1. Who we are
YSHJ & Co. LLP is a firm of Chartered Accountants. We are a limited liability partnership and our registered office is at Shop no. 4, Yamnotri Building, Ovaripada, Dahisar East, Mumbai 400068. In this policy we call ourselves the Firm, or we.
Under the Digital Personal Data Protection Act, 2023, which we call the DPDP Act, the Firm is the Data Fiduciary for the personal data described here. This policy covers this website and anything that follows from it.
2. What we collect
If you write to us through a form on this website, we get your name, your telephone number, your email address, your company if you give one, your message and the time of day you would prefer a call.
If you become a client, we get whatever the work needs: financial, tax and statutory records, as set out in the engagement letter you sign.
We do not measure you. This website sets no analytics cookies, no advertising cookies and nothing that follows you anywhere. It remembers only what you chose on the cookie banner, and it keeps a session for someone at the Firm who signs in to the Administration area, noting the browser, the system and its version, the kind of device and a phone's model, as the browser reports them, and each internet address the session is used from, so that a sign-in they did not make can be spotted. For two-step verification it keeps the key of an authenticator app; for each passkey its public half, which password manager or device made it, whether it is synced, and when and from which address it was last used; and for each recovery code, kept only in a form that cannot be read back, when and from which address it was used. A fingerprint, a face or a screen lock never leaves the device. Your internet address is used for a moment when you send an enquiry, to stop the form being abused, and it is not saved with what you wrote. If we ever add measurement of any kind, we will rewrite this policy first and set nothing until you have accepted it.
We do not knowingly collect anything about children under 18.
3. Why we collect it
To read your enquiry and put you in touch with the partner who should answer it. To agree, carry out and keep a record of professional work. To meet the duties the law and our profession put on us, which include the Chartered Accountants Act, 1949, the Code of Ethics and the Standards of the Institute of Chartered Accountants of India, the Income-tax Act, 1961, the Companies Act, 2013, the Goods and Services Tax Acts and the Prevention of Money-laundering Act, 2002. To keep our professional records and check our own work. And, if it ever comes to it, to defend the Firm's legal position.
4. What allows us to use it
For an enquiry, your consent, which you give by ticking the box on the form. That is Section 6 of the DPDP Act.
For client work, your consent, and in places the law itself: where you have given us something for a stated purpose, or where we have to process it to comply with a statute, that is a legitimate use under Section 7.
If the General Data Protection Regulation of the European Union or the United Kingdom applies to you, our grounds are your consent, the performance of our contract with you, our legal obligations, and our legitimate interest in running a professional practice.
5. Who else sees it
We do not sell personal data, and we never will.
We share it with regulators, courts and statutory authorities when the law or our professional duty requires it. We share it with the companies that host this website, our email and our documents, each of them bound by contract to keep it confidential and secure. We share it with our insurers, our lawyers and our peer reviewers where that is necessary. And if the practice ever passes to someone else, the records pass with it.
6. Data that leaves India
Some of the companies that hold data for us keep it on servers outside India. We only use countries the Central Government has not restricted under Section 16 of the DPDP Act, and the contracts require them to protect it.
If you are in the European Economic Area, the United Kingdom, or anywhere else with rules about transfers, we rely on standard contractual clauses or the equivalent that your law requires.
7. How long we keep it
An enquiry that leads nowhere is deleted 24 months after we receive it.
Client records and working papers we keep for as long as the law and our professional standards require, which is normally at least seven years from the date of the report, and then we destroy them securely.
A record of your consent is kept for as long as we hold the data it relates to.
8. What you can ask us for
Sections 11 to 14 of the DPDP Act give you the right to ask us for a summary of what we hold about you and what we do with it; to have it corrected, completed, brought up to date or erased; to withdraw your consent, which takes effect from the moment you withdraw it; to name someone to exercise your rights if you die or cannot act for yourself; and to have a complaint dealt with.
If the GDPR or the UK GDPR protects you, you can also ask us to restrict what we do with your data, to hand it over in a portable form, or to stop altogether, and you can complain to your own supervisory authority.
To ask for any of this, write to the Grievance Officer named below. We answer within the time the law allows.
9. Keeping it safe
We take the precautions the sensitivity of the data calls for: access is restricted, transmission is encrypted, client records are stored securely, and everyone who works with the Firm is under a duty of confidence.
If there is a breach, we tell the Data Protection Board of India and the people affected, in the manner the law prescribes.
10. Grievance Officer
Grievance Officer: Yanus Shukla, Partner. Email: yanus.shukla@yshj.co.in. Post: Shop no. 4, Yamnotri Building, Ovaripada, Dahisar East, Mumbai 400068.
If our answer does not satisfy you, you can take the matter to the Data Protection Board of India under Section 13 of the DPDP Act.
11. Changes to this policy
We will change this policy from time to time. The date at the top of the page is the date of the version you are reading. If you keep using the website after a change, you accept the version then published.