Privacy Policy

2. The personal data we collect

We collect personal data that you provide to us, that is generated in the course of an engagement, or that is collected automatically when you use our website:

• Identity and contact details — name, email address, telephone number, designation and organisation.
• Engagement information — business, financial, tax, secretarial and transaction information you share with us to deliver our services.
• KYC and statutory documents — identifiers and documents we are required to collect to meet legal, regulatory and anti-money-laundering obligations.
• Correspondence — the content of enquiries, consultation requests and other communications with us.
• Website and technical data — IP address, device and browser information, and cookie data collected when you visit www.comfintax.com.

3. How we use personal data

We process personal data for the following purposes:

• To provide, manage and deliver the professional services you engage us for.
• To respond to consultation requests, enquiries and other communications.
• To meet our legal, statutory, regulatory, tax and professional obligations, including KYC and record-keeping requirements.
• To administer our relationship with you, raise invoices and process payments.
• To operate, secure and improve our website and communications.

4. Lawful basis and consent

We process personal data on the basis of your consent and/or for the legitimate uses permitted under the DPDP Act — for example, where you voluntarily share data for a specified purpose, or where processing is necessary to comply with a legal obligation.

Where we rely on consent, we will request it for a specified purpose at or before the point of collection, in clear terms. You may withdraw your consent at any time by writing to us (see “Grievance Officer” below). Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal, and may mean we are unable to continue providing certain services.

5. Your rights as a Data Principal

Subject to applicable law, the DPDP Act gives you the following rights in relation to your personal data:

• Right to access — to obtain a summary of the personal data we process about you and the processing activities undertaken.
• Right to correction and erasure — to have inaccurate or misleading data corrected, completed or updated, and to have data erased where it is no longer required for the purpose or by law.
• Right to grievance redressal — to a readily available means of raising grievances with us about our handling of your personal data.
• Right to nominate — to nominate another individual to exercise your rights in the event of death or incapacity.

6. How we share personal data

We do not sell personal data. We may share it only as necessary:

• With regulators, government authorities, courts or other bodies where required or permitted by law.
• With service providers and processors who act on our instructions under appropriate confidentiality and data-protection obligations.
• With professional collaborators in our network where this is necessary to deliver an engagement, on a need-to-know basis.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet statutory record-keeping requirements under tax, companies and other applicable laws. When data is no longer required, we erase it or anonymise it in a secure manner.

8. Security safeguards

We implement reasonable technical and organisational security safeguards designed to protect personal data against unauthorised access, disclosure, alteration or loss. In the event of a personal-data breach, we will act in accordance with our obligations under the DPDP Act, including notifying the Data Protection Board and affected Data Principals where required.

9. Cookies and website analytics

Our website may use cookies and similar technologies to operate the site, remember your preferences (such as light or dark theme) and understand how the site is used. You can control or disable cookies through your browser settings; some features may not function correctly if cookies are disabled.

10. Children’s data

Our services and website are intended for businesses and adults. We do not knowingly process the personal data of children except in accordance with the DPDP Act, including obtaining verifiable consent of a parent or lawful guardian where required.

11. Processing and transfers

We may process and store personal data using service providers that operate within or outside India. Where data is processed outside India, we do so in accordance with the DPDP Act and any restrictions notified by the Government.

12. Grievance Officer

If you have any questions, requests or grievances regarding your personal data or this policy, you may contact our Grievance Officer:

Grievance Officer ————— (name to be confirmed), COMFINTAX, Bengaluru, India. Email: info@comfintax.com.

We will acknowledge and respond to grievances within the timelines prescribed under applicable law.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation or our practices. The “last updated” date above indicates when this policy was last revised. We encourage you to review it periodically.

14. Contact us

For any questions about this Privacy Policy or our data practices, write to us at info@comfintax.com.