Shiwam Agarwal & Associates

Practice Management Portal

Privacy Policy

This notice is under legal review and may be updated. Material changes will be posted on this page.

Shiwam Agarwal & Associates ("the Firm", "we", "us", or "our"), GSTIN 20AFRFS8644G1ZN, operates the Practice Management Portal (the "Service"), an internal system and client portal used to manage Chartered Accountancy engagements, statutory compliance filings, billing, and client communication. This notice explains what personal data we process through the Service, why, who processes it on our behalf and where, how long we keep it, and the rights you have under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it.

For the personal data described here, the Firm is the Data Fiduciary: we decide why and how it is processed. The service providers listed in section 5 process it only on our instructions, as Data Processors.

This notice applies to our clients and the people who act for them (directors, partners, authorised signatories and other contacts), users of our client portal, our own partners and staff, and anyone who communicates with us over WhatsApp or email in connection with our services.

1. Personal Data We Process

1.1 Clients and their contacts

  • Identity and registration details: name, designation, PAN, TAN, GSTIN(s), CIN or LLPIN, Director Identification Number (DIN), DIN KYC status, date of incorporation, and AGM dates.
  • Contact details: email address, phone number, WhatsApp number, and registered and other addresses.
  • Your WhatsApp consent record: whether you have opted in, the source and date of the opt-in, and any opt-out.
  • Digital Signature Certificate (DSC) details: holder name, PAN, certificate class, serial number, issue and expiry dates, and who in the Firm holds the token.
  • Financial and compliance information: invoices, payments, tax deducted at source (TDS) on our fees, advances, credit notes, statutory filings, working papers and notices.
  • Documents you or your organisation provide for an engagement. These may contain further personal data, such as Aadhaar details where a filing legally requires them, or bank details.

1.2 Government and other portal credentials (credential vault)

Where you authorise us to file or act on your behalf, we may hold the login credentials you give us for government and other portals (for example GST, Income Tax, TRACES or MCA), including passwords, PINs, security answers and two-factor authentication secrets. Each secret is encrypted individually with AES-256-GCM before it is stored, can be viewed only by team members specifically granted access to it, and every time a secret is revealed the access is logged.

1.3 Client portal users

  • Name, email address, the client you act for, your role, and your last sign-in time.
  • Your password, which is stored only as a one-way hash and never in readable form.
  • Messages, support tickets (with your replies, ratings and attached files) and documents you send us through the portal.

1.4 Partners and staff of the Firm

  • Name, email address, phone number, role and team, and Microsoft 365 sign-in identity where used.
  • Work records: task assignments, time entries and timesheets, attendance (check-in and check-out times), leave requests and balances, and approvals.

1.5 Communications

  • WhatsApp: the content of messages and media exchanged with us through the WhatsApp Business Platform, and, for WhatsApp voice calls, the phone number, time, duration and outcome of the call. We do not record the audio of WhatsApp calls.
  • Email: the recipient, subject and body of emails the Service sends.
  • Notifications the Service posts to the Firm's internal Microsoft Teams channels about engagement work.

1.6 Information collected automatically

  • Sign-in times, IP address and browser (user agent) information, recorded in an audit log of significant actions for security and accountability.
  • Strictly necessary cookies that keep you signed in and protect your session. We do not use advertising or third-party analytics cookies.

2. Why We Process It, and on What Basis

  • To prepare, review and file statutory returns and carry out compliance, audit and advisory work you have engaged us for.
  • To send deadline reminders, document requests, status updates and invoices.
  • To operate the client portal, including secure document exchange.
  • To manage billing, invoicing and payment reconciliation, including TDS deducted on our fees.
  • To run internal workflows, quality control, time recording, attendance and leave for our team.
  • To keep the Service secure, investigate misuse, and keep an audit trail.
  • To meet our own legal, regulatory and professional obligations as a Chartered Accountancy firm.

We process personal data either with your consent (section 6 of the DPDP Act) or for the legitimate uses permitted by section 7 of the DPDP Act, which include processing data you have voluntarily given us for a specified purpose, complying with a legal obligation, and employment purposes for our own staff. We send business-initiated WhatsApp messages only to numbers for which an opt-in has been recorded.

3. Consent and Withdrawing It

Where we rely on your consent, you may withdraw it at any time, as easily as you gave it, by contacting us (section 10) or, for WhatsApp, by replying "STOP". Once you opt out, the Service blocks further outbound WhatsApp messages to that number; we remain reachable by email and phone. Withdrawal does not affect processing already carried out, and does not stop processing we must continue to meet a legal obligation, such as keeping records of filings made on your behalf. If withdrawal means we can no longer perform part of an engagement, we will tell you.

4. Who We Share It With

We do not sell personal data, and we do not share it for anyone else's marketing.

