Privacy Policy — Nikita Goel & Associates

Effective date: 1 January 2025 · Last updated: 1 May 2025

This Privacy Policy explains how Nikita Goel & Associates ("NGA", "we", "us", "our") — a partnership firm of Chartered Accountants registered with the Institute of Chartered Accountants of India (ICAI) and operating from 224, 2nd Floor, Star Tower, Sector 30, NH-48, Gurugram — 122002, Haryana, India — collects, uses, stores, and protects the personal data of individuals who interact with us through this website (ngaca.net) or in the course of an engagement.

NGA is the Data Fiduciary in respect of personal data collected through this website, as defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). By submitting personal data to us, you ("the Data Principal") may exercise certain rights described in this Policy.

1. What personal data we collect

We collect only the minimum personal data required for the purpose for which it is shared. The categories of personal data we may collect include:

Contact data — name, phone number, email address, and any message text you choose to share when you fill the contact form on this website or correspond with us by phone, email, or WhatsApp.
Engagement data — additional details you provide as part of an active engagement, such as identity documents (PAN, Aadhaar, passport), financial records, tax filings, and statutory data necessary to deliver our professional services.
Technical data — limited technical information collected automatically by our hosting provider when you visit the website (such as IP address, browser type, and pages visited), used only for security and to maintain site availability.

2. Purposes for which we use your data

We process personal data only for specific, lawful purposes, including:

To respond to your inquiry submitted through the contact form, email, or phone;
To deliver Chartered Accountancy services under an engagement letter (audit, tax filing, FEMA filings, advisory, etc.);
To comply with our statutory and regulatory obligations as Chartered Accountants under the Chartered Accountants Act, 1949, the Income-tax Act, 1961, the GST laws, the Companies Act, 2013, and the Foreign Exchange Management Act, 1999;
To maintain professional records as required by ICAI and applicable Indian laws;
To respond to court orders, regulatory inquiries, or other lawful demands;
To secure and maintain the website.

We do not use your personal data for marketing or promotional purposes without your separate, explicit consent.

3. Legal basis — consent and legitimate use

Personal data is processed on the basis of your consent, freely given through clear affirmative action (such as ticking the consent checkbox on our contact form), or for the legitimate purposes specified under Section 7 of the DPDP Act, including delivery of services you have requested and compliance with our legal obligations.

4. Sharing with third parties

We do not sell, rent, or trade your personal data. We may share personal data only with:

Government authorities — Income Tax Department, GSTN, MCA, RBI, ICAI, and other statutory bodies, where required as part of filings and regulatory compliance authorised by you under an engagement;
Service providers — limited technical providers (such as our website host, email provider, and accounting software) who process data only on our instructions and under appropriate confidentiality obligations;
Where compelled by law — pursuant to a valid order, summons, or directive from a court, tribunal, or regulatory authority.

5. Cross-border transfers

Personal data is generally stored in India. Where our service providers (such as cloud-hosted email and form-handling tools) store data outside India, we ensure such transfers are to jurisdictions and providers that maintain reasonable security standards and otherwise comply with applicable Indian law.

6. Data retention

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law:

Contact-form inquiries — retained for up to 24 months from receipt, after which they are deleted unless an engagement has commenced.
Engagement records — retained for the duration of the engagement plus the period mandated by ICAI guidelines and applicable tax / corporate law (typically 8 years from the end of the relevant financial year).
Statutory records — retained for the period prescribed by the relevant statute.

7. Security

We maintain reasonable technical and organisational security measures appropriate to the sensitivity of the data — including access controls, encrypted communications, secured storage, and confidentiality obligations on personnel. While no system is fully impervious, we make every reasonable effort to protect data in our custody.

8. Your rights as a Data Principal

Under the DPDP Act, you have the following rights with respect to your personal data:

Right to access a summary of the personal data we hold about you and how it is being processed;
Right to correction of inaccurate or incomplete data;
Right to erasure of personal data once the purpose has been served (subject to statutory retention obligations);
Right to withdraw consent at any time, as easily as it was given;
Right to grievance redressal in respect of any concern about how your data is handled;
Right to nominate another individual to exercise your rights in the event of your death or incapacity.

9. Withdrawal of consent

You may withdraw your consent at any time by writing to info@ngaca.net. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal, and does not relieve us of our statutory obligations to retain certain records under tax and ICAI rules.

10. Grievance officer

If you have any concern, query, or complaint regarding the processing of your personal data, please contact our Grievance Officer at:

Email: info@ngaca.net
Address: Grievance Officer, Nikita Goel & Associates, 224, 2nd Floor, Star Tower, Sector 30, NH-48, Gurugram — 122002, Haryana, India
Phone: +91 88266 84532

We will acknowledge your communication within seven (7) working days and aim to respond substantively within thirty (30) days. If you are not satisfied with our response, you may approach the Data Protection Board of India established under the DPDP Act.

11. Cookies and tracking

This website uses minimal cookies — limited to functional cookies required for the site to operate (such as session identifiers used by our form provider for spam protection). We do not use third-party advertising or behavioural-tracking cookies.

12. Children's data

Our services are not directed to children. We do not knowingly collect personal data of any individual under 18 years of age. If you believe such data has been collected, please contact us so we may remove it.

13. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. The "Last updated" date at the top of this page indicates the date of the most recent change. We encourage you to review this Policy periodically.

14. Contact

For any questions about this Privacy Policy or our handling of personal data, please write to info@ngaca.net.