Lex Dux LLP

Privacy Policy

Last updated: 7 October 2026

This Privacy Policy explains how Lex-Dux LLP collects, uses, shares and protects personal data through the website lexdux.com (the “Website”), and the choices and rights available to you. Please read it before you submit any information to us.

1. Who we are

Lex-Dux LLP (“Lex Dux”, “we”, “us” or “our”) is a limited liability partnership incorporated in India under the Limited Liability Partnership Act, 2008 (LLPIN: ACS-2893), with its registered office at B-096, Sector 37, Tugalpur, Greater Noida, Gautam Buddha Nagar, Uttar Pradesh 201310, India. Lex Dux is responsible for the personal data described in this Policy and is the Data Fiduciary for the purposes of the Digital Personal Data Protection Act, 2023.

2. Legal framework

We publish this Policy in accordance with section 43A of the Information Technology Act, 2000 and Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”). It is also intended to serve as the notice required under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025, whose principal obligations take effect on 13 May 2027.

This Policy covers the Website only. Personal data we receive in the course of an engagement is governed by the terms of that engagement and by our duty of confidentiality.

3. Personal data we collect and why

3.1 When you send us an enquiry

Through the contact form on the Website, or by email, telephone or WhatsApp, we collect:

  • your name and email address;
  • your telephone number and company name, if you choose to give them;
  • the service area you select and the content of your message, which may include details of vessels, cargo, incidents or other persons involved in your matter; and
  • when you use the contact form, your IP address, browser type, and the date and time of submission.

We use this information to:

  • reply to your enquiry and discuss your matter;
  • check for conflicts of interest before any substantive discussion;
  • prepare a scope of work and fee proposal where you ask for one;
  • keep a record of the enquiry; and
  • protect the form from spam and abuse. For this purpose we count the submissions made from each IP address over a rolling one-hour period.

3.2 When you use the CII Calculator

The CII Calculator runs in your browser. The vessel figures you enter are not sent to us unless you ask for the PDF report. When you request the report, we collect:

  • your name and email address;
  • your company and vessel name, if you choose to give them;
  • the figures you entered and the results calculated, namely vessel type, capacity, fuel type and consumption, distance sailed, year, attained and required CII, and rating; and
  • your IP address and the date and time of the request.

We use this information to provide the report, to follow up with you about that report, to keep a record of requests and to prevent abuse. We will not add you to any mailing list or use the information for any other marketing.

3.3 When you browse the Website

  • Server logs. Our hosting provider records technical information about each visit, such as your IP address, browser type, the pages requested and the time of the request. These logs are used to operate and secure the Website.
  • Your cookie choice. When you click “Accept” or “Essential only” on the cookie banner, we store that choice in your browser’s local storage so that the banner is not shown again.
  • Analytics. Where we use Google Analytics, it is loaded only after you click “Accept”. If you choose “Essential only”, no analytics cookies are set.
  • Third-party resources. Pages on the Website load fonts from Google Fonts, and the CII Calculator loads a PDF library from cdnjs, a service operated by Cloudflare. When this happens your browser connects to those services, which receive your IP address and browser details.
  • WhatsApp. If you use the WhatsApp button, you leave the Website and WhatsApp processes your data under its own terms.

3.4 Information we do not seek

We do not seek sensitive personal data or information within the meaning of the SPDI Rules, such as passwords, bank account or payment card details, or health, medical or biometric information. Please do not send such information through the Website. If you need to share it in connection with a matter, we will agree a secure method with you.

4. Basis for processing

We process the personal data described in section 3 because you have given it to us voluntarily for the purposes stated, which is a legitimate use under section 7(a) of the DPDP Act, and with your consent for the purposes of the SPDI Rules. By submitting the contact form or requesting a CII report, you consent to our use of the information for those purposes. You may withdraw your consent at any time, as described in section 9. Withdrawal does not affect processing already carried out, and may mean that we cannot respond to your enquiry.

5. Who we share it with

We share personal data only:

  • with our partners and authorised personnel who need it to deal with your enquiry;
  • with service providers who process it on our behalf under contract, including our website hosting provider, Hostinger, and our email service provider;
  • with counsel, surveyors, experts or other professionals involved in your matter, but only with your consent or on your instructions; and
  • where required by law, by order of a court, or by a competent authority.

We do not sell personal data, and we do not use it for advertising or profiling.

6. Transfers outside India

Some of our service providers, such as Google and Cloudflare, may process data outside India. Any such transfer is made only as permitted under Indian law, including section 16 of the DPDP Act once it is in force.

7. How long we keep it

  • Enquiries and CII report requests that do not lead to an engagement: up to 24 months from our last communication with you, after which they are deleted.
  • Where an engagement follows: for the duration of the engagement and afterwards for as long as required for legal, regulatory, accounting and limitation purposes.
  • Spam-protection counters: one hour.
  • Server logs: for the period kept by our hosting provider, and for not less than one year where the law requires.
  • Your cookie choice: until you clear your browser storage.

Where the law requires us to keep data for longer, we keep it only for that purpose.

8. Security

We maintain reasonable security practices and procedures to protect personal data. These include encryption of data in transit to and from the Website (HTTPS), restricting access to enquiries to authorised partners through password-protected accounts, spam and abuse protections on our forms, and keeping the Website software up to date. No system is entirely secure. If a personal data breach occurs, we will notify affected persons and the relevant authorities as required by law.

9. Your rights

You may at any time:

  • ask what personal data we hold about you and how we use it;
  • ask us to correct, complete or update it;
  • ask us to erase it, unless we are required by law to keep it;
  • withdraw your consent; and
  • raise a grievance with us under section 10.

When the relevant provisions of the DPDP Act come into force, you will also have the rights given by sections 11 to 14 of that Act, including the right to nominate another person to exercise your rights in the event of your death or incapacity.

To make a request, email contact@lexdux.com with the subject line “Personal data request”. We may ask you to verify your identity. We will respond within one month.

10. Grievance Officer

If you have a question or complaint about how we handle personal data, please contact our Grievance Officer:

Capt. Pramod Kumar Singh, Managing Partner
Lex-Dux LLP, B-096, Sector 37, Tugalpur, Greater Noida, Gautam Buddha Nagar, Uttar Pradesh 201310, India
Email: contact@lexdux.com
Telephone: +91 98714 19797

We will acknowledge your grievance promptly and resolve it within one month of receipt. If you are not satisfied with our response, you may, once the relevant provisions of the DPDP Act are in force and after first using this process, complain to the Data Protection Board of India.

11. Children

The Website is intended for businesses and professionals. It is not directed at persons under the age of 18, and we do not knowingly collect their personal data. If we learn that we have done so, we will delete it.

12. Other websites

The Website links to other websites and services, such as WhatsApp. We are not responsible for their privacy practices, and we encourage you to read their policies.

13. Changes to this Policy

We may update this Policy from time to time. The current version will always be published on this page with the date of its last update. Where a change materially affects how we use personal data you have already given us, we will take reasonable steps to inform you before the change applies.