DPDP Act Notice

1. Who we are

Harun Raaj & Associates ("we", "us") is a Chartered Accountancy firm registered with the Institute of Chartered Accountants of India (ICAI Membership No. 238303, Firm Registration No. 19027S), practising at Visakhapatnam, Andhra Pradesh, India.

2. Why this notice exists

This notice explains how we collect and process your personal data in connection with our client portal, onboarding flow, and professional services, under the Digital Personal Data Protection Act, 2023 (the "DPDP Act").

Where we rely on your consent, it is free, specific, informed, and unconditional, and is limited to the personal data necessary for the purposes listed below (§6 of the DPDP Act, 2023).

3. What your consent covers

When you set up your client portal, you are asked to consent to the following, each of which you can review and accept individually:

• Engagement terms — scope of work and our professional obligations.
• Document storage — your documents stay in your vault; you can export them.
• Deadline reminders — notifications for statutory dates that apply to you.
• Portal access — we act on the portals you authorise, and log every action.
• Privacy notice — how we hold your data, detailed in our Privacy Policy.

Consent to each item is specific to that purpose. Declining or withdrawing an item does not affect the others.

4. How we protect your data

All data is stored on servers located in India (Supabase — ap-south-1 region). Financial credentials are encrypted at rest using AES-256-GCM. Data in transit is protected by TLS 1.2+. Access is restricted to your CA and authorised firm staff. We do not sell, rent, or share your data with third parties for marketing purposes.

5. Your rights as a Data Principal

Under the DPDP Act, 2023, you have the right to access, correct, and request erasure of your personal data, subject to statutory retention requirements (we retain records for a minimum of 8 years from the end of the relevant assessment year under Section 44AA of the Income Tax Act, 1961 and the Institute's guidelines). Requests are acknowledged and responded to within 30 days. To exercise these rights, write to us at hr@hr-ca.com.

6. Withdrawing consent

You may withdraw consent to data processing at any time via Settings → Privacy in your client portal. Withdrawing consent to data processing may restrict your access to certain HRA services. You can re-consent at any time.

7. Breach notification

In the unlikely event of a data breach affecting your personal data, we will notify you and the Data Protection Board of India as required by the DPDP Act, 2023.

8. Grievance officer

For any grievance relating to this notice or the processing of your personal data, write to hr@hr-ca.com (subject: "Privacy Grievance — DPDP Act 2023") or call +91 93008 97008.