Privacy Policy

DRAFT for legal review. This text was prepared as a starting point and is not yet in force. Replace the items in [square brackets] and remove this line before publishing.

This Privacy Notice explains how [Registered entity name] ("we", "us"), trading as Tsquare Professionals, processes your personal data when you use this website and our filing services. It is written to meet the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000 and its rules. We are the Data Fiduciary for the personal data described here.

1. What we collect

• Account details: name, email address, mobile number and password (stored only as a one-way hash).
• Identity documents: PAN, Aadhaar and other identity proofs that the government portal for your filing requires. For most filings the portal requires the full Aadhaar number or an unmasked copy, so we collect it in full.
• Filing documents and information: the documents and answers listed on each service page, for example address proofs, utility bills, rent agreements, bank statements, business registration documents, income details and photographs.
• Payment details: the amount, date and payment reference. Card, UPI and bank details are collected directly by our payment gateway, Razorpay, and never reach us.
• Communications: messages you send us through the website, email, phone or WhatsApp.
• Technical data: IP address, browser type and the time of key actions (such as sign-in, consent, downloads), kept for security and audit.

2. Why we use it (purpose)

We process your personal data only to: create and secure your account; prepare, review and submit the filing or registration you ask for; contact you about it; collect payment and issue receipts; meet our legal obligations (including tax, accounting and law-enforcement requests); and prevent fraud and misuse. We do not sell your data, and we do not use it for advertising.

3. Legal basis and consent

We rely on your consent, which you give when you create an account and again, after reading a short notice, before your first filing. We also process data where the law requires it. You may withdraw consent at any time from My Account → Privacy & My Data, as easily as you gave it. Withdrawal stops further processing for new work but does not affect processing already carried out, or records the law requires us to keep.

4. Aadhaar

We collect your Aadhaar number or a copy of your Aadhaar only when the government portal for your filing requires it. We do not perform Aadhaar authentication, do not store biometric information, do not publish or display your Aadhaar number, and do not share it with anyone other than the government department your filing goes to. Inside our systems it is shown in masked form (only the last four digits) except to staff who need the full number to complete your filing, and every such view is logged.

5. Who can see your data

Only you, the executive assigned to your filing and our managers can access your documents. We share data with: the government department or portal your filing is submitted to; Razorpay, to process payments; our hosting and email providers, who process data on our instructions under contract ([names of hosting and email providers]); and authorities where the law requires it.

6. Where your data is stored

Your data is stored on servers located in Singapore [update when the servers move to India]. The DPDP Act permits this transfer; we will follow any restriction the Government of India notifies for that country.

7. How long we keep it

Documents and form answers for a filing are deleted 365 days after the filing is completed or cancelled. We email you 48 hours before deletion so you can download anything you need. Documents uploaded for a filing you never submitted are deleted after 30 days. Basic filing records (service, dates, status) and payment receipts are kept for as long as tax and accounting laws require [confirm the period, typically six to eight years]. Security logs are kept for at least 180 days as required by CERT-In.

8. How we protect it

We use reasonable security practices as required by Section 43A of the IT Act and Rule 6 of the DPDP Rules, including: encrypted connections (HTTPS); encryption of stored documents; access limited to staff who need it, by role; logging of access to documents and personal data; and regular backups. If a personal data breach occurs, we will inform you and the Data Protection Board of India as the Rules require, and report cyber incidents to CERT-In within six hours.

9. Your rights

From My Account → Privacy & My Data you can: get a copy of your personal data and a summary of how we have processed it; ask us to correct, complete or update it; ask us to erase it (subject to records the law requires us to keep); withdraw consent; and nominate another person to exercise these rights if you die or cannot act yourself. We respond to requests within 90 days.

10. Children

If you are under 18, a parent or lawful guardian must agree before we process your data, and we verify that consent before starting work. We do not track children's behaviour or show them targeted advertising.

11. Cookies and analytics

Essential cookies keep you signed in and protect forms against forgery. The website can't work without them, so they're always on.

Analytics cookies are used only if you choose Accept in the cookie banner. They let us use Google Analytics to see, in aggregate, how the website is used (for example, which pages are read and which buttons are clicked) so we can improve it. Until you accept, no Google Analytics code runs on the website and no analytics cookies are set.

Google Analytics is provided by Google, which processes this information for us and may store it outside India. We have turned off Google's advertising features and do not use advertising cookies. Analytics data is kept for [the retention period set in Google Analytics] and then deleted. See Google's Privacy Policy.

You can change your choice at any time using Cookie settings at the foot of every page. Declining does not affect how the website works for you.

12. Grievances

If you have a question or complaint about how we handle your data, contact our Grievance Officer, whose details are shown at the foot of every page and on our Grievance Redressal page. We acknowledge complaints within 48 hours and resolve them within one month. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

13. Changes to this notice

We will post any change here with a new version date, and ask for your consent again before your next filing if the change affects how we use your data.

Version: 2026-10-draft