DPDP Act, 2023

Intime IT Services Private Limited is a Data Fiduciary under the Act for the personal data it collects through TaxMedha. We are not currently notified as a “Significant Data Fiduciary” under Section 10; if that status applies in future, we will update this page with the additional obligations it carries (a Data Protection Officer, periodic data protection impact assessments, and independent data audits).

Before we process your personal data for a purpose that requires consent, we give you a clear notice describing what data is collected and why, in plain language, at or before the point we ask for it — for example, at sign-up. You can withdraw consent at any time as easily as you gave it; see Privacy Policy for how.

Only the data required to answer a query, run a computation, or operate a feature is processed. Client personal data inside uploaded documents is never used to train AI models.

Core data is hosted in India (AWS Mumbai, ap-south-1), encrypted at rest and in transit, with role-based access control and MFA/SSO available for firm accounts. Some AI-assisted features send the relevant query/document content to processors located outside India as part of generating a response — see Privacy Policy’s “AI processing & sub-processors” and “Cross-border data transfer” sections for exactly which providers and why.

You can exercise the following rights at any time by contacting us (see below):

• Access a summary of the personal data we hold about you;
• Correct or update inaccurate or incomplete data;
• Request erasure, subject to statutory retention minimums (e.g. audit-log and financial-record retention);
• Withdraw consent for a specific processing activity;
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

Firms can additionally request export or deletion of their organization's data; deletion requests are honoured subject to statutory retention requirements on audit logs.

Raise a complaint about how we've handled your personal data with our Grievance Officer, Sandip Tanti (IT Admin), at [email protected]. We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you remain unsatisfied, you may complain to the Data Protection Board of India, the adjudicating body established under the Act.