Privacy Policy

This Privacy Policy describes how Bizeneed India Private Limited, a company incorporated under the Companies Act, 2013, with its registered office in New Delhi, Delhi, India, collects, uses, stores, shares and protects your personal data when you use our website, customer portal and related professional services. For the purposes of the Digital Personal Data Protection Act, 2023 (the DPDP Act), Bizeneed is the Data Fiduciary for this personal data and you are the Data Principal. This policy is written with reference to the DPDP Act, the Digital Personal Data Protection Rules, 2025 (the DPDP Rules), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Where we rely on your consent, we ask for it through a clear affirmative action, such as ticking a box; simply visiting the website is not treated as consent.

• This Privacy Policy applies to personal data collected through our website, customer portal and services
• Bizeneed India Private Limited is the Data Fiduciary for this personal data
• The provisions of the DPDP Act on notice, consent and your rights, and the matching DPDP Rules, apply from the date they come into force (eighteen months after 13 November 2025, under MeitY notification G.S.R. 843(E) dated 13 November 2025; rule 1(4) of the DPDP Rules); we already follow them in this policy
• Where consent is the basis for processing, it is asked for separately, through a clear affirmative action, and can be withdrawn at any time
• This policy was last updated on October 21, 2026, and may be revised periodically

We collect personal information that you provide directly to us, including your name, email address, phone number, business name, PAN, Aadhaar, incorporation certificates and other compliance documents needed for the service you ask for. We also collect technical data such as IP address, browser type, device information and usage patterns when you interact with our website and portal. Optional analytics and diagnostics run only if you allow them in Cookie settings. We may also obtain information from government portals and business registries (for example MCA and GST records) where this is needed for your service and permitted by law.

• Identity and contact information: name, email address, phone number, postal address, and PAN
• Business details: company name, registration number, business type, and operational address
• KYC and identification documents: Aadhaar, PAN, incorporation certificates, MOA/AOA, and other statutory documents
• Financial information: bank account details, transaction history, invoice details, and payment records
• Technical data: IP address, browser type, operating system, device identifiers, and network information
• Usage data: pages visited, features used, session duration, search queries, and interaction patterns (analytics only with your consent)
• Text you type or files you submit to AI-assisted features, such as the portal assistant and document tools
• Communication records: support tickets, chat messages, email correspondence, and call notes

Your data is used to deliver the services you ask for, process transactions, send service updates and compliance reminders, keep your account secure, improve our website and portal, and meet our legal obligations under Indian law. We process personal data either with your consent or for certain legitimate uses permitted by section 7 of the DPDP Act, such as using data you voluntarily provide for the purpose you provided it (section 7(a)) or complying with a law or court order. We use your data only for the specified purpose and only to the extent necessary for it.

• Processing registrations, filings, accounting, tax, and compliance services as per applicable statutes
• Sending service updates, compliance reminders, statutory due-date alerts, invoices, and responses to queries
• Creating and managing user accounts, processing authentication, and managing subscription plans
• Processing payments and maintaining transaction records for accounting and compliance purposes
• Analysing usage (only with your Analytics consent) to improve features, usability and security
• Fulfilling statutory obligations under the Companies Act, 2013, GST Act, 2017, Income-tax Act, 2025 (and the Income-tax Act, 1961 for earlier periods)
• Detecting, preventing, and addressing fraud, unauthorised access, and security incidents
• Conducting internal quality reviews of our service delivery
• Sending promotional communications only where you have opted in; every marketing email has an unsubscribe link

We do not sell your personal data. We share it only as needed to deliver your service, to meet legal obligations, or where you have asked us to. Recipients include professionals who work on your matter, government portals for your filings, and the technology providers (Data Processors) that run our website, portal, database, email and AI features. These providers are named, with their locations, in our List of Sub-processors at /list-of-subprocessors/. We use them under their service contracts, and dedicated data processing agreements with them are being put in place. We may also disclose data when required by law, regulation or legal process.

