Privacy Policy

1. Who we are

H G M & Co LLP is a firm of Chartered Accountants with its office at Office No. 07, Third Floor, Suyash Plaza, Bhandarkar Road, Pune 411004, India. For the personal data described in this policy, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). That means we decide why and how your personal data is processed, and we are responsible for protecting it.

This policy covers personal data we collect through this website and through enquiries made by phone, email or WhatsApp. Personal data you share with us as a client during a professional engagement is also handled under this policy, together with the terms of our engagement letter and the professional duty of confidentiality that applies to Chartered Accountants.

2. Personal data we collect

We collect only what we need for the purposes set out in section 3.

• Enquiries: your name, phone number, email address, the service you are interested in, and anything you choose to write in your message.
• Communication: details you share when you call, email or message us on WhatsApp, including your number or email address and the content of your messages.
• Client engagements: if you become a client, the information needed to provide our services. Depending on the service, this may include identity and address details (such as PAN and Aadhaar), financial records, tax documents, bank statements and business records.
• Careers: your CV and contact details, if you apply to join our team.

We do not use this website to collect payment details, and we do not ask for sensitive information through the enquiry form. Please don’t send identity documents or financial records through the form; we will tell you a secure way to share them if needed.

3. Why we use it

We use your personal data only for these purposes:

• To respond to your enquiry and discuss how we can help you
• To provide the professional services you engage us for, and to communicate with you about them
• To meet our legal and professional obligations, including record-keeping under tax and company law, ICAI requirements and requests from government authorities
• To consider your application, if you apply to join our team

We do not sell your personal data, and we do not use it for unrelated marketing.

4. Consent and withdrawal

When you submit an enquiry, you give us your consent to process the details you provide, for the purpose of responding to you. Where we rely on consent, it is specific to the purpose stated at the time.

You can withdraw your consent at any time by writing to us at the address in section 12. Withdrawing is as easy as giving consent. Once you withdraw, we will stop processing your data for that purpose and erase it, unless the law requires us to keep it. Withdrawing consent does not affect processing that was done before you withdrew.

In some cases the DPDP Act allows us to process personal data without consent. Examples are complying with a law, a court order or a request from a government authority.

5. Who we share it with

We share personal data only when necessary, and only for the purposes above:

• Service providers (Data Processors) who help us run our practice, such as website hosting, email, cloud storage and accounting software providers. They may process data only on our instructions and must keep it secure.
• Government authorities and regulators, such as the Income Tax Department, GST authorities, the Ministry of Corporate Affairs, MahaRERA and the Reserve Bank of India, when filings or responses are part of the work you have engaged us for or are required by law.
• Other professionals, such as advocates or valuers, only with your knowledge, where your matter requires it.

6. Where it is stored

Your data is stored in India or with reputable service providers whose servers may be located outside India. Any transfer outside India is made in line with the DPDP Act and any restrictions notified by the Government of India.

7. How long we keep it

• Enquiries that do not lead to an engagement are deleted within a reasonable time once they no longer need a follow-up, or earlier if you ask.
• Client records are kept for the period required by law and professional standards, such as income tax, GST and company law, and ICAI requirements. Records are then securely deleted.
• Job applications are kept only for as long as needed to consider them, unless you agree to us keeping them for future openings.

8. How we protect it

We take reasonable security safeguards to protect personal data against unauthorised access, loss or misuse. These include:

• access limited to team members working on your matter
• password-protected systems and devices
• secure methods for sharing documents
• confidentiality obligations on everyone in the firm

If a personal data breach occurs, we will notify the Data Protection Board of India and the affected individuals as required by the DPDP Act.

9. Your rights

Under the DPDP Act, you have the right to:

• Access information: a summary of the personal data we hold about you, how we use it, and who we have shared it with
• Correction and completion of inaccurate or incomplete data, and updating of your data
• Erasure of data that is no longer needed, unless we are required by law to keep it
• Grievance redressal: an answer from us on any concern about how your data is handled
• Nomination: naming a person to exercise your rights if you die or become incapable

To use any of these rights, write to our Grievance Officer (section 12). We may need to verify your identity before acting on a request. As the Act requires, please give accurate information and do not file false or frivolous complaints.

10. Children’s data

This website and our enquiry form are meant for adults. We do not knowingly collect personal data of anyone under 18 without verifiable consent from a parent or lawful guardian. Where our services involve a minor, for example a minor’s tax return, we process their data only with the consent of the parent or guardian, and only for that purpose.

11. Cookies and third-party services

• Our website does not use advertising or tracking cookies. It stores a small setting in your browser to remember that you accepted the disclaimer during your visit. This contains no personal data and is cleared when you close the browser.
• Google Maps (on our Contact page) and Google Fonts are provided by Google, which may receive your IP address and set its own cookies, under Google’s privacy policy.
• WhatsApp: messages you send us on WhatsApp are also subject to WhatsApp’s own terms and privacy policy.

If we add website analytics in future, we will update this policy first.

12. Grievance officer and complaints

We will acknowledge your request and respond as soon as possible, within the time prescribed under the DPDP Act and its rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India, after first raising it with us.

13. Changes to this policy

We may update this policy to reflect changes in law or in how we work. The latest version will always be on this page, with the “Last updated” date at the top. Where a change materially affects how we use data you have already given us, we will tell you.