Privacy Policy

1. Introduction

Anil Arora & Co. (“the firm”, “we”, “us”, or “our”) operates this website to share information about our practice and to receive enquiries from prospective clients, candidates, and other interested persons. We are committed to handling personal data lawfully, fairly, and with reasonable care.

This Policy applies to personal data collected through this website. It does not apply to data processed in the course of our professional engagements, which is governed by the engagement terms agreed with each client and by the Chartered Accountants Act, 1949 and the Code of Ethics issued by the Institute of Chartered Accountants of India (“ICAI”).

2. Data we collect

We collect personal data in three ways:

Information you provide

When you complete a contact, careers, or service-enquiry form on this site, we collect the information you submit. Typical fields include:

• your name;
• your email address and phone number;
• the country and city in which you are based;
• the service you are interested in or the nature of your enquiry;
• the content of any message or attachment (including, for careers, your CV).

Information collected automatically

When you visit the site, our hosting provider records standard server logs. These typically include your Internet Protocol (IP) address, the user-agent string of your browser, the page you visited, and the date and time of the request. These logs help us run the site reliably and detect abuse.

Information from cookies and analytics

We use a small number of strictly necessary cookies to operate the site and privacy-respecting analytics to understand aggregate usage patterns (for example, which pages are most read). We do not use advertising cookies and we do not allow third-party advertising networks to profile visitors.

3. Purpose of collection

We collect and use personal data for the following purposes:

• to respond to your enquiry, prepare a proposal, or schedule a conversation with you;
• to maintain an audit trail of communications, as required by professional, regulatory, and record-keeping obligations applicable to a Chartered Accountancy firm;
• to maintain the security of the website, prevent fraud and abuse, and investigate suspected misuse; and
• to comply with applicable law and to respond to lawful requests from authorities.

4. Legal basis for processing

Under the DPDP Act, 2023, we process personal data on the following grounds:

• Consent (Section 6). When you submit a form, you provide free, specific, informed, unconditional, and unambiguous consent to the processing of the personal data you have entered, for the purpose of responding to your enquiry. You may withdraw this consent at any time (see Section 7 below).
• Certain legitimate uses (Section 7). We rely on this basis for security logging, fraud prevention, and discharging legal and regulatory obligations applicable to our practice.

5. Sharing of data

We do not sell personal data. We do not share personal data with marketing partners or advertising networks. We share personal data only in the following limited circumstances:

• Sub-processors who help us operate the website. These currently include:
  • Vercel Inc. — our hosting and serverless infrastructure provider, which operates the servers that deliver this website and store server logs;
  • Resend Inc. — our transactional email provider, which we use to deliver form submissions to our internal inbox and to send acknowledgement emails to you;
  • Cloudflare, Inc. — whose Turnstile service we use to verify that form submissions originate from a human and to protect the site from automated abuse.
• Professional advisers. Where necessary, we may share data with our own lawyers, auditors, or insurers, under obligations of confidentiality.
• Authorities. Where we are required to do so by law, by an order of a competent court or tribunal, or by a lawful request from a regulator.

6. Retention

We retain personal data only for as long as is necessary for the purpose for which it was collected:

• Form submissions (contact, service, and careers enquiries) are retained for a period of 24 months from the date of submission, so that we have a record of our engagement with you and can follow up if circumstances change.
• Server logs are retained for a period of 30 days and are then deleted, except where they form part of an ongoing security or fraud investigation.
• Where data has become part of an engagement file or is required to be retained under any law (for example, the Income-tax Act, 1961 or the Companies Act, 2013), the statutory retention period applies and supersedes the periods above.

On expiry of the retention period, personal data is securely deleted or anonymised.

7. Your rights under the DPDP Act, 2023

As a Data Principal, you have the following rights:

• Right to access. You may request a summary of the personal data we hold about you and the processing activities undertaken in respect of that data.
• Right to correction and erasure. You may request that we correct inaccurate or incomplete data, or erase personal data that is no longer required for the purpose for which it was collected.
• Right to withdraw consent. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to grievance redressal. You may raise a grievance with our Grievance Officer (see Section 8). If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India as constituted under the DPDP Act, 2023.
• Right to nominate. You may nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, please write to us at the contact details in Section 11. We will respond within the timelines required by law.

8. Grievance Officer

In compliance with Section 8(9) of the DPDP Act, 2023, we have designated a Grievance Officer to address questions and grievances regarding personal data processed by us:

• Name: CA Anil Arora
• Email: anilca@anilarora.co.in
• Postal address: Anil Arora & Co., First Floor, K-359, opp. Water Tank, near Emerald Mall, Ashiyana Colony, Sector K, LDA Colony, Lucknow, Uttar Pradesh 226012, India

We endeavour to acknowledge grievances within three working days and to resolve them within the timeline prescribed under the DPDP Act, 2023 and the rules made thereunder.

9. International transfers

Some of our sub-processors named in Section 5 (in particular, Vercel, Resend, and Cloudflare) are headquartered outside India and may process or store personal data on servers located outside India. Such transfers are conducted under the contractual safeguards offered by those providers, which include standard contractual clauses and equivalent measures. We rely on these arrangements to ensure a reasonable standard of protection for personal data that is processed outside India, consistent with Section 16 of the DPDP Act, 2023.

10. Changes to this Policy

We may amend this Policy from time to time, for example to reflect changes in the services we offer, the sub-processors we engage, or the law. The current version is always published on this page, with the “Last updated” date at the top. Material changes will be highlighted. We encourage you to review the Policy periodically.

11. Contact

If you have any question about this Policy or about how we handle personal data, please write to us at anilca@anilarora.co.in, or by post to Anil Arora & Co., First Floor, K-359, opp. Water Tank, near Emerald Mall, Ashiyana Colony, Sector K, LDA Colony, Lucknow, Uttar Pradesh 226012, India.