• Service partners including chartered accountants, company secretaries and legal advisors working on your matter
• Government authorities and regulatory bodies (GSTN, Income Tax Department, MCA, ROC) for mandatory filings
• Hosting: Hostinger, which provides the server that runs our website, portal, uploaded files, cache, background jobs, our own mail server and our database backups
• Database: Neon, a managed PostgreSQL service hosted on Amazon Web Services in the United States, for account, order and portal data
• AI features: DeepSeek, which receives the text you submit to AI-assisted features to generate a response (processed outside India)
• Payments: Razorpay, our payment gateway, when online payment is enabled; card, UPI and bank details you enter in its checkout are collected by Razorpay, and we receive the payment status and reference
• Optional services that run only when enabled on our site: Google Analytics 4 (only with your Analytics consent) and MSG91 for SMS and WhatsApp messages
• Browser push notifications, if you turn them on, are delivered through your browser provider's push service
• Law enforcement agencies or statutory authorities upon receipt of valid legal process
• Courier services for dispatch of physical documents, where needed

We take reasonable security safeguards to protect personal data, as required by section 8(5) of the DPDP Act and the SPDI Rules, 2011. The measures listed below are the ones we have in place today. No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security of your data.

• Encrypted HTTPS (TLS) connections between your browser and our website and portal
• Bank account numbers submitted for partner KYC are encrypted in our database (AES-256-GCM) and shown masked
• Passwords are stored only in hashed form, never in plain text
• Role-based access controls, so staff see only the data needed for their work
• Optional two-step verification (authenticator app) and passkeys or security keys for portal accounts
• Audit logs of significant actions taken in the portal
• Daily backups of the database and uploaded files, kept on our hosting server for a limited period
• In the event of a personal data breach, we will inform affected Data Principals and the Data Protection Board of India as required by section 8(6) of the DPDP Act and rule 7 of the DPDP Rules, and report to CERT-In where its directions require

Chapter III of the DPDP Act gives you the right to information about your personal data (section 11), to correction, completion, updating and erasure (section 12), to grievance redressal (section 13) and to nominate another person (section 14). You may also withdraw consent at any time (section 6(4)). These sections apply from the date they come into force (eighteen months after 13 November 2025, under MeitY notification G.S.R. 843(E) dated 13 November 2025); we already accept and act on these requests. To make a request, write to grievance@bizeneed.in from your registered email address or quote your registered mobile number, so that we can identify you (rule 14 of the DPDP Rules).

• Right to information: a summary of the personal data we process and the processing activities, and the identities of the other Data Fiduciaries and Data Processors with whom we have shared it, with a description of the data shared (section 11)
• Right to correction, completion and updating of inaccurate, incomplete or out-of-date personal data (section 12(2))
• Right to erasure: we will erase your personal data on request unless we need to keep it for the specified purpose or to comply with a law, for example tax, GST and company law record-keeping (section 12(3))
• Right to grievance redressal: write to our Grievance Officer at grievance@bizeneed.in; we aim to respond within 30 days and in any case within the period published under the DPDP Rules, which may not exceed ninety days (section 13; rule 14(3))
• Right to nominate: you may nominate another individual to exercise your rights in the event of your death or incapacity (section 14)
• Right to withdraw consent at any time, as easily as you gave it; withdrawal does not affect processing done before it, and services that depend on that data may stop (section 6(4) and (5))
• Right to approach the Data Protection Board of India: if your grievance is not resolved by our Grievance Officer, you may complain to the Board; section 13(3) requires you to use our grievance redressal mechanism first
• In addition to your statutory rights, we will, on request, give you a copy of your data in a commonly used, machine-readable format, and stop direct marketing to you at any time
• Your duties under section 15 of the DPDP Act include not impersonating another person, not suppressing material information, not filing false or frivolous grievances, and giving only verifiably authentic information when asking for correction or erasure

Our website uses cookies and similar browser storage. Essential storage keeps the site, sign-in and security working and cannot be switched off. Optional categories (Analytics, Diagnostics and Marketing) stay off until you allow them. Your choice is stored in your browser and is asked for again after 180 days. More detail is in our Cookie Policy at /cookie-policy/.

