Privacy notice

The Data Fiduciary for this website — the person who decides what personal data is collected here and why — is the chartered accountancy practice trading as CA Services Mumbai, in practice since 2012 and serving Mumbai and the surrounding Mumbai Metropolitan Region. Everywhere below, “we” means that practice and “you” means the Data Principal: the person the data is about.

How to reach us about data, in one place:

• Email — [email protected]. This is the route for every request and every grievance under this notice.
• Phone — +91 96731 98867, during Mon–Sat, 9:30 AM – 7:30 PM.

We publish no postal address, and this website never asks you for yours. Anything you would otherwise have posted should come by email. If you would rather speak to someone, call the number above and then send the request in writing so there is a record of what you asked for and when.

No Data Protection Officer

We have not appointed one, and we are not stating that one is required of us. The Act requires a Data Protection Officer only of a Significant Data Fiduciary — an entity the Central Government notifies as such under section 10. No such notification applies to this practice so far as we are aware. If that ever changes, the officer’s name and contact details will be published in this section. Until then a grievance goes to the email above and is handled by the practice itself.

Our processing of your enquiry rests on your consent and on nothing else. You give it by ticking the box on the form before you submit it. The box is never pre-ticked, and we never treat the act of submitting as agreement on its own. On the page form and the pop-up the browser itself refuses to send while the box is unticked, so that holds even with JavaScript switched off. In the on-site assistant the same gate sits at the review step: it shows you exactly what will be sent, and nothing is sent until you have actively chosen “Yes — contact me about this enquiry”.

The wording you agree to is this, verbatim:

I agree that CA Services Mumbai may use these details to answer this enquiry and call me back, and for nothing else. I can withdraw this at any time by emailing [email protected] — see the privacy notice.

That consent is limited to the purpose named in it. It is not agreement to be added to a mailing list, to be called about something else, or to have your number passed to anyone for their own use. If we ever want to use your details for a new purpose, we have to ask you again — a notice cannot take consent on its own.

Withdrawing it

You can withdraw your consent at any time, and withdrawing is deliberately no harder than giving it was: one email to [email protected] saying you withdraw it. You do not have to give a reason, fill in a form, or use any particular words. We stop using your enquiry, and we erase it unless another law requires us to keep it.

Withdrawal applies from the moment you ask. It does not undo processing that already happened lawfully while your consent was in force — a call we had already made, or a quote we had already emailed, stands as a thing that happened. The Act does not require it to be unwound, and we are not going to imply that it can be.

What we do not keep

We do not keep a separate timestamped log of the tick itself. This is a static site with no server of ours in the path, so a record of that kind cannot be written reliably for every visitor, and a consent log that exists for some people and not others would be worse than none. What we hold is the enquiry you chose to send, and this published notice of what ticking the box meant.

The contract we owe you, stated honestly

Section 8(2) of the Act lets a Data Fiduciary involve a Data Processor only under a contract. Putting that contract in writing with our forms provider, covering what it retains and for how long, is an outstanding item for us. We would rather say so on this page than imply a document we cannot show you. What is described above is how the arrangement works today, read from the code that runs this site.

Data leaving India

The Act permits personal data to be transferred outside India except to a country the Central Government restricts by notification under section 16. We do not choose the country in which Google processes measurement data, and we do not deliberately send any part of your enquiry outside India ourselves.

What we actually do

• The site is served over HTTPS, and every enquiry is posted over HTTPS. Your browser shows you that padlock; it is not a claim you have to take on trust from us.
• A submission is sent without cookies or credentials attached, so nothing of yours from another site travels with it.
• Nothing you type is written to your browser’s storage, and no enquiry is logged to the browser console.
• Each field is validated before anything is sent, and a hidden anti-spam field keeps automated submissions out.
• No password, card number or bank detail is collected anywhere on this site, so there is none of it here to lose.

What we do not claim

This site has not been through a security audit. It holds no certification. We name no encryption standard beyond the HTTPS your browser can verify for itself, and we do not describe our safeguards as “bank-grade” or anything of that sort. All of that would be easy to write and untrue, and a notice that overstates its own security is not worth reading.

If something goes wrong

If a personal data breach affecting your enquiry comes to our notice, the Act requires us to inform you and the Data Protection Board of India. We will, and we will tell you what was affected rather than describe it as a “security incident” and leave it there.

There is one route, and it is deliberately short. Email [email protected] with “DPDP request” in the subject line.

Tell us, in your own words:

• Which right you are using — a summary of what we hold, a correction, an erasure, a grievance, or a nomination.
• The mobile number or the email address you used on the form, so we can find the right enquiry. Without one of those we may not be able to identify your data at all.
• For a correction: what is wrong, and what it should say.
• For a nomination: your nominee’s name and one contact detail for them.

We may ask you one question to check that you are the person the enquiry came from. We will not ask you to send an identity document for this, and you should not send one.

We aim to answer within 7 working days, and we commit to answering within 30 days. If a request needs longer than that, we will tell you why before the 30 days is up rather than let it lapse in silence.

This site is about company formation, tax and accounting. It is not directed at children, and we do not knowingly collect the personal data of anyone under 18. Where the Act requires it, a child’s personal data is processed only with the verifiable consent of a parent or lawful guardian, and the same applies to a person with a disability who has a lawful guardian.

We do no tracking, no behavioural monitoring and no targeted advertising directed at children. That is easy for us to say truthfully, because this site runs no advertising tags for anybody of any age.

A web form cannot verify how old someone is, and we are not going to pretend otherwise. We rely on you not entering a child’s details. If a child’s details have reached us, email [email protected] and we will erase them without asking you for a reason.

When this notice changes, the date at the top changes with it. That date is edited by hand rather than generated, so it tells you when the words last changed and not when the site was last rebuilt. Today it reads 18 October 2026.

If a change would widen what we do with your data beyond the purpose you consented to, we have to ask you for fresh consent. Publishing a new version of this page does not take it for us.

We do not keep earlier versions on the site. If you want to know what a particular paragraph used to say, ask us at [email protected] and we will tell you.