llmadvocates.com
Grievance Officer	Grievance Portal

Important Clarification: LLMASSURE is a Consent Management Platform (CMP). We are NOT a registered "Consent Manager" under Section 6(7)–(9) of the DPDP Act. We do not require registration with the Data Protection Board of India (DPBI). Compliance responsibility remains with the Data Fiduciary (our clients).

2. Personal Data We Collect

Under Section 5 of the DPDP Act, we provide this notice detailing the personal data we collect and process:

2.1 Data Collected Directly From You

• Account Information: Name, email address, phone number, company name, designation
• Service Application Data: Business registration details, industry sector, compliance documents submitted
• Communication Data: Messages exchanged through our portal chat system, support inquiries
• Payment Information: Billing address, GST number (payment processing handled by third-party gateway)

2.2 Data Collected Automatically

• Usage Data: Pages visited, features used, self-assessment responses (if consented)
• Device Data: IP address, browser type, operating system, screen resolution
• Cookie Data: As detailed in our Cookie Policy

2.3 Data We Process on Behalf of Clients (CMP Subscribers)

When our clients use the LLMASSURE CMP, we process personal data of their Data Principals (end users) as a Data Processor under Section 8 of the DPDP Act. This includes consent records, notice delivery records, and withdrawal records. Our clients (Data Fiduciaries) are responsible for ensuring lawful processing.

3. Purposes of Processing

We process your personal data for the following purposes (Section 5(1)(i) of the DPDP Act):

Purpose	Legal Basis
Service delivery (audit, CMP, DPO advisory)	Consent (Section 6) / Contract performance
Account management and authentication	Consent (Section 6)
Compliance report generation	Consent (Section 6) / Legitimate use
Analytics and platform improvement	Consent (Section 6) — withdrawable
Marketing communications	Consent (Section 6) — withdrawable
Legal and regulatory compliance	Legal obligation (Section 7)

4. Your Rights as a Data Principal

Under the DPDP Act 2023, you have the following rights:

• Right to Access (Section 11): Request a summary of your personal data and processing activities
• Right to Correction and Erasure (Section 12): Request correction of inaccurate data or erasure of your personal data
• Right to Withdraw Consent (Section 6(4)): Withdraw consent at any time. Withdrawal is as easy as giving consent — one-click via your portal dashboard
• Right to Grievance Redressal (Section 13): File a grievance with our Grievance Officer. We will respond within 90 days
• Right to Nominate (Section 14): Nominate a person to exercise your rights in case of death or incapacity
• Right to Complaint (Section 15): If unsatisfied with our response, you may file a complaint with the Data Protection Board of India

To exercise any of these rights, contact us at dpo@llmadvocates.com or through the Grievance Portal.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law (e.g., RBI KYC mandates, PMLA requirements). When the purpose is served or consent is withdrawn, your data will be erased within a reasonable period, subject to:

• 48-hour pre-erasure notice (Rule 8(2))
• Legal obligation overrides where applicable (documented and communicated to you)
• Audit log retention: minimum 1 year (Rule 8(3))

6. Data Security

We implement reasonable security safeguards as required by Section 8(4) and Rule 6:

• AES-256-GCM encryption at rest for all PII fields
• TLS 1.2+ encryption in transit (HSTS enforced)
• Multi-factor authentication (TOTP) for admin and DPO roles
• Role-based access control (10 roles) with principle of least privilege
• Immutable audit log of all administrative actions
• Daily encrypted backups within India

7. Cross-Border Data Transfers

All personal data is stored and processed within India on servers located at Indian data centres (MilesWeb, India). We do not transfer personal data outside India unless:

• The destination country is not in the Central Government's restricted list (Section 16(1))
• Adequate safeguards are in place and documented

8. Children's Data

We do not knowingly collect personal data from children (persons under 18 years) without verifiable parental consent as required by Section 9 of the DPDP Act. If our clients process children's data through the CMP, they are responsible for obtaining verifiable parental consent.

9. Breach Notification

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India as required by Section 8(6) and Rule 7
• Notify affected Data Principals as required by Rule 7
• Document the breach, its consequences, and mitigation measures taken

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice on our platform. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact Us

Data Protection Officer	dpo@llmadvocates.com
Grievance Portal	llmassure.com/grievance
Data Protection Board	As notified by the Central Government under Section 18 of the DPDP Act