SS Auditors & Tax Consultants ("SS Auditors", "we", "us", "our") is a chartered accountancy firm based in Bengaluru, Karnataka, India. We are committed to protecting the personal data of our clients and users of our client platform ("Platform"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights available to you under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This policy applies to personal data processed through our Platform and in the course of providing our professional services.

In the course of providing accountancy, taxation, audit, and compliance services, and operating the Platform, we collect and process the following categories of personal data: Identity and contact data: name, email address, phone number, and postal/business address. Financial and tax data: information necessary to provide our services, which may include PAN, GSTIN, bank account details, invoices, receipts, financial statements, and other financial documents you provide or authorise us to prepare. Account and authentication data: login credentials (passwords are stored only in hashed/encrypted form and are never visible to us in plaintext), and, where enabled, two-factor authentication details. Documents and correspondence: files, documents, and messages you upload or exchange through the Platform. Technical and usage data: information generated automatically when you use the Platform, including session information, access logs, and limited device/browser information used for security and to operate the service. See our Cookie Policy. We collect personal data directly from you, from documents you provide, and as generated through your use of the Platform.

Under the DPDP Act, we process your personal data on the basis of your consent and/or as necessary for the legitimate uses permitted under the Act (including performing our professional engagement with you and complying with legal obligations). We use your personal data to: Provide accountancy, taxation, audit, and compliance services to you; Create and manage your account on the Platform; Communicate with you about your engagement, including notices, reminders, invoices, and quotations (by email and, where you have provided a number, WhatsApp); Prepare, file, and maintain records of statutory and regulatory filings on your behalf; Secure the Platform, prevent fraud and unauthorised access, and maintain audit logs; Comply with our legal, regulatory, and professional obligations, including record-keeping requirements applicable to chartered accountants. We do not sell your personal data.

We do not disclose your personal data except as described here. We share personal data with: Service providers (data processors) who operate the Platform on our behalf, under contractual obligations to protect your data and process it only on our instructions. These include providers of cloud database and authentication hosting, file/document storage, application hosting, transactional email delivery, WhatsApp business messaging (for notices, reminders, quotations, and similar communications), and error-monitoring and security services. Statutory and regulatory authorities, where disclosure is required to provide our services (e.g. filing returns with tax authorities) or is required by law. Professional and legal advisors, where necessary and subject to confidentiality. We do not share your data with third parties for their own marketing purposes.

We retain your personal data for as long as necessary to provide our services, to comply with our legal, regulatory, and professional record-keeping obligations as a chartered accountancy firm, and to resolve disputes or enforce agreements. [CONFIRM — specify retention periods in line with applicable law and ICAI/tax record-keeping requirements.]

We implement appropriate technical and organisational measures to protect your personal data, including: encryption of sensitive stored credentials and encrypted database backups; access controls that restrict data to authorised staff on a need-to-know basis; row-level security ensuring clients can access only their own data; audit logging of access to client documents; authentication protections including enforced password changes and two-factor authentication for staff; malware scanning of uploaded files; and security monitoring and rate-limiting. No system can be guaranteed perfectly secure, but we work to protect your data using industry-standard safeguards.

As a Data Principal under the DPDP Act, you have the right to: access a summary of the personal data we process about you; request correction, updating, and completion of inaccurate or incomplete data; request erasure of your personal data, subject to our legal and professional retention obligations; raise a grievance regarding our processing (see Section 9); nominate another individual to exercise your rights in the event of death or incapacity; and, where processing is based on consent, withdraw it at any time (this will not affect the lawfulness of processing before withdrawal, and may affect our ability to provide services). To exercise any of these rights, contact our Grievance Officer (Section 9). We will respond within the timeframes required by law.

Some of the service providers we use to operate the Platform may store or process personal data on servers located outside India. Where personal data is transferred or processed outside India, we take steps to ensure it continues to be protected in accordance with the DPDP Act and applicable law, including through contractual safeguards with our processors. [CONFIRM — the firm should verify the current hosting locations of each processor and keep this disclosure accurate.]

If you have any questions, concerns, or complaints about how we handle your personal data, please contact our Grievance Officer: Sayeed Ahmed VM SS Auditors & Tax Consultants No. 12, 1st Cross, AMC Road, MM Layout, Kavalbyrasandra, RT Nagar Post, next to SBI Bank Branch, Kaval Bairasandra, Bengaluru, Karnataka 560032 Email: services@ssauditor.com Phone: +91 99168 32841

Our Platform and services are intended for businesses and individuals engaging our professional services and are not directed at children. We do not knowingly collect personal data of children (individuals under 18) except as part of a client engagement where lawful and with the consent of a parent or lawful guardian as required.

We may update this Privacy Policy from time to time. The "Last updated" date reflects the most recent version. Material changes will be notified through the Platform or by other appropriate means.

For any questions about this Privacy Policy, contact us at services@ssauditor.com or via the details in Section 9.