Privacy Policy
Your data privacy, statutory compliance, and client confidentiality are our highest priorities.
1. Introduction
Yuvaasoft Technologies Pvt. Ltd. ("Yuvaasoft", "we", "us", "our") operates AuditDesk, a practice management platform for CA offices and auditor firms in India. We take privacy seriously. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over your data.
This Policy applies to:
- • Subscribers - CA firm owners and administrators who hold an AuditDesk account
- • Staff Users - employees or team members added by the subscriber
- • Client Portal Users - end clients who access documents through AuditDesk
- • Visitors to the AuditDesk website
This Policy is governed by:
- • India's Digital Personal Data Protection Act 2023 (DPDP Act)
- • The European Union's General Data Protection Regulation (GDPR), where applicable
- • Indian Information Technology Act 2000 and IT (Amendment) Act 2008
2. Who We Are (Data Controller / Data Fiduciary)
| Company Name | Yuvaasoft Technologies Pvt. Ltd. |
| Location | Coimbatore, Tamil Nadu, India |
| info@gofauditdesk.com |
Under the GDPR, Yuvaasoft acts as a Data Controller for the personal data of EU-based users. For Indian users, Yuvaasoft is a Data Fiduciary under the DPDP Act 2023.
3. What Data We Collect
3.1 Account Registration Data
• Name, email address, phone number
• CA firm name and firm registration number (if applicable)
• GST number (for billing and compliance purposes)
• Office address
3.2 Subscription and Billing Data
• Plan type and billing cycle
• Bank transaction reference numbers (no card data is ever stored)
• Invoice history
3.3 Platform Usage Data
• Login timestamps, IP addresses, and device type
• Actions performed within the platform (document uploads, client creation, etc.)
• Session duration and frequency
3.4 Client Data (entered by the subscriber)
• Client names, contact information, and GST numbers
• Client documents (PDFs) uploaded by the subscriber
• Financial records and correspondence stored on the platform
3.5 Communications Data
• Support queries sent via chat, email, or form
• Demo booking information
• Feedback submitted through the platform
3.6 Cookies and Technical Data
Session cookies and functional cookies as described in our Cookie Policy. We do not use advertising or tracking cookies.
4. Legal Basis for Processing (GDPR - EU/EEA Users)
For users in the European Union or European Economic Area, we process personal data on the following legal bases:
| Legal Basis | Application |
|---|---|
| Contract Performance (Art. 6(1)(b)) | Processing necessary to deliver the subscription service and all platform features. |
| Legal Obligation (Art. 6(1)(c)) | Processing required for GST compliance and Indian tax regulations. |
| Legitimate Interests (Art. 6(1)(f)) | Security monitoring, fraud prevention, and service improvement using anonymised aggregate data. |
| Consent (Art. 6(1)(a)) | Marketing communications, where applicable. Opt-in only. You may withdraw consent at any time. |
5. How We Use Your Data
- • To deliver and operate the AuditDesk platform and all its features
- • To manage your subscription, billing, and account
- • To provide customer support and respond to queries
- • To comply with GST and Indian tax filing obligations
- • To send service notifications, renewal reminders, and product updates
- • To monitor platform security and prevent unauthorised access
- • To improve platform features based on aggregate, anonymised usage data
6. Data Storage and Security
All personal data and client documents are stored on servers located in India (AWS Mumbai region or equivalent Indian cloud infrastructure). No personal data is transferred outside India for primary storage.
Security measures in place:
- ✓ Encryption at rest using AES-256
- ✓ Encryption in transit using TLS 1.2 or higher
- ✓ Access controls limiting staff access to data on a need-to-know basis
- ✓ Regular security audits and vulnerability assessments
- ✓ Automated daily backups with 30-day retention minimum
For GDPR purposes: India is not currently a country with an EU adequacy decision. If you are an EU-based user, data transfers are governed by Standard Contractual Clauses (SCCs) where applicable, or by your explicit informed consent.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account registration data | Duration of active subscription plus 3 years |
| Billing and invoice records | 8 years (Indian GST compliance requirement) |
| CA client documents | 8.5 years minimum (CA professional standard) |
| Platform usage logs | 12 months rolling |
| Support communications | 3 years from date of interaction |
| Session cookies | Expire on browser close |
| Functional cookies | Expire within 12 months |
After the applicable retention period ends, data is securely deleted or irreversibly anonymised.
8. Sharing of Data
We do not sell, rent, or trade personal data. Data is shared only in the following strictly limited circumstances:
- • Cloud infrastructure providers (AWS Mumbai) - under binding data processing agreements, for server hosting purposes only
- • Legal requirement - if compelled by Indian law, a court order, or a regulatory authority with jurisdiction
- • Business transfer - if Yuvaasoft is acquired or merged, subscribers will be notified at least 30 days in advance with the right to request data deletion
9. Your Rights
9.1 Rights Under GDPR (EU/EEA Users)
| Right | What It Covers |
|---|---|
| Right of Access (Art. 15) | Request a copy of the personal data we hold about you. |
| Right to Rectification (Art. 16) | Request correction of inaccurate or incomplete data. |
| Right to Erasure (Art. 17) | Request deletion of your data, subject to our legal retention obligations. |
| Right to Restrict Processing (Art. 18) | Request that we limit how we use your data while a dispute is resolved. |
| Right to Data Portability (Art. 20) | Receive your personal data in a structured, machine-readable format. |
| Right to Object (Art. 21) | Object to processing based on our legitimate interests. |
| Automated Decision-Making (Art. 22) | We do not use automated decision-making that produces legal or similarly significant effects. |
9.2 Rights Under DPDP Act 2023 (Indian Users)
| Right | What It Covers |
|---|---|
| Right to Access (S. 11) | Obtain a summary of personal data processed and the processing activities carried out. |
| Right to Correction and Erasure (S. 12) | Request correction of inaccurate data or erasure where data is no longer necessary for original purpose. |
| Right to Grievance Redressal (S. 13) | Lodge a grievance with our Grievance Officer and receive a response within 30 days. |
| Right to Nominate (S. 14) | Nominate an individual to exercise your data rights on your behalf in case of incapacity or death. |
To exercise any of these rights, contact us at info@gofauditdesk.com. We will respond within 30 days of receiving your request.
10. Children's Data
AuditDesk is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly and notify the account holder.
11. Grievance Officer (DPDP Act 2023)
As required under the Digital Personal Data Protection Act 2023, our Grievance Officer is:
| Name | Sathya Priya |
| Company | Yuvaasoft Technologies Pvt. Ltd. |
| info@gofauditdesk.com | |
| Address | Coimbatore, Tamil Nadu, India |
| Response Time | Within 30 days of receipt of grievance |
12. Changes to This Policy
We will notify subscribers by email at least 14 days before any material change to this Privacy Policy takes effect. The updated policy will be published on the AuditDesk website with a revised Effective Date. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
13. Contact Us
For privacy queries, data access requests, or complaints:
- • Email: info@gofauditdesk.com
- • Address: Yuvaasoft Technologies Pvt. Ltd., Coimbatore, Tamil Nadu, India
EU users also have the right to lodge a complaint with their local data protection supervisory authority.