How to ask for data to be deleted, how long it takes, and what the law makes us keep.

Data Deletion Policy and Request Instructions

Effective date: 19 September 2026 · Version 1.0

This page explains how personal data held in Tosure (operated by Bhujbal Daily Solutions Private Limited, CIN U72900MH2019PTC330201, registered office B-11/14, Siddhivinayak Society, M G Complex, Sector 14, Vashi, Navi Mumbai, Maharashtra – 400703, India) is deleted, how to ask for deletion, how long it takes, and the limited records Indian law requires us to keep even after a deletion request. It supports the right to erasure under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.

This page is also our data deletion instructions URL for the Meta / WhatsApp Business Platform app.

1. Who should ask whom

| You are | What you can ask for | Where to ask | | --- | --- | --- | | A client of a CA firm (you received an upload link or WhatsApp message) | Erasure of your personal data and documents, or withdrawal of consent | Ask your CA firm first — its name and email are on the notice you received. The firm decides what it must keep for its professional and statutory duties. | | A firm user (owner or staff) | Deletion of your own staff account | Your firm's Owner, under Settings › Staff | | A CA firm (through its Owner) | Deletion of a client record, a document, an activity, or the whole workspace | In the platform, or by email to us | | Anyone, if the firm does not respond | Help getting a response, and escalation | [grievance email] |

Because Tosure processes client data on behalf of the CA firm (the firm is the Data Fiduciary and we are the Data Processor), we cannot delete a firm's client data on a client's instruction alone. We pass the request to the firm, help the firm act on it, and follow up.

2. How to make a request

In the platform (fastest). A firm Owner can:

delete a single document version — Document vault › open the file › Delete;
permanently purge an activity and its files — Activities › open › Purge (Owner only, audit-logged);
deactivate or delete a client record — Clients › open › Deactivate or Delete;
record and complete a data-principal request — Settings › Data-principal requests (Access, Correction, Erasure, Withdraw consent, Grievance);
set how long completed work is kept — Settings › Retention (default 90 days after completion);
close the whole workspace — write to us as below.

By email. Send your request to [grievance email] with:

the subject line "Data deletion request";
your name and the email or WhatsApp number the data relates to;
the name of the CA firm you deal with (if you are a client);
what you want deleted — everything, or specific documents or records.

Do not send copies of ID documents or passwords. We may ask you to confirm the request from the email address or WhatsApp number already on record, so that we do not delete someone's data on a stranger's word.

3. How long it takes

| Step | Time | | --- | --- | | We acknowledge the request | Within 48 hours | | We pass a client request to the CA firm and tell you we have | Within 3 working days | | Deletion completed (or a written explanation of what must be kept and why) | Within 30 days, and in every case within the 90 days allowed for grievance redressal under the DPDP Rules | | Removal from encrypted backups | On the normal backup expiry cycle, within [35] days |

Backups are not opened to remove single records — that would risk the integrity of every other firm's data. Deleted data stays only in encrypted backups until those expire, is not used for anything, and is not restored to live systems.

4. What is deleted

When a deletion request is completed, the following are securely erased from live systems:

uploaded documents and every stored version of them, including WhatsApp-received files;
OCR text and document analysis results;
checklist items, activity notes, attachments and exports;
the client record: name, WhatsApp number, email, PAN, GSTIN, bank account last four digits;
magic links (which immediately stop working);
WhatsApp message payloads and recipient numbers for that client;
for a workspace closure: all of the above for every client, plus staff user accounts, API tokens and WhatsApp connection credentials.

Files are deleted from object storage, not merely hidden, and the deletion itself is recorded in the audit trail (the record of the deletion contains no personal data beyond an internal identifier).

5. What we must keep, and for how long

Indian law requires some records to survive a deletion request. Section 12(3) of the DPDP Act allows a Data Fiduciary to retain personal data where it is necessary for compliance with any law in force. We keep only the minimum, we do not use it for anything else, and it stays protected exactly as other data is.

| What we keep | Why | How long | | --- | --- | --- | | Tax invoices, credit notes and the accounts ledger (firm legal name, GSTIN, address, amounts, invoice numbers) | GST and income-tax law; a tax invoice cannot be deleted on request | As the CGST Act requires (72 months from the due date of the annual return) and the Companies Act, 2013 requires for books of account (8 financial years) | | Payment records and gateway references | Payment, accounting and audit obligations; chargeback and refund evidence | Same as above | | Consent and consent-withdrawal records | Proof that processing was lawful and that withdrawal was honoured, as the DPDP Act requires | Life of the firm's account plus the limitation period | | Security and access logs, and the tamper-evident audit trail | CERT-In directions on log retention, and fraud and misuse investigation | At least 180 days, as the CERT-In directions require | | Data under a legal hold, or needed for a live dispute, investigation or court or regulator order | Legal obligation; deleting it could be an offence | Until the hold, case or order ends | | Records of the deletion request itself (who asked, when, what was done) | To show we honoured the request | 3 years | | Encrypted backups | Disaster recovery | Until normal expiry, within [35] days |

Where a record must survive, we remove or mask everything not needed for the legal purpose. For example, an invoice keeps the firm's legal name, GSTIN and amount, but an erased client's name, phone number and documents do not appear in it.

What this means for a client of a CA firm: your CA firm may also have to keep some of your records — working papers, audit files and records required by the Income-tax Act, the Companies Act or ICAI guidance. That decision is the firm's, and the firm will explain it to you. Tosure will not delete data the firm tells us it must retain by law.

6. Closing a workspace

When a CA firm ends its subscription or asks us to close its workspace:

The Owner can export data for 30 days after termination.
We then delete or irreversibly anonymise the firm's data within 60 days, except the records in section 5.
We confirm the deletion in writing if asked.
WhatsApp: the firm should disconnect the WhatsApp Business Account in the platform (Owner › WhatsApp › Disconnect). That revokes Tosure's access token and removes the webhook subscription. Message history held by Meta is governed by Meta's own policies; the firm can manage or delete it in WhatsApp Manager / Meta Business settings.
Deletion cannot be undone. Export first.

7. Withdrawing consent instead of deleting

A client can withdraw consent without asking for deletion. After withdrawal the firm can no longer send WhatsApp requests or collect new files, and the platform blocks both automatically. Records already collected stay until the firm's retention period ends or the client asks for erasure.

8. Automatic deletion, even without a request

Completed work is deleted automatically after the firm's retention period (default: 90 days after completion).
Exports expire and are purged automatically.
Magic links expire and can be revoked at any time.
Ephemeral data (login challenges, idempotency keys, cache entries) is pruned on a schedule.

9. If you are not satisfied

Write to our Grievance Officer at [grievance email]. If the CA firm or we do not resolve your grievance within 90 days, you may complain to the Data Protection Board of India under the DPDP Act, 2023.

10. Governing law

This policy is governed by the laws of India and forms part of our Terms of Service — arbitration seated at Mumbai, with the courts at Mumbai, Maharashtra having exclusive jurisdiction. It does not limit any right a data principal has under the DPDP Act, 2023, including the right to complain to the Data Protection Board of India.

11. Contact

Bhujbal Daily Solutions Private Limited B-11/14, Siddhivinayak Society, M G Complex, Sector 14, Vashi, Navi Mumbai, Maharashtra – 400703, India Grievance Officer: [Grievance Officer name] · [grievance email] · [phone]

Questions about this document? Write to grievance@tosure.in.