Your data, your consent

Required · about your own data (§ 6 · Data Principal)

• Store your identity · name, work email, phone, ICAI membership number

  To verify against the public ICAI register, route matches to you, and pay you out. Encrypted at rest. Retained while you are on the panel, plus 7 years post-resignation (ICAI recordkeeping).

• Store your KYC scans · PAN, Aadhaar (last-4 only), ICAI Certificate of Practice

  For identity match and manual KYC review. Encrypted. Never displayed to clients — only your verification status is shown on the marketplace.

• Display your public profile on the marketplace

  Name, firm, declared specialisations, ★ rating, response window. You control per-field visibility from Settings · Public profile.

• Send operational emails · match requests, client replies, payout confirmations, disputes

  Required to operate the panel. No marketing while on the panel. You can't opt out of these while your panel membership is active.

These four are required because the panel cannot function without them. Read the full Privacy Policy and the CA Panel Agreement.

Required · handling client data (§ 8(3) · Data Processor)

• Read-only access to engaged clients' Tax Review and Inbox

  Only for the duration of the engagement. You cannot write into a client's ledger or modify their parsed tax data. Your deliverables (filed ITR-V acknowledgement, written advice, notice replies) are your own work product.

• Retention limits on client data you've seen

  Platform access revoked within 24 hours of engagement closure. Any locally cached copies (downloads, PDFs) you may hold must be wiped within 30 days.

• Breach notification within 72 hours

  If a local copy of client data is exposed, lost, or stolen, you notify Chitragupt's DPO within 72 hours so we can meet our § 8(6) reporting duty to the Data Protection Board.

• ICAI Code of Ethics applies to every engagement

  Independence, confidentiality, professional skepticism, fee transparency. Breach of the Code is grounds for panel removal in addition to ICAI sanction.

These are the Data Processor terms required under DPDP Act 2023 § 8(3). Read the full Data Processing Agreement.