  • Government and regulatory authorities (for example GSTN, the Income Tax Department, TRACES and MCA) when we make filings on your behalf or where disclosure is required by law.
  • Professional advisors and successors, only where necessary and subject to confidentiality obligations consistent with professional standards for Chartered Accountants.
  • Our Data Processors, listed in section 5, who process data only to run the Service for us.

5. Data Processors and Where Your Data Is Stored

  • Hosting: the application, its database and backups, and files uploaded to the Service where no SharePoint site is used, are kept on computers the Firm operates itself or rents from a hosting provider it chooses.
  • Microsoft Corporation (Microsoft 365): stores engagement documents in the Firm's SharePoint sites, provides staff sign-in, and carries internal Teams notifications. Data is held in the Firm's Microsoft 365 tenant, in the data location Microsoft assigns to that tenant.
  • Meta Platforms (WhatsApp Business Platform): carries WhatsApp messages and calls. Depending on our configuration, messages may be delivered through Meta directly or through Twilio Inc. or Gupshup as WhatsApp Business solution providers. These providers may process message content and metadata outside India.
  • Resend: sends the Service's emails. Processes recipient addresses and email content, which may be outside India.
  • GSTIN lookup provider (AppyFlow, where enabled): receives only the GSTIN being verified, to fetch the registered name from the public GST register.

Transfers outside India. Some of the processors listed above may store or process personal data outside India. Section 16 of the DPDP Act permits such transfers except to countries the Central Government restricts by notification; we will not transfer personal data to a restricted country.

6. How Long We Keep It

We keep personal data only as long as it is needed for the purpose it was collected for, or for longer where Indian tax, company, professional or other law requires us to keep records. In particular:

  • Engagement records, filings, working papers, client documents, and billing and payment records are kept for the period Indian tax, company and professional law requires for such records, counted from the end of the engagement or the year they relate to.
  • Credential vault entries: until the engagement ends or you ask us to remove them, whichever is earlier. When an entry is deleted, its passwords and other secrets are destroyed at once; the portal name, username and record of who had access are kept with the audit log.
  • WhatsApp and email communications, portal user accounts, staff records (time, attendance, leave) and security audit logs are kept only as long as the purpose they were collected for, or a legal obligation, requires.
  • You can ask us (section 10) how long a particular record of yours will be kept.

When a client relationship, portal account or staff account ends, the record is first deactivated: it is removed from day-to-day use but kept, together with any SharePoint site (which is archived), so that we can meet our record-keeping obligations. Personal data is permanently erased once the applicable period above has passed, or earlier on a valid erasure request where no law requires us to keep it. Copies in database backups are overwritten as those backups expire under our database provider's backup schedule.

7. How We Protect It

  • All traffic to the Service is encrypted in transit (HTTPS).
  • Credential vault secrets are encrypted individually with AES-256-GCM, and access to them is granted per person and logged.
  • Account passwords are stored only as one-way hashes.
  • Role-based access control limits each team member to the clients and functions their role requires; client portal users see only their own organisation's data.
  • Uploaded files are kept in private storage and are served only after a permission check.
  • Significant actions, including sign-ins and changes to records, are written to an audit log.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Personal Data Breaches

If a personal data breach occurs, we will notify the Data Protection Board of India and each affected person, in the form and within the time required by the DPDP Act and the rules made under it, describing what happened, the likely consequences, the steps we have taken, and what you can do to protect yourself.

9. Your Rights

Under the DPDP Act you have the right to:

  • Access: obtain a summary of the personal data we hold about you, the processing we carry out, and the identities of those we have shared it with.
  • Correction: have inaccurate or misleading data corrected, incomplete data completed, and out-of-date data updated.
  • Erasure: have your personal data erased when it is no longer needed for the purpose it was collected for, unless a law requires us to keep it.
  • Grievance redressal: have a complaint about how we handle your data addressed by us (section 10).
  • Nomination: nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
  • Withdraw consent, as described in section 3.

To exercise any of these rights, write to us at the contact in section 10. We may need to verify your identity before acting on a request. We will respond within the period the DPDP Act and the rules made under it allow. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Grievances and Contact

For questions about this notice, to exercise your rights, or to raise a grievance, write to us, marking your message "Data protection grievance":
Shiwam Agarwal & Associates
LGF-B, OM Sharday, Kusum Vihar, Ring Road, Saraidhela, Dhanbad, Dhanbad – 826005, Jharkhand, India
Email: shiwam@saaindia.in

11. Children's Personal Data

The Service is meant for adults acting in a business or professional capacity and is not directed at children. Where an engagement involves a child's personal data (for example, a return filed for a minor), we process it only with the verifiable consent of the child's parent or lawful guardian, only for that engagement, and never for tracking, behavioural monitoring or targeted advertising.

12. Changes to This Notice

We may update this notice from time to time. Material changes will be posted on this page with an updated effective date, and where the change affects processing based on your consent, we will tell you before it takes effect.