Privacy Policy &
Data Protection Standards.

1. Introduction & Statutory Scope

FinnovaCA ("Firm", "we", "our") is a Chartered Accountancy practice committed to protecting the privacy and security of corporate clients and individual taxpayers. This Privacy Policy sets out how we collect, store, process, and protect information when you visit our website, engage our advisory services, or provide financial records for statutory filings.

Our data processing practices adhere strictly to the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the professional code of ethics established by the Institute of Chartered Accountants of India (ICAI).

2. Personal & Corporate Data We Collect

To execute statutory audits and government filings, we collect necessary business and personal identifiers:

• Director & Authorized Signatory KYC: Full legal name, Permanent Account Number (PAN), Aadhaar, Director Identification Number (DIN), passport copies, address proofs, and registered contact information.
• Corporate & Commercial Data: Company incorporation certificates, Memorandum & Articles of Association (MOA/AOA), GSTIN credentials, bank account statements, digital invoices, and accounting ledgers.
• Statutory Authentication Tokens: Digital Signature Certificates (DSC) and portal credentials supplied strictly for authorized government portal upload purposes.

3. Lawful Basis & Purposes of Processing

We process data exclusively for legitimate statutory purposes:

• Statutory Execution: Preparing and filing annual ITRs, Form 3CD tax audit reports, GSTR-1/3B returns, and MCA forms (AOC-4, MGT-7).
• Notice Defense: Preparing structured legal replies to departmental inquiries under Section 142(1), 143(2), 148, or GST DRC-01 notices.
• Advisory & Structuring: Calculating advance tax liabilities, compiling MIS reports, and conducting startup due diligence.

4. Data Security & Encryption Standards

Client financial documents and identity records are stored in access-controlled environments. We deploy industry-standard TLS encryption in transit and AES-256 encryption at rest. Internal access to client financial ledgers is strictly restricted to assigned Chartered Accountants and authorized audit team members.

We never monetize, license, or share client financial databases with marketing brokers or automated aggregator platforms.

5. Authorized Disclosures (MCA, GSTN, ITD)

We disclose client data only in the following lawful contexts:

• Government Portals: Submitting authorized returns directly to the Income Tax Department (ITD), Goods and Services Tax Network (GSTN), and Ministry of Corporate Affairs (MCA).
• Statutory Obligation: When explicitly mandated by a valid judicial subpoena, court order, or statutory directive from regulatory authorities.

6. Statutory Retention Lifecycles

In accordance with the Income Tax Act, 1961, Companies Act, 2013, and GST regulations, statutory records and audit working papers must be maintained for a statutory period of up to 7 to 8 financial years following the conclusion of the relevant assessment year.

7. Client Data Rights (DPDP Act, 2023)

Under the Digital Personal Data Protection Act, 2023, clients and individuals hold the right to:

• Request a summary of personal data held and processing activities performed.
• Request correction or updating of inaccurate KYC records.
• Request deletion of non-statutory personal data upon conclusion of engagement, subject to mandatory statutory retention rules.