This document is a draft template provided for convenience and has not been reviewed by legal counsel. Have it reviewed before relying on it.
01Overview
This policy explains what personal data CA Practice OS handles and why. CA firms (our customers) are the controllers of their clients’ data; we act as a processor on their instructions. For our own website visitors and account holders, we are the controller.
02What we collect
Account data: names, work email, phone and firm details you provide. Client data entered by firms: identities (such as PAN, GSTIN), contact details, filings, tasks, invoices and uploaded documents. Technical data: login events, IP address and audit trails of actions in the product. Enquiries: details you submit through our contact or demo forms.
03How we use data
To provide and secure the Service, to keep the append-only audit log, to send service messages, to respond to enquiries, and to improve reliability. We do not sell personal data.
04Tenant isolation and access
Each firm’s data is isolated server-side. Our staff do not access a firm’s data unless the firm explicitly grants time-limited support access, which is logged.
05Documents
Uploaded documents are held in private storage and are not served through public links. Every download is permission-checked.
07Retention
We keep data while your account is active and for a limited period afterwards to allow export. Audit logs are retained for compliance and security. You may ask us to delete data, subject to legal retention duties.
08Your rights
Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you may request access, correction or erasure of your personal data and may withdraw consent. Clients of a firm should direct requests to that firm in the first instance.
09Security
We use encryption in transit, hashed credentials, role-based access control, rate limiting and audit logging. No system is perfectly secure; we will notify affected customers of a breach as required by law.
10Contact
Questions about this policy can be sent through the contact page.