Privacy Policy

Quick answer: This policy explains how Virtual Auditor Private Limited collects, uses, and protects personal data in compliance with the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000. It details the categories of data collected, the purpose of processing, the lawful basis for handling information, and the company's consent mechanisms.

Privacy Policy

What is Privacy Policy — Virtual Auditor Private Limited?

Virtual Auditor Private Limited ("Company", "we", "us", or "our") is committed to protecting the privacy and personal data of every client, website visitor, and stakeholder. This Privacy Policy explains how we collect, use, store, share, and protect personal information provided through our website (virtualauditor.in), mobile applications, email communications, and professional service engagements.

We comply with applicable Indian data protection laws including the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Information We Collect

1.1 Personal Information You Provide

When you engage our services or contact us, we may collect: full name, email address, phone number, postal address, PAN, Aadhaar (where legally required), GSTIN, CIN/LLPIN, bank account details, financial statements, tax returns, incorporation documents, share certificates, ESOP grant letters, FEMA filings, and any other information necessary for the specific service you have requested.

1.2 Information Collected Automatically

When you visit our website, we automatically collect: IP address, browser type and version, operating system, referring URL, pages visited, time spent on pages, click patterns, and device identifiers. We use cookies and similar tracking technologies for analytics and improving user experience.

1.3 Service-Specific Data Collection

Depending on the service engaged, we may collect additional data as follows:

• Company Registration (Pvt Ltd, LLP, OPC, Section 8, Indian Subsidiary): Director KYC details, DIN, DSC information, MOA/AOA drafts, registered office proof, shareholder details, foreign investment details for FDI reporting, SPICe+ application data.
• Valuation Services (Startup, ESOP, FEMA, 409A, IBC, Companies Act, Income Tax Act): Financial statements (audited and projected), cap tables, SHA/SSA terms, revenue models, comparable company data, DCF assumptions, Monte Carlo simulation parameters, ESOP grant details, Black-Scholes inputs, IBC resolution plans, and complex instrument term sheets.
• GST Services (Registration, Returns, Appeals, LUT, Cancellation, SCN Reply): GSTIN, GST returns (GSTR-1, 3B, 9, 9C), e-way bills, ITC ledgers, show cause notices (DRC-01), appeal orders, reconciliation statements, HSN/SAC classifications, and anti-profiteering data.
• Income Tax Services (ITR Filing, Appeals, Notices, Transfer Pricing): ITR forms, Form 26AS/AIS, TDS certificates, assessment orders, appeal submissions (Form 35/36), transfer pricing documentation, Master File, Local File, CbCR data, APA applications, and advance ruling petitions.
• FEMA Compliance (FDI, ODI, ECB, LRS, Compounding): FC-GPR filings, FC-TRS forms, ECB-2 returns, ODI declarations, LRS transaction details, AD bank correspondence, RBI compounding applications, foreign shareholding patterns, and FDI compliance checklists.
• Forensic Accounting and Due Diligence: Bank statements, vendor invoices, general ledger extracts, journal entries, employee records, email communications (with consent), Benford's Law analysis data, and digital evidence for fraud investigations.
• Trademark and IP Services (Registration, Objection, Renewal, Copyright, Patent): Trademark application details, brand logos, class specifications, proprietor information, power of attorney, evidence of prior use, copyright work descriptions, and patent claims.
• Company Secretary Services (Annual Filing, Board Meetings, Share Transfer, Name Change, Registered Office Change): Board resolution drafts, annual return data (MGT-7/7A), financial statement filings (AOC-4), director appointment/resignation forms (DIR-11/DIR-12), share transfer deeds (SH-4), and charge registration documents (CHG-1).
• Virtual CFO Services: Monthly financial data, MIS reports, cash flow statements, budget variance analysis, investor reporting data, board meeting presentations, and KPI dashboards.
• Startup Advisory (DPIIT Recognition, Startup India, Funding Advisory, Due Diligence): Pitch decks, business plans, DPIIT recognition documents, incubator certificates, funding round details, convertible note/SAFE terms, and angel tax exemption applications.
• Digital Signature Certificate (DSC Class 3): Identity proof, address proof, PAN card, passport-size photograph, organisation proof for organisation DSC, and video verification data.
• Compliance Registrations (MSME/Udyam, FSSAI, Import-Export Code, ESI, EPF, Professional Tax, Shop Act): Business registration documents, industry classification data, food business details, import-export transaction records, employee wage registers, and establishment details.
• Financial Modelling and Advisory: Revenue projections, cost structures, unit economics, customer acquisition data, churn rates, and market sizing data.

