Legal

Privacy Policy

Last updated: 8 August 2026

1. Introduction

Puneet M & Co (“the Firm”, “we”, “us”, “our”) is a Chartered Accountancy firm carried on by the proprietor CA Puneet Middha, a member of the Institute of Chartered Accountants of India (ICAI), Membership No. 463179. Our website is puneetmiddha.in and our contact email is puneetmiddha11@gmail.com. Our registered office/place of practice: F-39, 1st Floor, Rangoli Plaza, Maharana Pratap Road, Vaishali Nagar, Jaipur 302034.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you interact with us — through our website, email, phone, in person, or WhatsApp (including the WhatsApp Business Platform / WhatsApp Business API). It is drafted in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable rules made thereunder.

Under the DPDP Act, an individual whose personal data we process is a “Data Principal”, and the Firm — determining the purpose and means of processing — is the “Data Fiduciary”. Where you have consented through a Consent Manager registered under the Act, that consent is honoured and can be withdrawn through the same Consent Manager.

Professional note (ICAI compliance):This page and the information on it do not constitute, and must not be construed as, solicitation, advertisement, or canvassing of professional work in any form, as prohibited or restricted under the Chartered Accountants Act, 1949 and the ICAI Council General Guidelines, 2008. Nothing herein is an inducement to engage the Firm’s services. Any information provided is for transparency, statutory notice, and client-service purposes only.

2. Personal Data We Collect

We collect personal data you provide directly, personal data generated through our professional engagement, and personal data received via communication channels including WhatsApp.

Categories of personal data:

  • Identity data: name, PAN, Aadhaar (where legally required for KYC/engagement), date of birth, signature.
  • Contact data: phone number, email address, postal/registered address.
  • Financial data: income details, bank statements, GST returns, TDS returns, invoices, ledgers, financial statements, tax computations, investment details — as necessary to render accounting, tax, GST, TDS, audit-support, and business-registration services.
  • Statutory identifiers: GSTIN, TAN, CIN/LLPIN, UDIN, and other registration numbers of clients or their businesses.
  • Communication data: content of emails, letters, and messages (including WhatsApp messages), call logs where retained for service purposes.
  • Technical data: IP address, browser type, device information, and cookies collected via our website (if applicable).

We do not knowingly collect personal data of children (under 18) except where necessary as part of a family’s tax/compliance engagement and with verifiable consent of a parent or lawful guardian, as required under the DPDP Act.

3. WhatsApp Business Platform Data Processing

We use the WhatsApp Business API / WhatsApp Business Platform, provided by Meta Platforms, Inc. and its affiliates (“Meta”), to communicate with clients and prospective clients.

What we collect via WhatsApp:

  • Your WhatsApp phone number and profile name.
  • The content of messages you send us (text, and any documents, images, or media you share — e.g., invoices, PAN/Aadhaar copies, financial statements).
  • Delivery and read-receipt metadata generated by the platform.

Why: to respond to service queries, share appointment/document reminders, exchange documents needed for tax/GST/accounting work, and provide client updates — this is necessary for the performance of the professional engagement (or, before engagement, for legitimate steps taken at your request).

Meta’s role: Meta processes messages, media, and associated metadata as part of operating the WhatsApp Business Platform infrastructure that delivers our messages to you and yours to us. Meta acts as a data processor/technology-service-provider for this transmission and is separately bound by its own Business Messaging Policy and Privacy Policy, available at whatsapp.com/legal/business-data-processing-terms and whatsapp.com/legal/privacy-policy. We do not control Meta’s infrastructure-level processing and encourage you to review Meta’s own disclosures.

Retention: message content and shared documents exchanged over WhatsApp are retained in line with our general retention schedule (Section 6 of this Policy) and, for records a Chartered Accountant is statutorily required to retain, for the periods specified under the Income Tax Act, 1961, Companies Act, 2013, and ICAI documentation-retention requirements.

Opting out / stopping messages: you may stop receiving messages from us on WhatsApp at any time by:

  • Replying STOP to any message thread with us, or
  • Blocking our WhatsApp Business number directly within WhatsApp, or
  • Emailing puneetmiddha11@gmail.com requesting that we cease WhatsApp communication.

Opting out of WhatsApp does not affect our ability to serve statutory notices or communications through other legally valid channels (email, post) where required for an ongoing engagement.

