Privacy Policy.

Akrutrim (“we”, “our”, or “us”) acts as a Data Fiduciary under the Digital Personal Data Protection (DPDP) Act. We operate the business compliance operating system and digital studio platform located in Delhi, India.

This policy applies to corporate founders, directors, designated partners, and authorized representatives whose personal and corporate information is collected to facilitate statutory compliance tracking and digital studio deliverables.

We only collect data strictly necessary to fulfill legal obligations, manage corporate filings, or produce digital deliverables:

• Identity & Director Records: Director Identification Numbers (DIN), Permanent Account Numbers (PAN), and masked Aadhaar numbers (with initial 8 digits masked in compliance with UIDAI regulations). Purpose: Form DIR-3 KYC filings, ROC annual returns, and incorporation verification.
• Corporate & Tax Identifiers: Corporate Identification Numbers (CIN), Limited Liability Partnership Identification Numbers (LLPIN), GSTIN, and registered office address. Purpose: Statutory portal lookup and GST return reconciliation.
• Financial & Banking Records: Audited balance sheets, profit and loss statements, and bank account statements. Purpose: AOC-4 and MGT-7 secretarial preparation and statutory review by our in-house CA/CS compliance desk.
• Contact Data: Authorized representative full name, business email address, and mobile phone/WhatsApp number. Purpose: Deadline reminders, SRN filing receipt delivery, and direct customer support.

We never collect biometric data, nor do we request personal bank account passwords or net-banking PINs.

All corporate filing records and personal identity proofs are protected using institutional-grade cryptographic controls:

• Data in Transit: Encrypted using Transport Layer Security (TLS 1.3) with modern cipher suites.
• Data at Rest: Encrypted using AES-256 standards in our secure Indian cloud document vault.
• Access Restrictions: Access to sensitive corporate filing documents is restricted via strict role-based access controls (RBAC) and limited exclusively to the authorized in-house CA/CS compliance professionals assigned to manage and execute your filing.

In strict compliance with the Indian Computer Emergency Response Team (CERT-In) directions issued under Section 70B of the Information Technology Act, 2000:

System access logs, authenticated session timestamps, IP addresses, and document access histories are securely maintained within Indian jurisdiction for a mandatory rolling period of 180 consecutive days. These audit trails ensure complete non-repudiation and regulatory compliance.

We share data only with verified infrastructure processors and statutory government repositories under strict confidentiality terms:

• Statutory Portals & Government Registries: Official government repositories including the Ministry of Corporate Affairs (MCA V3), Goods and Services Tax Network (GSTN), Income Tax Department (e-Filing/TRACES), and the Trade Marks Registry for direct statutory submission.
• Infrastructure & Hosting Providers: Secure cloud servers situated in India (AWS Mumbai Region / Edge infrastructure) maintaining ISO/IEC 27001 certifications.
• Transactional Communication Channels: Authorized SMS/WhatsApp Business API gateways and transactional email delivery providers used exclusively to dispatch filing notifications and SRN challans.

Internal handling of your corporate documents is restricted exclusively to our authorized in-house Company Secretaries and Chartered Accountants. We never sell, rent, broker, or farm out your records to external aggregators, advertisers, or third-party lead networks.

As a Data Principal under the DPDP Act, you maintain the following actionable statutory rights:

• Right to Access: You may request a complete summary of personal data being processed by Akrutrim.
• Right to Correction & Completion: You may request the update or correction of any inaccurate or outdated information.
• Right to Erasure: You may request the deletion of your personal data, subject only to mandatory legal retention periods prescribed by the Companies Act, GST Act, and CERT-In directives.
• Right to Withdraw Consent: You may withdraw consent for platform notifications or marketing communications at any time.

In accordance with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, our designated Grievance Officer is: