Privacy Policy
This Privacy Policy is our notice under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, and also meets the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 for as long as they apply. It explains what personal data we collect, why, who we share it with, how long we keep it, and how you can exercise your rights.
1. Who we are
Ishvaa Consultancy Services (“Ishvaa”, “we”, “us”) is a proprietorship based in Bengaluru, Karnataka, India, owned by Gosala Subramanyam. For personal data collected through this website and for our own client relationship, we are the Data Fiduciary.
Where a client asks us to process personal data of its employees, directors or customers (for example, payroll, PF/ESI or director KYC), the client is the Data Fiduciary and we act as its Data Processor under a written engagement letter.
Contact: ishvaaconsultancy@gmail.com · +91 70193 82275
2. What we collect, why, and on what basis
| When | Personal data | Purpose | Legal basis |
|---|---|---|---|
| You send an enquiry (form, WhatsApp, email, phone, Calendly) | Name, phone, email, city/country, profile, your message | Reply to you and prepare a proposal | Consent (s.6), which you give through the checkbox or by contacting us |
| You download a guide | Name, email | Send you the guide | Consent (s.6) |
| You opt in to alerts / the monthly dispatch | Email (and name, if given) | Send deadline alerts and our newsletter | Separate, optional consent (s.6). Unsubscribe at any time |
| You engage us as a client | Identity and KYC documents (PAN, Aadhaar, passport, DIN, address proof, photographs), contact details, bank details, financial and tax records, employee payroll data, login credentials you choose to share for government portals | Deliver the services in your engagement letter: registrations, filings, accounting, payroll and advisory | Consent and the engagement contract (s.6), and legitimate uses — data you voluntarily give us for a specified purpose and compliance with law (s.7(a) and s.7(c)–(e)) |
| You browse the website | With consent only: pages viewed, approximate location, device and browser, the campaign or site that referred you | Understand which content helps visitors; measure our advertising | Consent through the cookie banner (s.6) |
Please do not send PAN, Aadhaar, bank or passport details through the website forms. We will request such documents securely after you engage us.
We do not knowingly collect personal data of children (anyone under 18). If a minor’s data is needed for a service (for example, as a family member in a tax matter), we will obtain verifiable consent from a parent or lawful guardian, as the DPDP Act requires.
3. Consent and how to withdraw it
Where we rely on consent, it is free, specific and given by a clear action — we never use pre-ticked boxes. You may withdraw consent as easily as you gave it:
- Cookies: click “Cookie settings” in the footer of any page.
- Newsletter or alerts: use the unsubscribe link, or email or WhatsApp us “STOP”.
- Anything else: write to our Grievance Officer (section 10).
Withdrawal does not affect processing already done, and we may continue to keep data that the law requires us to retain (section 7). If you withdraw consent needed for an active engagement, we may be unable to continue that service.
4. Who we share data with
We do not sell, rent or trade personal data. We share it only as needed:
- Government portals and authorities — GSTN, Income Tax Department, TRACES, MCA, EPFO, ESIC, RBI (FIRMS), DGFT and state departments — to make filings on your behalf.
- Independent Chartered Accountants you appoint for statutory or tax audits and certifications, and your bank (authorised dealer) for FEMA and remittance matters.
- Service providers (Data Processors) who help us operate, under confidentiality terms:
Provider Used for Google (Workspace / Gmail, Drive, Google Analytics, Google Ads if used) Email, document storage, website analytics Meta (WhatsApp; Meta Pixel only if we run Meta ads) Client messaging; ad measurement Calendly Booking consultation calls Vercel Website hosting A form-handling provider (if enabled) and accounting software you use (Tally, Zoho Books, Sage) Receiving website enquiries; bookkeeping - Where the law requires — a court order, a statutory notice, or to prevent fraud or protect rights.
5. Transfers outside India
Some service providers above store data on servers outside India. Under section 16 of the DPDP Act such transfers are permitted except to countries the Central Government restricts; we will stop any transfer to a restricted country. International clients: your data is processed in India and by the providers above.
6. How we protect your data
We use reasonable security safeguards in line with Rule 6 of the DPDP Rules, including: encrypted connections (HTTPS) and encrypted cloud storage; multi-factor authentication on email and storage accounts; access limited to people working on your file; separate client folders; regular backups; and access logs kept for at least one year. No system is completely secure, but we work to prevent unauthorised access, use, change or loss.
Personal data breach: if a breach affects you, we will tell you without delay — what happened, the likely impact, what we are doing, and what you can do — and we will report it to the Data Protection Board of India, with a detailed report within 72 hours of becoming aware of it, or as the Rules require.
7. How long we keep data
| Data | Retention |
|---|---|
| Enquiries that do not become engagements | Up to 24 months after our last contact, then erased |
| Newsletter / alert list | Until you unsubscribe or withdraw consent |
| Client records, books, returns and supporting documents | 8 years after the end of the financial year concerned, or longer if a law, assessment, notice or dispute requires (e.g., Companies Act s.128, CGST Act s.36, Income-tax law) |
| Website analytics | 14 months in Google Analytics |
| Consent records and security logs | At least 1 year, and as long as needed to prove consent |
When the purpose is served and no law requires us to keep it, we erase the data or anonymise it permanently.
8. Your rights
Under the DPDP Act you have the right to:
- Access — a summary of the personal data we hold about you, how we process it, and who we have shared it with (s.11);
- Correction, completion, updating and erasure — subject to data we must keep by law (s.12);
- Grievance redressal — a response from us to any complaint about how we handle your data (s.13);
- Nominate another person to exercise your rights if you die or become incapable (s.14);
- Withdraw consent at any time (s.6(4)).
To make a request, contact the Grievance Officer below. We may ask you to verify your identity. We acknowledge requests within 7 days and respond within 30 days — and in any case within the 90-day maximum set by the Rules.
You also have duties under s.15: provide genuine information, do not impersonate others, and do not file false or frivolous complaints.
9. Cookies
We use essential browser storage to remember your cookie choice. Analytics and marketing cookies are loaded only after you consent. Details are in our Cookie Policy.
10. Grievance Officer
Ishvaa Consultancy Services, Bengaluru, Karnataka, India
Email: ishvaaconsultancy@gmail.com (subject: “Data protection request”)
Phone / WhatsApp: +91 70193 82275 · Monday–Saturday, 9 am – 7 pm IST
If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act, after first using our grievance process.
11. Language and changes
This notice is in English. On request, we will provide it in Kannada, Telugu or Hindi, or any other language in the Eighth Schedule to the Constitution. We will post any changes on this page with a new effective date, and ask for fresh consent where the law requires.