Privacy Policy
Last updated: March 2026
This Privacy Policy is prepared in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and other applicable Indian laws. It describes how Gajanand Gupta & Co. ("we", "us", "our", or "Data Fiduciary") collects, processes, stores, and protects your personal data.
1. Identity of Data Fiduciary
Gajanand Gupta & Co.
Chartered Accountants
31, Indraprastha Colony, Ram Nagar
Hawa Sadak, Sodala, Jaipur, Rajasthan
WhatsApp: +91 92511 11676
Under the DPDP Act, 2023, we act as the Data Fiduciary — the entity that determines the purpose and means of processing your personal data.
2. Personal Data We Collect
We collect personal data only to the extent necessary for providing our chartered accountancy services ("purpose limitation"). The categories of data we may collect include:
Category Examples Purpose
Identity Information Name, PAN, Aadhaar, date of birth Tax filing, KYC compliance
Contact Information Phone number, email, address Communication, service delivery
Financial Information Income details, bank statements, investment records ITR filing, accounting, audit
Tax Documents Form 16, TDS certificates, GST records Tax compliance services
Communication Data WhatsApp messages, emails Service communication, record keeping
3. Lawful Basis for Processing (DPDP Act Compliance)
Under the DPDP Act, 2023, we process your personal data on the following lawful bases:
Consent: Where you have provided explicit consent for us to process your data, such as WhatsApp communication. You may withdraw consent at any time by contacting us.
Legitimate Use: Processing necessary for providing services you have engaged us for, including tax filing, accounting, and compliance services.
Legal Obligation: Processing required to comply with applicable laws including the Income Tax Act, GST laws, Companies Act, and other regulatory requirements.
4. Notice to Data Principals
In accordance with Section 5 of the DPDP Act, 2023, we provide the following notice:
Before or at the time of collecting your personal data, we will inform you of the personal data being collected and the purpose of processing, the manner in which you may exercise your rights under the DPDP Act, and the manner in which you may make a complaint to the Data Protection Board of India.
5. WhatsApp Communication
We use WhatsApp Business API to communicate with our clients. When you provide your WhatsApp number or contact us via WhatsApp, you consent to receiving service-related messages including ITR filing confirmations, document requests, acknowledgements, and important service updates.
We process WhatsApp communication data solely for delivering our chartered accountancy services. We do not send unsolicited marketing messages. You may opt out of WhatsApp communications at any time by informing us in writing.
6. Data Sharing and Disclosure
We do not sell, trade, or rent your personal data to third parties. We may share your data only in the following circumstances:
Government Authorities: With the Income Tax Department, GST authorities, Ministry of Corporate Affairs, and other regulatory bodies as mandated by law.
Service Providers (Data Processors): With technology service providers who assist us in delivering our services. These providers are bound by contractual obligations to maintain confidentiality and process data only as instructed by us.
Legal Requirements: When required by applicable law, court order, or legal process in India.
Cross-Border Transfer: We do not transfer your personal data outside India except as may be permitted under the DPDP Act and applicable government notifications.
7. Your Rights as Data Principal (DPDP Act, 2023)
Under the Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:
Right to Access (Section 11): You have the right to obtain a summary of your personal data being processed and the processing activities undertaken.
Right to Correction and Erasure (Section 12): You have the right to correct inaccurate or misleading personal data and to erase personal data that is no longer necessary for the purpose it was collected.
Right to Grievance Redressal (Section 13): You have the right to have your grievances addressed within a reasonable time period.
Right to Nominate (Section 14): You have the right to nominate another individual to exercise your rights in the event of your death or incapacity.
Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
To exercise any of the above rights, please contact our Grievance Officer using the details provided below. We will respond to your request within a reasonable time as prescribed under the DPDP Act.
8. Grievance Redressal
You can contact us to address your data protection concerns at below details:
Gajanand Gupta & Co.
Chartered Accountants
31, Indraprastha Colony, Ram Nagar
Hawa Sadak, Sodala, Jaipur, Rajasthan-302019
WhatsApp: +91 92511 11676
Response Time: Within 30 days of receiving your grievance
If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is established under the DPDP Act, 2023.
9. Data Retention
We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected or as required by applicable law. Tax-related documents are retained for a minimum of 8 years as required under the Income Tax Act, 1961. GST records are retained for a minimum of 6 years as required under GST laws. After the retention period expires, personal data is securely deleted or anonymised. In accordance with the DPDP Act, 2023, we will delete your personal data upon withdrawal of consent or when it is no longer necessary for the specified purpose, unless retention is required by law.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include secure storage of documents, restricted access to personal data, and confidentiality obligations on all staff. In the event of a personal data breach, we will take prompt action and notify affected Data Principals as required under the DPDP Act.
11. Children's Data
In accordance with Section 9 of the DPDP Act, 2023, we do not knowingly collect personal data of children (persons under 18 years of age) without verifiable parental consent. If we become aware that we have inadvertently collected data of a child without appropriate consent, we will delete such data promptly.
12. Cookies
Our website may use cookies to improve your browsing experience. You can choose to disable cookies through your browser settings. This will not affect your ability to use our services.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws including the DPDP Act, 2023 and rules made thereunder. Any significant changes will be communicated to you. The updated policy will be posted on this page with a revised date.
14. Governing Law and Jurisdiction
This Privacy Policy is governed by the laws of India including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and applicable rules and regulations. Any disputes arising from this policy shall be subject to the jurisdiction of courts in India.
15. Contact Us
Gajanand Gupta & Co.
Chartered Accountants
31, Indraprastha Colony, Ram Nagar
Hawa Sadak, Sodala, Jaipur, Rajasthan-302019
WhatsApp: +91 92511 11676
For any privacy-related queries, requests to exercise your rights under the DPDP Act, or grievances, please contact us via WhatsApp or visit our office. We are committed to addressing your concerns promptly and transparently.