1. Our Role Under the DPDP Act

The DPDP Act creates two key roles:

Role	Who	Responsibility
Data Fiduciary	The CA firm (you)	Determines the purpose and means of processing client data. Responsible for obtaining consent and meeting Data Principal rights.
Data Processor	Axxoraa Private Limited (us)	Processes client data only on your instructions, for the purpose of providing CA Saathi.

This means: You own your client data. We simply process it for you. You remain responsible for obtaining valid consent from your clients before entering their data into CA Saathi.

2. How We Comply with the DPDP Act

2.1 Lawful Processing

• We process personal data only for lawful purposes and only with your consent.
• We collect only the minimum data needed to provide the Service (data minimisation).
• We do not use your data for purposes beyond what you have agreed to.

2.2 Consent

• You provide consent when you sign up for CA Saathi.
• You can withdraw consent at any time by deleting your account or contacting us.
• We provide a clear, easy-to-understand Privacy Policy so you know exactly how your data is used.

2.3 Data Principal Rights

We support all rights granted to Data Principals under the DPDP Act:

Right	How We Support It
Right to Access	You can export all your data from the dashboard at any time.
Right to Correction	You can edit client details, invoices, documents, and UDINs directly in the dashboard.
Right to Erasure	You can delete your account and all data. We permanently delete within 30 days.
Right to Withdraw Consent	You can stop using the Service at any time and request deletion.
Right to Nominate	Contact our Grievance Officer to nominate a person to exercise your rights.
Right to Grievance Redressal	Contact our Grievance Officer (details below). We respond within 48 hours.

2.4 Data Security

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Role-based access controls.
• Secure authentication via Supabase Auth.
• Regular security reviews.

2.5 Breach Notification

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India within the timeline prescribed by the DPDP Rules.
• Notify affected users without undue delay.
• Take immediate steps to contain and remediate the breach.

2.6 Data Retention and Deletion

• We retain your data only as long as your account is active or as required by law.
• When you delete your account, we permanently delete your data within 30 days.
• Financial records may be retained longer where required by tax or other laws.

3. Your Obligations as a Data Fiduciary

As a CA firm using CA Saathi, you are the Data Fiduciary for your clients' data. You must:

• Obtain valid consent from your clients before entering their data into CA Saathi.
• Inform your clients about how their data will be used.
• Respond to your clients' requests regarding their data.
• Use the Service only for lawful purposes.

4. Data Processing Agreement (DPA)

Under the DPDP Act, a Data Processing Agreement is required between the Data Fiduciary and the Data Processor. We provide a standard DPA to all CA firms. To request a copy, email us at axxoraaprivatelimited@clipster.co.in.

The DPA covers:

• Scope and purpose of processing
• Security safeguards
• Breach notification timelines
• Sub-processor restrictions
• Data deletion on termination
• Audit rights

5. Sub-Processors

We use the following sub-processors to deliver the Service. All are bound by strict data protection terms:

Sub-Processor	Purpose
Supabase	Database, authentication, file storage
Razorpay	Payment processing
OpenAI	AI-driven reconciliation and explanations
Firebase / Google	Website hosting
Meta / WhatsApp	Message delivery via WhatsApp Web links

6. Grievance Officer

In accordance with Section 13 of the DPDP Act, our Grievance Officer is:

Acknowledgment: Within 48 hours of receiving a complaint.
Resolution: Within 30 days.

7. Updates to This Page

We may update this DPDP Compliance page as the law and our practices evolve. Material changes will be notified by email.

8. Contact Us

← Back to home