1. Scope
This policy applies to visitors of our website, people who enquire or book a consultation, clients and the directors, partners and other persons whose data clients share with us, and job applicants. It does not cover government portals or third-party websites we link to — their own policies apply.
2. What we collect and why
We collect only what is needed for the purpose described. You can choose not to share data, but some services cannot be delivered without it.
| Personal data | Purpose |
|---|---|
| Identity details — name, date of birth, father's name, photograph, signature, PAN, Aadhaar (masked where the authority accepts it), passport / voter ID, DIN | Required by government forms for incorporation, GST, tax, DSC and other registrations you ask us to file |
| Contact details — mobile number, email, residential and business address | To respond to your enquiry, deliver the service, send OTP-linked filings and share updates |
| Business documents — rent agreements, utility bills, NOCs, MoA / AoA, partnership deeds, board resolutions, licences | Proof of registered office and constitution documents required by MCA, GSTN and other authorities |
| Financial information — Form 16, bank statements, invoices, books of account, capital gains statements, tax credit statements | To prepare returns, compute tax, reconcile GST and complete accounting or compliance work |
| Payment information — transaction ID, amount, payment status | To confirm payment, issue GST invoices and handle refunds. Card and bank credentials are collected directly by the payment gateway; we never see or store them |
| Technical data — pages visited, device and browser type, approximate location, a one-way hash of your IP address, cookies (see Cookie Policy) | Security, fraud and spam prevention, and — only with your consent — analytics and advertising measurement |
| Communications — call notes, emails, WhatsApp messages and feedback | Service quality, record of instructions, and resolving disputes |
| Job applicant data — résumé, experience, salary details and answers to screening questions | To assess applications for roles you apply for |
Aadhaar: we ask for Aadhaar only where a government form requires it, request a masked copy wherever the authority accepts one, and never use it for any other purpose. We do not perform Aadhaar authentication ourselves.
3. Legal basis for processing
- Consent (Section 6 of the DPDP Act) — given when you submit a form, accept our terms or opt in to cookies. You can withdraw it at any time.
- Legitimate uses (Section 7) — where you voluntarily give data for a specific service, to comply with law or court orders, and to respond to emergencies.
4. Who we share data with
We never sell personal data. We share it only as needed to deliver the service, with:
- Qualified professionals — Chartered Accountants, Company Secretaries, Cost Accountants and Advocates who work on your matter, bound by confidentiality and professional codes of conduct.
- Government portals and authorities — MCA, GSTN, Income Tax Department, TRACES, Udyam, DPIIT, EPFO/ESIC and others where your filing is made.
- Certifying Authorities — for issuing Digital Signature Certificates, including the video and identity verification they require.
- Payment gateway and banks — to process payments and refunds.
- Technology providers (Data Processors) — cloud hosting and database (Vercel, Supabase), email delivery (Resend), communication tools, and — only with your consent — analytics and advertising tools (Google Analytics / Ads, Meta, Microsoft Clarity).
- Authorities and courts — when required by law, or to protect our rights or prevent fraud.
Data Processors act on our instructions under written contracts. Some providers may store data outside India; we transfer data only to countries not restricted by the Government of India under Section 16 of the DPDP Act.
5. How long we keep data
| Data | Retention |
|---|---|
| Client engagement records, filings and supporting documents | For the engagement and 8 years after the end of the financial year in which it ends, to meet record-keeping and limitation periods under tax and company law |
| Enquiries that did not become clients | 24 months from our last interaction, then deleted |
| Job applications | 12 months from the application date, then deleted |
| Payment and invoice records | 8 years, as required by GST and income-tax law |
| Security logs and hashed IP addresses | Up to 12 months |
| Analytics and advertising cookies | As set by each provider, generally 13 months or less — see the Cookie Policy |
When the period ends, or once you withdraw consent and no law requires us to keep it, we delete or anonymise the data.
6. How we protect data
- Encryption in transit (HTTPS/TLS) and encryption at rest by our hosting providers.
- Documents and résumés are stored in private storage; staff open them through short-lived links and access is logged.
- Role-based access — team members see only the data their role needs, enforced at the database level.
- IP addresses are stored only as one-way hashes. Card and bank credentials never reach our servers.
- Confidentiality obligations for employees, professionals and processors, and regular access reviews.
7. Your rights
Under the DPDP Act you can:
- Access a summary of the personal data we process about you and the processing activities;
- Correct, complete or update inaccurate or incomplete data;
- Erase data that is no longer needed, unless the law requires us to keep it;
- Withdraw consent at any time — this does not affect processing already done, and some services may stop;
- Nominate another person to exercise your rights in case of death or incapacity;
- Raise a grievance with us, and if unresolved, complain to the Data Protection Board of India.
Email privacy@filingedge360.com from your registered email address. We may verify your identity before acting, and we respond within the time set out in our grievance redressal policy.
8. Children
Our services are meant for adults. Where a minor’s data is needed (for example, a minor shareholder or a family member’s tax return), we process it only with verifiable consent of the parent or lawful guardian, and we do not track or target minors with advertising.
9. Cookies and similar technologies
Essential cookies keep the website working. Analytics and advertising cookies are used only if you accept them in the cookie banner. Details and how to change your choice are in our Cookie Policy.
10. Data breaches
If a personal data breach occurs, we will contain it, inform the Data Protection Board of India and affected individuals as required by the DPDP Act and its rules, and tell you what we are doing and what you can do to protect yourself.
11. Changes to this policy
We will post any changes here and update the date at the top. For significant changes, we will also notify active clients by email.
12. Contact and Grievance Officer
Privacy questions and requests: privacy@filingedge360.com.
Grievance Officer — grievance@filingedge360.com. See Grievance Redressal.