Data Privacy Policy

1. Scope and Applicability

At Sunit Gupta & Associates (“SGA”, “we”, “us”, or “our”), safeguarding your privacy and maintaining the confidentiality of your financial data is fundamental to how we practise. This Privacy Policy governs the collection, processing and protection of information obtained through this website, through our secure client portal (“My Finance Desk”) once it becomes available to clients, and in the course of our professional engagements.

For the purposes of the Digital Personal Data Protection Act, 2023, Sunit Gupta & Associates acts as a Data Fiduciary in respect of the personal data you provide to us, and determines the purpose and means of its processing.

2. Information We Collect

To provide comprehensive Chartered Accountancy and business advisory services, we collect various types of information, which may include:

• Personal Information: Names, contact details, PAN, Aadhaar, and other identification documents required for KYC and statutory filings.
• Financial & Corporate Data: Bank statements, ledger accounts, payroll logs, tax returns, incorporation documents, GST records, and audit evidence.
• Technical Data: IP addresses, browser types, and access timestamps collected automatically when you navigate our digital platforms or use our secure portal, utilized purely for security monitoring and platform optimization.

3. Use of Your Information

The information we collect is strictly utilized for the following professional purposes:

• Executing professional engagements, including tax preparation, statutory audits, and corporate advisory.
• Filing mandatory compliance reports with regulatory authorities (e.g., Income Tax Department, Ministry of Corporate Affairs, GST Network).
• Communicating with you regarding critical deadlines, regulatory updates, and ongoing service delivery.
• Maintaining internal records and ensuring quality control in adherence to ICAI standards.

4. Data Security & Confidentiality

As Chartered Accountants, confidentiality is the cornerstone of our practice. We deploy advanced organizational and technical measures to prevent unauthorized access, alteration, or disclosure of your data. Access to client files is governed by the principle of least privilege, restricted exclusively to the designated partners and engagement personnel handling your account.

We do not sell, rent, barter, or commercially exploit any client data with third-party marketers or advertisers under any circumstances.

5. Disclosure of Information

We disclose your information only where it is necessary to perform the engagement or where the law requires it. In practice this means:

• Regulatory authorities: submissions made on your instructions to the Income Tax Department, the Goods and Services Tax Network, the Ministry of Corporate Affairs and similar bodies.
• Service providers: a limited set of technology providers who host or process data on our behalf, under contract and only for the purposes set out in this policy.
• Statutory or judicial compulsion: where disclosure is required by a court, tribunal or authority of competent jurisdiction.

We do not sell, rent or barter client data, and we do not disclose it to marketers or advertisers under any circumstances.

6. Data Retention

Financial data and audit working papers are retained for the period mandated by applicable Indian law — including the Companies Act, 2013 and the Income-tax Act, 1961 — and by ICAI regulations on the retention of working papers. Where no statutory period applies, we retain information only for as long as the purpose for which it was collected requires.

Clients retain ownership of their primary source documents at all times.

7. Your Rights

Subject to the Digital Personal Data Protection Act, 2023 and to our overriding statutory and professional obligations, you may:

• Request access to a summary of the personal data we hold about you and how it is processed.
• Request correction of data that is inaccurate, incomplete or out of date.
• Request erasure of data that we are no longer required by law to retain.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Raise a grievance with us, and thereafter with the Data Protection Board of India.

We cannot delete records that a statute, a regulator or ICAI requires us to keep, and we will tell you plainly when that is the reason a request cannot be met in full.

8. Cookies and Website Analytics

This website does not use advertising cookies or third-party marketing pixels, and we do not sell or share your information with advertisers. Standard server logs record technical information such as IP address, browser type and timestamp; these are used only to keep the site secure and available, and are not used to build a profile of you.

We do use Google Analytics to understand how the site is used in aggregate — which pages are read, on what kind of device, and how visitors arrive. It sets a first-party cookie to recognise a returning browser and sends usage data to Google, which acts as our processor for this purpose. We do not use it to identify you personally, and we do not combine it with any client information you send us. You can opt out entirely by installing Google’s browser opt-out add-on, or by blocking analytics cookies in your browser settings; the site works exactly the same either way.

9. Grievance Redressal

Questions, concerns and requests regarding this policy or the handling of your data may be addressed to your engagement partner, or to our compliance desk at support@sgaca.in, or by post to Sunit Gupta & Associates, 43 Jasmeet Nagar, Ambala City, Haryana 134003, India. We aim to acknowledge every request within seven working days.

10. Changes to this Policy

We may revise this policy to reflect changes in law, regulation or our own practices. The date at the top of this page records when it was last revised. Material changes affecting existing clients will be communicated directly.