How personal data is handled, and your rights under the DPDP Act.

Privacy Policy

Effective date: 19 September 2026 · Version 1.0

This policy explains how Bhujbal Daily Solutions Private Limited (CIN U72900MH2019PTC330201, registered office B-11/14, Siddhivinayak Society, M G Complex, Sector 14, Vashi, Navi Mumbai, Maharashtra – 400703, India) — operating the Tosure platform at tosure.in — handles personal data. It is written to meet the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (notified in November 2025, with obligations phasing in over 18 months), and the Information Technology Act, 2000 and rules made under it.

If you are a client of a CA firm and received an upload link or a WhatsApp message, please read section 3: your CA firm decides what is collected, and Tosure only handles it for them.

1. Two different roles

| Whose data | Who decides how it is used | What we are | | --- | --- | --- | | Firm account data (owners, staff, billing details, invoices, support messages) | Tosure | Data Fiduciary | | Client data a firm uploads or collects (client names, WhatsApp numbers, PAN, GSTIN, bank account last four digits, documents, consent records) | The CA firm | Data Processor acting for the firm |

For client data, the CA firm is the Data Fiduciary. Requests about that data are answered by the firm; we assist the firm and do not use the data for our own purposes.

2. What we collect from a CA firm

• Account and workspace: firm name, ICAI firm registration number, email, phone, address, GSTIN, users' names, emails, roles, passwords (stored only as salted hashes) and two-step verification settings.
• Billing: plan, subscription and invoice history, GST details, payment reference IDs from Razorpay, message wallet balances. We never see or store card numbers, UPI PINs or net-banking credentials — those go directly to Razorpay.
• WhatsApp connection: the firm's WhatsApp Business Account ID, phone number ID, display name, quality rating and an encrypted access token and two-step PIN issued by Meta.
• Usage and security logs: sign-in times, IP addresses (stored as a one-way hash), device and browser information, actions taken in the workspace, and a tamper-evident audit trail.
• Support: messages you send us and records of our replies.

3. What a CA firm collects through Tosure about its clients

A firm typically stores: client name, WhatsApp number, email, PAN, GSTIN, the last four digits of a bank account, the documents the client uploads, checklist and status history, consent records, and WhatsApp message status. Sensitive identifiers are encrypted, and the platform keeps a searchable one-way hash instead of the plain value where it can.

We do not sell personal data, we do not use it for advertising, and we do not use client documents to train machine-learning models. Text recognition (OCR) and file checks run inside our systems purely to help the firm review a document.

4. Why we use data and on what basis

| Purpose | Basis | | --- | --- | | Providing the workspace, document collection, reminders and the vault | Performance of the contract with the firm; for client data, the firm's lawful basis including consent | | Sending WhatsApp requests and reminders to a firm's clients | The firm's consent record for the purpose "document collection and compliance" | | Billing, invoicing and tax compliance | Legal obligation and contract | | Security, fraud prevention, audit trail, backups | Legitimate uses under section 7 of the DPDP Act and our legal obligations | | Support and service messages | Contract | | Improving reliability and performance using aggregated, non-identifying statistics | Legitimate uses |

We do not use client documents for marketing, and we do not profile data principals.

5. Who we share data with

We use a small number of processors, each bound by contract and by confidentiality:

| Provider | What they receive | Why | | --- | --- | --- | | Meta Platforms (WhatsApp Business Platform) | The client's WhatsApp number, the template message content (client name, firm name, activity title, checklist summary, due date, upload link) and delivery status. Files a client sends on WhatsApp pass through Meta before reaching the vault. | Delivering messages and receiving replies | | Razorpay Software Private Limited | Firm name, email, payment amount and reference | Collecting subscription and wallet payments | | [Hosting provider] | Encrypted storage and compute for all platform data, hosted in India ([region]) | Running the platform | | [Email provider] | Recipient email address and message content | Password setup, notifications, invoices |

Documents uploaded through the secure client link never pass through Meta. We may also disclose data where a law, court or authorised agency requires it; where lawful, we tell the affected firm first.