4. Lawful Basis for Processing

We process personal data on the following grounds recognised under the DPDP Act and applicable law:

  • Consent: for marketing-adjacent or optional communications, obtained through clear, itemised notice.
  • Legitimate/specified use for which you voluntarily provide data, e.g., sharing documents to obtain a tax return or GST filing.
  • Performance of a contract/engagement: to deliver the accounting, tax, audit-support, or registration services you have engaged us for.
  • Compliance with legal obligation: e.g., retaining records under the Income Tax Act, Companies Act, Prevention of Money Laundering Act (where applicable), and ICAI regulations.
  • State/statutory functions: where we act on your behalf before tax or regulatory authorities under a duly executed authorisation.

5. Third-Party Processors and Disclosures

We share personal data only as necessary, with the following categories of recipients:

  • Meta Platforms, Inc. — as the WhatsApp Business Platform provider (see Section 3).
  • Hosting/IT service providers — for website hosting, email, and cloud storage of working papers, under confidentiality obligations.
  • ERPNext (self-hosted instance) — used internally by the Firm to manage client records, invoicing, and engagement data; hosted on infrastructure the Firm controls and secures.
  • Statutory/regulatory authorities — Income Tax Department, GST authorities, ROC/MCA, ICAI, or courts/tribunals, where legally required or authorised by you.
  • Sub-consultants — e.g., a co-opted specialist for a specific matter, only with confidentiality safeguards and, where appropriate, your knowledge.

We do not sell personal data to third parties and do not share client financial data for marketing purposes.

6. Cross-Border Data Transfer

WhatsApp/Meta infrastructure operates on a global basis, and messages and associated metadata processed via the WhatsApp Business Platform may be transmitted to, or stored on, Meta servers located outside India, including in jurisdictions such as the United States, subject to Meta’s own data-transfer safeguards. Except as required for this platform’s functioning and any cloud-hosting arrangement expressly disclosed to you, the Firm does not otherwise routinely transfer client personal data outside India. Where cross-border transfer occurs, it is limited to what is necessary for service delivery, consistent with Section 16 of the DPDP Act (which permits transfer except to countries restricted by the Central Government).

7. Data Retention

Our operative retention period is 8 years from the end of the engagement. We apply this single period to all client records rather than varying it by record type, because 8 years satisfies the longest applicable statutory minimum and a uniform policy is one we can reliably honour.

The statutory minimums this period is set to cover are:

  • The Income Tax Act, 1961 — generally up to 6 years from the end of the relevant assessment year.
  • The Companies Act, 2013 — books of account for at least 8 years, the longest of the applicable minimums and therefore the basis for our period.
  • GST law — generally 72 months from the due date of the annual return.
  • ICAI documentation and audit-file retention norms — working papers for 7 years.

Records are retained beyond 8 years only where an assessment, reassessment, appeal, litigation or other proceeding remains pending, in which case they are retained until that matter concludes and any further statutory period expires.

  • Communication records (including WhatsApp message logs retained for service continuity) are kept only as long as necessary for the engagement and applicable statutory retention, after which they are securely deleted or anonymised.
  • Data no longer required, and not subject to statutory retention, is deleted or irreversibly anonymised.

8. Security Measures

We apply reasonable security safeguards proportionate to the sensitivity of the data, including: access restricted to authorised personnel on a need-to-know basis, password-protected and encrypted storage of client financial documents, secure (self-hosted, access-controlled) ERPNext deployment, regular backups, and confidentiality undertakings consistent with our professional obligations as Chartered Accountants. No system is completely secure; we will notify affected Data Principals and the Data Protection Board of India of any personal data breach as required under the DPDP Act.

9. Your Rights as a Data Principal

Under the DPDP Act, you have the right to:

  • Access — obtain a summary of personal data we process about you and the processing activities undertaken.
  • Correction and updating — request correction of inaccurate or incomplete personal data.
  • Erasure — request erasure of personal data that is no longer necessary for the purpose it was collected, subject to our statutory retention obligations (see Section 7 and our Data Deletion Instructions).
  • Grievance redressal — raise a grievance with our Grievance Officer and expect a response within a reasonable time.
  • Nominate — nominate another individual to exercise your rights in the event of death or incapacity.
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email puneetmiddha11@gmail.comwith the subject line “DPDP Request” and a description of the request.

10. Grievance Officer

Name: CA Puneet Middha
Designation: Proprietor / Grievance Officer
Email: puneetmiddha11@gmail.com
Address: F-39, 1st Floor, Rangoli Plaza, Maharana Pratap Road, Vaishali Nagar, Jaipur 302034

If you are not satisfied with our response, you may approach the Data Protection Board of India as constituted under the DPDP Act, 2023.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The “Last updated” date at the top reflects the latest revision. Material changes will be notified through our website or WhatsApp/email where appropriate.

12. Contact Us

Puneet M & Co
Email: puneetmiddha11@gmail.com
Website: puneetmiddha.in