• Essential: sign-in, session management, security, and remembering choices such as your cookie preferences - cannot be disabled
• Analytics (optional): usage measurement with Google Analytics 4, only when enabled on our site and only if you allow it
• Diagnostics (optional): browser error and performance reports, only when enabled on our site and only if you allow it
• Marketing (optional): no marketing tracker is currently enabled
• Third-party: on payment pages, Razorpay's checkout may set cookies it needs to process your payment
• You can change your choices at any time through the Cookie settings link in the footer of our pages, or the Cookie settings button on pages without a footer
• We do not use cookies for behavioural advertising or to track you across unrelated third-party websites

We retain your personal data only for as long as necessary for the purpose for which it was collected, or for longer where a law requires us to keep it, as section 8(7) of the DPDP Act allows. Retention periods depend on the nature of the data and our obligations under the Companies Act, 2013, the Income-tax Act, 2025 (and the Income-tax Act, 1961 for earlier periods) and the GST Act, 2017. From the date rule 8 of the DPDP Rules comes into force, we will also keep personal data, traffic data and logs of processing for at least one year, as rule 8(3) requires. After the applicable period, data is deleted or anonymised.

• Customer account data retained for the duration of the business relationship plus 7 years for statutory compliance
• Financial and transaction records retained for 8 years, or longer where the Companies Act, 2013, section 36 of the Central Goods and Services Tax Act, 2017 or income-tax law requires
• Corporate records including incorporation documents and MCA filings retained as required by the Companies Act, 2013
• KYC and identification documents retained for 5 years after account closure, or longer where a law requires
• Technical logs and analytics data retained for a maximum of 26 months unless required for ongoing investigations or by law
• Deleted account data is removed from production systems within 30 days and from backups within 90 days
• Data subject to ongoing legal proceedings is retained until the conclusion of such proceedings

Our services are meant for businesses and adults. Under the DPDP Act, a child is a person under 18 years of age, and section 9 requires verifiable consent of a parent or lawful guardian before a child's personal data is processed. We do not knowingly collect personal data of children. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at privacy@bizeneed.in and we will delete it after verification.

• Our Platform is not intended for use by individuals under the age of 18
• We do not knowingly collect personal data of children under 18
• Parents or guardians who believe their child has provided data should contact us at privacy@bizeneed.in
• Verified requests for deletion of a minor's data will be actioned promptly
• If we discover that we have collected a child's data without verifiable parental consent, we will delete it

Some of your personal data is stored and processed outside India. Our application database (account, order and portal data) is hosted by Neon on Amazon Web Services in the United States, and text you submit to AI-assisted features is processed by DeepSeek outside India. Our website, portal, uploaded files and backups run on servers operated for Bizeneed by our hosting provider. Section 16 of the DPDP Act and rule 15 of the DPDP Rules allow transfers outside India, except to countries the Central Government restricts by notification and subject to any requirements it specifies; we will follow any such restriction.

• Application database: Neon on Amazon Web Services, United States region (data stored outside India)
• AI-assisted features: DeepSeek (data processed outside India)
• Website, portal, uploaded files, email and backups: servers operated for Bizeneed by our hosting provider, Hostinger
• The current list of providers and their locations is published in our List of Sub-processors at /list-of-subprocessors/
• We will update this policy and the List of Sub-processors before changing where your data is stored
• You may ask us at any time which countries your data is processed in

If you have questions about this Privacy Policy or about how we process your personal data, please contact us. The contact below can answer your questions about the processing of your personal data on behalf of Bizeneed (section 8(9) of the DPDP Act; rule 9 of the DPDP Rules). For requests to exercise your rights or to raise a grievance, write to our Grievance Officer. We aim to respond within 30 days of receipt, and in any case within the period published under the DPDP Rules.

• Email: privacy@bizeneed.in - for questions about this policy and about the processing of your personal data
• Email: grievance@bizeneed.in - Grievance Officer, for complaints and data access/correction/erasure/nomination requests
• Registered Office: Bizeneed India Private Limited, New Delhi, Delhi, India
• Response time: We aim to respond to all privacy inquiries within 30 days of receipt, and to grievances within the period published under the DPDP Rules (not more than ninety days)
• Data requests may require identity verification, such as writing from your registered email address, before processing

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or Platform features. We will notify you of material changes by posting the updated policy on our Platform with a revised date and, where you have an account, by email or in-portal notification. Where a change needs your fresh consent, we will ask for it rather than assume it. The 'Last updated' date at the top of this page indicates when this policy was last revised.

• This Privacy Policy may be updated periodically to reflect changes in practices or legal requirements
• Material changes will be communicated via email or in-platform notification at least 7 days in advance
• The Last updated date indicates when this policy was last revised
• Where a change requires your consent, we will ask for it separately
• Previous versions of this policy are available upon written request