6. Where data is stored

Platform data, including client documents, is stored in India. Meta processes WhatsApp messages on its own infrastructure, which is outside India — that is inherent to using WhatsApp, and the firm's consent notice to its clients should say so. We do not otherwise transfer personal data outside India, and we do not transfer it to any country restricted by the Central Government.

7. How long we keep data

• Client documents and activity records: for the retention period the firm sets in its workspace (default: 90 days after the work is completed), after which they are securely deleted. Records under a legal hold are kept until the hold is lifted.
• Consent records and the audit trail: for the life of the account plus the period needed to show compliance.
• Invoices, tax and accounting records: as required by the GST and income-tax laws and the Companies Act, 2013 (generally 8 years).
• Security logs: retained as required under the CERT-In directions.
• After an account closes: 30 days to export, then deletion or irreversible anonymisation within 60 days, apart from the records listed above. Backups expire on their normal cycle.

Even after an erasure request, section 12(3) of the DPDP Act lets us keep what a law in force requires: tax invoices and accounting records, payment records, consent and withdrawal records, security and audit logs, and anything under a legal hold. We keep the minimum needed for that purpose and nothing else. The Data Deletion page sets out each category, the reason and the period.

8. How we protect data

• Encryption in transit (HTTPS) and encryption of sensitive fields and documents at rest.
• Each firm's data is isolated in its own tenant, enforced in the application and in the database.
• Role-based access, two-step verification for administrators, and a tamper-evident audit trail of who did what.
• Malware scanning of every uploaded file, file-type and size limits, and password-protected-PDF detection.
• Private document storage with short-lived download links, never public URLs.
• Least-privilege access for our staff; our administrators can see account and billing information but cannot open a firm's client documents or sign in as a firm user.
• Regular backups, and reviews of access and security settings.

No system is perfectly secure. If a personal data breach occurs, we inform the affected firm without undue delay and support the firm in telling its clients and the Data Protection Board of India as the law requires, and we make our own reports where they apply to us.

9. Rights of data principals

If you are a client of a CA firm, the firm answers your requests. You may ask it to:

• know what personal data it holds about you and who it has been shared with;
• correct, complete or update your data;
• erase data that is no longer needed;
• withdraw consent (after which the firm will stop sending you requests, though it may keep records the law requires it to keep);
• nominate someone to exercise your rights if you die or become incapacitated;
• raise a grievance.

Contact your CA firm first — its details are on the notice you received. If the firm does not respond, write to [grievance email] and we will route your request to the firm and help it respond. Step-by-step instructions, timelines and the list of records the law makes us keep are on the Data Deletion page. Where we are the Data Fiduciary (firm users' own account data), write to us directly. We acknowledge within 48 hours and respond within 90 days, usually much sooner. If you are not satisfied, you may complain to the Data Protection Board of India.

10. Cookies

We use strictly necessary cookies only: a session cookie to keep you signed in and a security token that prevents cross-site request forgery. We do not use advertising or tracking cookies, and we do not embed third-party analytics in the firm workspace or the client upload portal.

11. Children

Tosure is a business tool and is not directed at children. A CA firm must not use the platform to process the personal data of a child (under 18) except where its professional engagement requires it and it has verifiable parental consent as the DPDP Act requires.

12. Changes

We may update this policy. The version and effective date at the top always show the current text, and we give at least 15 days' notice in the platform or by email before a material change takes effect.

13. Governing law

This policy is governed by the laws of India. Disputes are handled as set out in our Terms of Service — arbitration seated at Mumbai, with the courts at Mumbai, Maharashtra having exclusive jurisdiction. Nothing here limits a data principal's right to complain to the Data Protection Board of India.

14. Contact

Bhujbal Daily Solutions Private Limited B-11/14, Siddhivinayak Society, M G Complex, Sector 14, Vashi, Navi Mumbai, Maharashtra – 400703, India Support: [support email]

Grievance Officer / person answering questions about data processing: [Grievance Officer name] Email: [grievance email] · Phone: [phone] Post: B-11/14, Siddhivinayak Society, M G Complex, Sector 14, Vashi, Navi Mumbai, Maharashtra – 400703, India

Data Protection Board of India: if a grievance is not resolved, a data principal may complain to the Board under the DPDP Act, 2023.

Questions about this document? Write to grievance@tosure.in.