Privacy notice

Who is responsible

Data Niyam, Bangalore, India, is the Data Fiduciary for the personal data described here. Our Grievance Officer is Saideep H J, reachable at ceo@dataniyam.in or +91 9606566272.

What we collect, and why

• Account details — name, email, phone number, designation and organisation, used to create and secure your console account.
• Assessor applications — firm name, address, partner and administrator contact details, submitted roster names and emails, registration and professional credential particulars (including ICAI identifiers when supplied, DISA/CISA declarations and advocate Bar Council/enrolment details). We use these to assess applications, verify professional status and arrange named account access. An administrator must be authorised to supply other people’s details; email verification does not establish their individual consent.
• Law-firm tax identity — PAN, GST-registration status and GSTIN where applicable, used for contracting and tax administration. PAN/GSTIN are encrypted in application records and masked in ordinary review screens. Bank details are not collected in the registration forms.
• Sign-in records — email address, one-time codes, device and session records, used to authenticate you and to keep an access log that forms part of your compliance evidence.
• Workspace content — the organisation, processing-activity, consent, breach, grievance and data principal request records you enter, used to produce your DPDP assessments, drafts and reports.
• Billing details — plan, seats and payment references, used to invoice you.
• Support correspondence — messages you send us, used to answer you.

Legal basis

We request affirmative consent for Assessor registration review, credential review and account arrangements as explained at collection. A contract alone is not a general processing ground under the DPDP Act. Where an applicable law requires particular tax records, we retain them for that obligation; any reliance on a permitted use must meet its specific statutory conditions. For workspace data, the organisation remains responsible for its applicable consent or permitted-use basis. You may withdraw consent from Withdraw consent. Withdrawal is as easy as giving consent was (Sec. 6(4)).

Who we share it with

Your workspace is visible to the users your organisation invites, and to the Assessor firm authorised for your engagement, so they can review and counter-sign your records. Authorised Master reviewers review applications; registration decisions and application review-screen access are recorded. Other staff access is restricted to their authorised duties. This does not claim that every individual database read has a separate audit entry. We use Data Processors for hosting, email delivery, payments and AI drafting under written agreements. Named recipients and third-party origins this site contacts, under Sec. 11(1)(b): Lovable Cloud / Supabase (hosting and database), Resend (email delivery), Razorpay (payments), and Google Fonts — fonts.googleapis.com and fonts.gstatic.com — for typefaces; browser requests may disclose connection information such as IP addresses. We do not sell personal data.

How long we keep it

Assessor applications and pending CA rosters are retained while review or account arrangements remain necessary. Fixed periods for declined, abandoned and never-activated registrations are awaiting approval; automatic applicant deletion is not currently enabled. You may request erasure through the contact below, subject to identity checks and justified legal holds. Active firm, engagement and audit records are not deleted merely because an activation link expires. Workspace and evidence records are kept for the life of your subscription and for three years after it ends, so compliance evidence remains available for audit. Sign-in and access logs are kept for one year. Records we must keep under tax or other law are kept for the period that law requires. Once no purpose remains, data is deleted or anonymised.

Your rights

You may ask for access to your data, correction, completion, updating or erasure, and you may nominate another person to exercise your rights. Signed-in users can raise these from the console; anyone else can write to ceo@dataniyam.in. If you are not satisfied with our answer you can complain to the Data Protection Board of India.

Grievances

Write to our Grievance Officer, Saideep H J, at ceo@dataniyam.in or use Raise a grievance. We acknowledge within 3 working days and respond within 30 days.

This notice in other languages

• हिन्दी (Hindi)
• ಕನ್ನಡ (Kannada)
• தமிழ் (Tamil)