2. How We Use Your Information

We use the collected information for: providing the requested professional services; preparing statutory filings, valuation reports, tax returns, compliance certificates, and legal documents; communicating with you about engagement status, deliverables, and deadlines; verifying identity as required under KYC/AML regulations; issuing invoices and processing payments; complying with regulatory requirements of ICAI, ICSI, IBBI, MCA, CBDT, CBIC, RBI, SEBI, and other statutory authorities; improving our services and website functionality; sending relevant updates about regulatory changes affecting your business (with your consent); and conducting internal quality reviews and professional development.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information with: government and regulatory authorities (MCA, CBDT, CBIC, RBI, SEBI, IBBI, Registrar of Companies, GST Network, DPIIT, DGFT, EPFO, ESIC) as required for statutory filings; authorised representatives and sub-registrars for document execution; payment gateway providers for secure transaction processing; cloud service providers for data storage (with appropriate data processing agreements); professional indemnity insurers in case of claims; and law enforcement agencies when required by law or court order.

All third-party service providers are bound by confidentiality agreements and are required to implement appropriate security measures.

4. Data Retention

We retain client data for the following periods: engagement working papers — 8 years from the completion of the engagement (as per ICAI guidelines); valuation reports and supporting documents — 5 years from the date of the report (IBBI requirements); tax-related documents — 8 assessment years from the relevant assessment year; GST records — 6 years from the due date of annual return for the relevant year; FEMA compliance records — as required by RBI circulars and AD bank requirements; company secretarial records — as required under the Companies Act, 2013; trademark records — duration of registration plus 2 years; forensic investigation records — 10 years or as directed by investigating authority.

After the retention period, data is securely deleted or anonymised.

5. Data Security

We implement industry-standard security measures including: 256-bit SSL/TLS encryption for all data transmission; encrypted file storage with access controls; multi-factor authentication for internal systems; regular security audits and vulnerability assessments; role-based access control ensuring data is accessible only to assigned engagement teams; secure document sharing portals with link expiry and password protection; regular staff training on data protection and confidentiality obligations; and incident response procedures for data breach notification.

6. Your Rights Under DPDPA 2023

Under the Digital Personal Data Protection Act, 2023 and applicable laws, you have the right to: access your personal data held by us; correct or update inaccurate information; withdraw consent for non-essential data processing; request erasure of personal data (subject to statutory retention requirements); receive a copy of your data in a commonly used format; nominate a person to exercise your rights in case of death or incapacity; and lodge a complaint with the Data Protection Board of India.

To exercise any of these rights, email us at support@virtualauditor.in with the subject line "Data Rights Request". We will respond within 72 hours.

7. Cookies Policy

Our website uses: essential cookies (required for website functionality and security); analytics cookies (Google Analytics — to understand visitor behaviour and improve services); preference cookies (to remember your language and display settings); and marketing cookies (to show relevant service information). You can manage cookie preferences through your browser settings. Disabling essential cookies may affect website functionality.

8. Third-Party Links

Our website contains links to third-party websites including MCA portal, CBDT e-filing portal, GST portal, RBI website, IBBI portal, DPIIT Startup India portal, DGFT portal, IPO India (trademark registry), and other government resources. We are not responsible for the privacy practices of these external sites and recommend reviewing their respective privacy policies.

9. Children's Privacy

Our services are designed for businesses, professionals, and individuals above 18 years of age. We do not knowingly collect information from individuals under 18 years of age. If we become aware that we have collected data from a minor, we will delete it promptly.

10. Cross-Border Data Transfers

For services involving international clients (NRI advisory, 409A valuations, cross-border FEMA compliance), data may be processed across jurisdictions in compliance with applicable data protection laws and contractual safeguards.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or regulatory guidance. The updated policy will be posted on this page with a revised "Last Updated" date. Material changes will be communicated via email to active clients.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and DPDPA 2023, the Grievance Officer for data protection matters is:

CA V. Viswanathan, FCA, ACS, CFE, IBBI RV

Virtual Auditor Private Limited

G-131, Ground Floor, Phase 3, Spencer Plaza Mall, Anna Salai, Chennai

Email: support@virtualauditor.in | Phone: +91 99622 60333

Grievances will be acknowledged within 48 hours and resolved within 30 days.

13. Contact Us

For any questions about this Privacy Policy, contact us at:

Chennai (HQ): G-131, Ground Floor, Phase 3, Spencer Plaza Mall, Anna Salai, Chennai | +91 99622 60333

Bangalore: 7th Floor, Mahalakshmi Chambers, 29, MG Road, Bangalore | +91 95139 39333

Mumbai: Workafella, AK Estate, SV Road, Goregaon West, Mumbai | +91 77000 89597

Email: support@virtualauditor.in

What has changed in the law — reviewed October 2026

• Income-tax Act, 2025: assented to on 21 August 2025 and in force from 1 April 2026, it replaces the Income-tax Act, 1961 for tax year 2026-27 onward, and the Income-tax Rules, 2026 (notified 20 March 2026) replace the 1962 Rules. Section and rule numbers on this page are those of the 1961 Act and 1962 Rules, which continue to govern assessments, appeals and pending proceedings for assessment years up to 2026-27; for tax year 2026-27 onward the corresponding provisions of the 2025 Act apply, and our engagement letters quote both.