Privacy Notice

1. Who we are

Pratik K Shah ("we", "us") is a firm of Practising Company Secretaries. We decide why and how personal data is processed in this application and are the "data fiduciary" for that data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). The software is provided and hosted for us by CorProDoc, which processes data only on our instructions.

2. Personal data we collect

• Staff: name, email, phone, role, login and activity records.
• Clients and their people: names, PAN, DIN, Aadhaar-linked details where supplied, addresses, email and phone, shareholding and directorship details, and documents you share with us.
• Financial records: invoices, receipts, expenses, bank statements and transactions that we import to prepare accounts and reconcile fees.
• Technical data: IP address, device and browser information, and notification (push) subscription details.

3. Why we use it

• To provide company secretarial, compliance, filing, accounting and advisory services you have engaged us for.
• To meet legal obligations under the Companies Act, 2013, other applicable laws and professional standards.
• To raise invoices, collect fees and keep accounting records.
• To send reminders, alerts and service communications.
• To keep the system secure and prevent misuse.

4. Legal basis

We process personal data on the basis of your consent, your engagement with us, and, where permitted by the DPDP Act, for legitimate uses such as compliance with law. You may withdraw consent at any time (see section 8); withdrawal does not affect processing already done, and we may need to retain records the law requires us to keep.

5. Who we share it with

We do not sell personal data. We share it only with:

• Government portals and authorities (for example MCA, GSTN, Income-tax) when we file on your behalf.
• Our service providers who host and run this application: Supabase (database, authentication and file storage), Vercel (application hosting) and our email/notification providers. They are bound by their own security and confidentiality terms.
• Professional advisers and auditors, where needed, under duties of confidentiality.
• Anyone else only where required by law or with your consent.

6. Where data is stored

Data is stored with the cloud providers above. This may include servers outside India. Transfers are made only to places not restricted by the Government of India under the DPDP Act.

7. How long we keep it

We keep data for as long as the engagement continues and thereafter for the period required by law or professional practice (for example statutory registers and accounting records). After that it is erased or anonymised.

8. Your rights

Subject to the DPDP Act you may ask us to:

• give you a summary of the personal data we hold and how it is used;
• correct, complete or update it;
• erase it, where we no longer need it for a lawful purpose;
• withdraw your consent;
• nominate another person to exercise these rights if you die or become incapacitated.

Write to our Grievance Officer below. We aim to respond within the time the law allows (currently not more than 90 days). If you are not satisfied you may complain to the Data Protection Board of India.

9. Security

We use access controls, role-based permissions, encrypted connections and audit logs. No system is perfectly secure; if a breach affecting your personal data occurs we will inform you and the Data Protection Board as the law requires.

10. Children

We do not knowingly process the personal data of children except where it forms part of a client's statutory records (for example a minor shareholder) and then only as lawfully required.

11. Changes

We may update this notice. When we do, the version changes and portal users are asked to review it again.

12. Grievance Officer

• Please contact Pratik K Shah through the details on our website.