Privacy policy

This policy covers personal data collected through this website. It is drafted against the Digital Personal Data Protection Act, 2023. It does not cover data we hold about you as a client under an engagement — that is governed by the engagement letter and by our professional obligations.

In the language of that Act, Upadhyay Suraj & Co. is the Data Fiduciary for the data described here and you are the Data Principal.

Through the contact form: your name, email address, telephone number, organisation if you give one, the service you select, and the message you write.

Automatically, in server logs: your IP address, the pages requested, timestamps and your browser's user-agent string. We store a one-way hash of the IP address against a form submission rather than the address itself, because we need it to limit abuse, not to identify you.

We use the details you submit solely to respond to your enquiry. The lawful basis is the consent you give when you tick the consent box before submitting the form. You are not required to submit the form, and you may contact us by telephone or email instead.

We do not sell your data, we do not share it for marketing, and we do not use it to send you material you did not ask for.

Submissions are stored on the server that hosts this website and sent to a firm mailbox; our hosting and email providers handle them only in providing those services. Nobody else receives your data, we do not transfer it outside India, and we would disclose it only where a law in force requires us to.

Enquiries that do not become engagements are retained for the period stated in our retention schedule and then deleted. [CONFIRM: retention period to be set by the firm.]

Where an enquiry becomes an engagement, the record moves into the client file and is retained for the period our professional and statutory obligations require. A record we are required by law to keep, we keep, even if you withdraw your consent.

The site is served over HTTPS. Form submissions are written to storage outside the web root with restricted file permissions, and are not readable from the internet.

Separately from data protection law, we are bound by the Institute's requirement that a website ensures adequate secrecy of client matters handled through it. We treat information sent through this site on that footing.

If a breach affecting your personal data occurs, we will intimate you and the Data Protection Board of India as the Act requires.

This site sets one cookie, for the session that carries the form's anti-forgery token. It is removed when you close your browser. It is not used for tracking.

The site does not currently run third-party analytics. If that changes, this policy will be updated before the change goes live. [CONFIRM: whether analytics will be introduced.]

This website is not directed at children, and we do not knowingly collect the personal data of a person under eighteen. If you believe we hold any, write to us and we will delete it.

Under the Digital Personal Data Protection Act, 2023 you may ask us for a summary of the personal data we hold about you and of how we are processing it; ask us to correct, complete or update it; ask us to erase it; and withdraw your consent at any time. You may also nominate someone to exercise these rights for you in the event of your death or incapacity.

Withdrawing consent is as easy as giving it, and you need not give a reason. We then stop processing your data and delete it, except where a law requires us to keep a record.

To exercise any of these rights, or to raise a grievance, write to casurajupadhyay@causnc.com. That address is our contact point for questions about the processing of personal data. The Act expects you to give us the opportunity to resolve the matter first; if our response does not satisfy you, or we do not respond, you may then complain to the Data Protection Board of India.

We update this policy when our practice changes. The date of the current version is shown at the foot of this page.