Privacy Policy
What we collect, why we collect it, how long we keep it, and the rights you can exercise.
Effective date: 1 August 2026
This policy explains how Khata World (a tax and compliance consultancy firm, “we”, “us”) handles personal data collected through khataworld.in and in the course of providing tax and compliance services.
It is written to meet our obligations under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Rules made under it, the Information Technology Act, 2000 together with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
Under the DPDP Act we are the Data Fiduciary and you are the Data Principal.
1. Data we collect
1.1 When you submit the enquiry form
These are the only fields the website itself collects. The form will not submit unless you tick the consent box beside it.
| Field | Required | Why we need it |
|---|---|---|
| Full name | Yes | To address you correctly |
| Email address | Yes | To send the acknowledgement and reply |
| Mobile number (with country code) | Yes | To call or message you about your enquiry |
| State and district | Yes | To route you to the right jurisdiction and adviser |
| PIN code | No | Optional; helps identify the assessing jurisdiction |
| Service of interest | Yes | To assign the enquiry to the right team |
| Your message | Yes | To understand what you need |
We do not ask for your PAN, Aadhaar, bank details, passwords or any financial document through this website. If any page or message appears to request these, it is not from us — please report it to grievance@khataworld.in.
1.2 When you engage us for a service
Once you become a client, we collect what is necessary to perform the engagement — typically PAN, Aadhaar (only where a statute requires it), Form 16 or salary statements, bank statements, GST credentials, invoices and books of account. This is collected directly from you over agreed channels, not through this website, and is governed by your engagement letter in addition to this policy.
Some of this is sensitive personal data or information under Rule 3 of the SPDI Rules, and we treat it accordingly.
1.3 Collected automatically
- Server logs — IP address, timestamp, page requested, browser and device type. Generated by Vercel Inc., our hosting provider, and retained for 180 days as required by the CERT-In Directions of 28 April 2022.
- Google reCAPTCHA — the enquiry form is protected by reCAPTCHA, which loads only when you focus the message field. Google collects your IP address, device and browser signals, and interaction data, and may set cookies. See the Cookie & Tracking Policy.
- Google Analytics — loaded only if you accept the cookie banner shown on your first visit. Collects aggregate, anonymised traffic data (pages viewed, referring site, device/browser type, IP address truncated by Google before storage). We do not use it for advertising or to identify you individually, and it never loads if you reject or ignore the banner. See the Cookie & Tracking Policy for full detail and how to withdraw consent.
We run no advertising or behavioural-tracking software, and we set no first-party cookies of our own. There is no advertising pixel on this site.
2. Purposes and legal basis
Under Section 4 of the DPDP Act we process personal data only for a lawful purpose for which you have given consent, or for a legitimate use permitted by the Act.
| Purpose | Basis |
|---|---|
| Responding to your enquiry and sending the acknowledgement email | Your consent, given at the form |
| Delivering the tax or compliance service you engaged us for | Performance of the engagement |
| Filing returns and forms with tax authorities on your instructions | Your consent and statutory authorisation |
| Retaining engagement records after the work ends | Compliance with the Income-tax Act, 1961 and the CGST Act, 2017 |
| Protecting the form from automated abuse | Legitimate use — security of our systems |
We do not use your data for automated decision-making that produces legal effects, and we do not sell, rent or trade personal data.
3. Who your data is shared with
We share personal data only as set out below. Each recipient is a Data Processor bound to process data only on our instructions.
| Recipient | What is shared | Where processed |
|---|---|---|
| Vercel Inc. (website hosting) | IP address and request metadata for every page you visit (server logs) | Outside India — see section 4 |
| Supabase (database hosting) | Your enquiry form submission | Outside India — see section 4 |
| Google LLC (reCAPTCHA) | IP address, device and interaction signals | Outside India |
| Google LLC (Analytics) — only if you accept the cookie banner | Aggregate, anonymised traffic data — see the Cookie & Tracking Policy | Outside India |
| Google LLC (Gmail, for sending mail) | The enquiry contents, in the notification and acknowledgement emails | Outside India |
| Groq, Inc. (AI assistant) | Only what you type into the chat window | United States — see section 4 |
| Income Tax Department, GSTN, MCA and other authorities | Only what the relevant return or form requires, on your instructions | India |
We may also disclose data where compelled by law, a court order, or a lawful demand from a government agency under Section 91 of the Bharatiya Nagarik Suraksha Sanhita, 2023 or an equivalent power.
4. Transfers outside India
Section 16 of the DPDP Act permits transfer of personal data outside India except to territories the Central Government restricts by notification. Our website host, database host, email provider, reCAPTCHA and AI assistant process data outside India as set out above.
About the AI assistant: messages you type into the chat widget are sent to Groq, Inc. in the United States to generate a reply. We do not store the conversation on our servers; it exists only in your browser for that session. Please do not enter your PAN, Aadhaar, bank details or any document contents into the chat.
5. How long we keep it
Section 8(7) of the DPDP Act requires us to erase personal data once the purpose is no longer being served, unless retention is required by law. Our schedule:
| Category | Retention | Why |
|---|---|---|
| Website enquiry (name, email, mobile, state, district, PIN, message) | 24 months from last contact | Follow-up on the enquiry and resolution of any dispute arising from it |
| Engagement records for filed returns (ITR, GST, TDS) | 8 years from the end of the relevant assessment year | Section 149 of the Income-tax Act, 1961 permits reassessment within this window |
| Books of account and supporting records | 6 years from the end of the relevant financial year | Rule 6F of the Income-tax Rules, 1962; Section 36 of the CGST Act, 2017 (72 months) |
| Server and application logs | 180 days, stored within India | CERT-In Directions dated 28 April 2022 |
| Chat transcripts with our AI assistant | Not retained by us — held only in your browser for the session | No storage purpose; see the Cookie & Tracking Policy |
6. Your rights as a Data Principal
Under Chapter III of the DPDP Act you may:
- Access — obtain a summary of the personal data we hold about you and who it has been shared with (Section 11).
- Correct, complete, update or erase — have inaccurate data fixed or data no longer needed deleted (Section 12).
- Withdraw consent — as easily as you gave it. We will stop processing on that basis, though this does not affect processing already carried out, or records we must keep by law (Section 6(4)–(6)).
- Grievance redressal — raise a complaint with us before approaching the Data Protection Board (Section 13).
- Nominate — name someone to exercise your rights in the event of your death or incapacity (Section 14).
To exercise any of these, email privacy@khataworld.in from the address you gave us. We respond within 30 days. If you are not satisfied, our Grievance Redressal page sets out the next steps, including your right to complain to the Data Protection Board of India.
Section 15 of the Act places duties on you too — in particular, not to furnish false particulars or impersonate another person when exercising these rights.
7. Children
Our services are intended for people aged 18 and over. Section 9 of the DPDP Act requires verifiable parental consent before processing a child's personal data and prohibits behavioural advertising directed at children. We do not knowingly collect data from anyone under 18. If you believe we have, write to privacy@khataworld.in and we will erase it.
8. Security
We apply reasonable security safeguards as required by Section 8(5) of the DPDP Act and Rule 8 of the SPDI Rules. Details of the specific controls, our breach-notification process and our incident-reporting posture under the CERT-In Directions are set out on the Security & Data Retention page.
If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal as required by Section 8(6) of the DPDP Act.
9. Changes to this policy
We may update this policy as our services or the law change. The effective date at the top always reflects the current version. Where a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.
10. Contact
Data protection queries: privacy@khataworld.in
Grievances: grievance@khataworld.in
Post: Khata World, Muzaffarpur, Bihar 842001, India