Privacy Policy
1. About this Policy
1.1 This Privacy Policy explains what personal data is collected when you visit https://www.aop.onl (the "Website"), subscribe to the Changelaw newsletter, or write to us, and what is done with it. The Website is a personal, non-commercial website of legal scholarship written by Prof. Feroz Ali. The website is maintained and published by LexCampus ("we", "us" or "our"), who is the Data Fiduciary for this data within the meaning of the Digital Personal Data Protection Act, 2023 (the "DPDP Act").
1.2 This Policy is written to meet the requirements of the DPDP Act and the Digital Personal Data Protection Rules, 2025. Until those obligations come into force on 13 May 2027, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 continue to apply.
1.3 The Website sells nothing and takes no payment, and it collects very little personal data. You can read every page without giving us any information about yourself.
2. What we collect
| When | Personal data | Why |
|---|---|---|
| You visit the Website | Your IP address, browser type and the page requested, recorded in the server logs of our hosting provider | To deliver the page and protect the Website against abuse |
| You search the Website | Nothing. Search runs in your own browser, and your search terms are not sent to us | — |
| You subscribe to Changelaw | Your email address, the date, time and IP address of your subscription and of your confirmation, and your subscription status | To send you Changelaw, and to keep a record that you consented to receive it |
| You write to us | Your name, email address and the content of your message | To reply to you and, where you report an error, to correct the page |
We do not use advertising cookies, analytics cookies or tracking pixels. Changelaw contains no open-tracking or click-tracking. Our hosting provider may set a cookie that is strictly necessary to protect the Website against automated attacks. It is not used to identify you or to follow you across other websites.
3. The basis on which we process your data
3.1 Changelaw. We send Changelaw only with your consent, given by entering your email address and confirming it from the email we send you ("double opt-in"). Consent to Changelaw is not required to use the Website.
3.2 Correspondence and server logs. Where you write to us, we use your details to reply, as you intended when you wrote. Server logs are kept for the security of the Website and because the law requires records of processing to be kept.
4. Withdrawing consent
You may withdraw your consent to Changelaw at any time with one click, using the unsubscribe link in every issue or the unsubscribe control in your email program. After you unsubscribe, we keep only your email address and the record of your subscription and withdrawal, so that we can prove your consent was obtained and make sure you are not sent Changelaw again. If you ask us to delete that record as well, we will do so.
5. Who handles your data
5.1 We do not sell, rent or share your personal data with anyone for their own purposes, and the Website carries no advertising.
5.2 The Website and Changelaw run on infrastructure provided by the following companies, which handle personal data only to provide that infrastructure:
(a) Cloudflare, Inc., which hosts the Website and protects it against attacks;
(b) PikaPods, which hosts the software (Listmonk) that holds the Changelaw subscriber list, on servers located in Europe; and
(c) Amazon Web Services, whose Simple Email Service delivers Changelaw from its Asia Pacific (Mumbai) region. It passes each email to its recipient and does not keep the subscriber list.
5.3 We disclose personal data to a court, regulator or other authority where the law requires it.
6. Transfers outside India
Some of the infrastructure described in section 5.2 may store or process data outside India. We do not transfer personal data to any country or territory to which the Central Government has restricted transfers under the DPDP Act.
7. How long we keep your data
| Data | How long |
|---|---|
| Changelaw subscription | Until you unsubscribe. After that, the record of your consent and withdrawal is kept as described in section 4 |
| Correspondence | Two years from the last message, unless it concerns a correction, in which case it is kept with the record of that correction |
| Server logs and records of processing | At least one year, as the Digital Personal Data Protection Rules, 2025 require, and then deleted |
8. Security and breaches
8.1 We protect personal data with reasonable security safeguards, including encrypted connections, access limited to the Author and the Website's technical administrators, and two-factor authentication on the accounts that hold it.
8.2 If a personal data breach occurs, we will inform each affected person without delay, and report the breach to the Data Protection Board of India within the time the law requires.
9. Your rights
9.1 You have the right to a summary of the personal data we hold about you, to have it corrected, completed, updated or erased, to withdraw your consent, to have your grievances redressed, and to nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
9.2 To exercise them, write to contract@lexcampus.org. We will respond within thirty days, and in any event within ninety days.
9.3 If you are not satisfied with our response, you may complain to the Data Protection Board of India.
9.4 If you are in the European Economic Area or the United Kingdom, you also have the rights given by the General Data Protection Regulation or the UK General Data Protection Regulation, including the right to complain to your local data protection authority. If you are in the Kingdom of Saudi Arabia, you have the rights given by the Personal Data Protection Law.
10. Children
Changelaw is intended for persons aged eighteen and over, and we do not knowingly collect personal data from children.
11. Changes to this Policy
We may revise this Policy by publishing a new version on the Website with a new effective date. If a change materially affects how we use your email address, we will tell Changelaw subscribers in the next issue.
12. Governing law
This Policy is governed by the laws of India. Disputes are resolved as clause 11 of the aop.onl Terms of Use provides, without prejudice to your right to approach the Data Protection Board of India.