Data Processing Agreement

The client — the salaried filer whose documents these are — is the Data Principal. They own the data and decide who sees it.

Chitragupt Technologies Pvt Ltd is the Data Fiduciary. We hold the documents and run the platform.

You, the CA, are a Data Processor. You handle client data on their instruction, for the job they hired you for, and for nothing else. This agreement is the Section 8(3) contract the DPDP Act 2023 requires between us.

One purpose only: doing the work in the engagement the client bought — reviewing their tax position, preparing or checking a return, answering a notice, or whatever the listing named.

Specifically, you may not:

• use it to market anything to the client or anyone else
• build a profile, mailing list, or lead list from it
• train a model on it, or paste it into a third-party AI tool
• share it with another CA, an assistant, or a firm colleague unless the client instructs it in writing
• keep working with it after the client revokes access

The client picks the scope when they share: which assessment years, and whether you can read documents, read the computed review, and upload on their behalf. You see exactly that and nothing beyond it. You never see another member of their household unless that member shared with you separately.

Access ends the moment the client revokes the share, or when the engagement closes and they do not extend it. There is no grace period and no read-only tail.

Read and work with client documents inside Chitragupt. Do not download them to personal storage, email them to yourself, or copy them into another system — every one of those puts the data somewhere the client cannot revoke.

Where your own professional or statutory record-keeping genuinely requires a copy, keep only what that obligation requires, keep it encrypted, and delete it when the obligation lapses. You are the controller of that copy and answerable for it.

• Your Chitragupt account is yours alone — no shared logins, no handing credentials to staff.
• Sign out of shared or public machines, and lock your own.
• Do not photograph or screen-record client documents.
• Tell us within 24 hours if you think client data has been exposed — email firodiya.ritesh@gmail.com. Under DPDP Act 2023 we must notify the Data Protection Board and the affected clients, and we cannot do that from what we do not know.

When you open a client's document or their Tax Review, that writes a row to their DPDP audit trail with your name and the timestamp. The client can read that trail at any time from Settings · Privacy & data. This is not surveillance of you — it is the client's statutory right to know who touched their data, and it is what lets us settle a dispute with facts.

Clients can ask for a copy of their data, ask us to correct it, or ask us to erase it. If honouring one of those needs something from you, we will ask and you must respond within 7 days. On an erasure request you delete any copy you hold outside the platform, unless a statutory retention rule requires you to keep it — in which case tell us which rule and for how long.

You may not pass client data to anyone else to process on your behalf — no outsourced data entry, no offshore prep team, no third-party bookkeeping tool. Chitragupt's own sub-processors are listed in the Privacy Policy and all client data stays in the Mumbai region.

This agreement runs for as long as you have access to any client's data through Chitragupt, and the confidentiality and deletion duties in sections 2, 4 and 7 outlive it. Breaching it can end your panel listing immediately under section 8 of the CA Panel Agreement, and a serious breach is reportable to the Data Protection Board and to the ICAI.