STATUTORY PRIVACY GOVERNANCE

Privacy Policy & Data Protection Covenant

Last Updated & Effective: September 2026 · Compliant with the Digital Personal Data Protection (DPDP) Act 2023 & Information Technology Act 2000

1. Legal Entity & Scope

This Privacy Policy governs the collection, processing, encryption, and protection of corporate and personal financial data by M/s SS Enterprise (GSTIN: 10CZUPA0656B1ZX), headquartered at Khagaul Anisabad Road, Phulwari Sharif, Patna, Bihar – 800002, operating the cloud ERP platform akcount.in.

2. 100% Indian Data Sovereignty & Residency

All tenant databases, financial ledgers, invoice archives, and audit trails are maintained on secure enterprise cloud server infrastructure physically located within the Republic of India. Cryptographic boundaries guarantee that your double-entry accounting ledgers and GST records remain within Indian territorial jurisdiction, protected against unauthorized cross-border mirroring.

3. Cryptographic Security Standards

All financial data at rest is encrypted with military-grade AES-256 GCM encryption. All data in transit utilizes TLS 1.3. Cryptographic isolation prevents cross-tenant access, and strict role-based access control (RBAC) ensures only authorized enterprise operators can decrypt ledger records.

4. Statutory Retention (MCA & Section 44AA)

In compliance with Section 128 of the Companies Act 2013 and Section 44AA of the Income Tax Act 1961, books of account, audit logs, and supporting vouchers are maintained for a mandatory minimum statutory retention period of 8 preceding financial years with continuous immutable timestamp verification.

5. Zero Third-Party Commercial Monetization

Akcount.in and M/s SS Enterprise maintain a strict fiduciary standard: we do NOT sell, lease, monetize, or share your financial records, invoice items, pricing, margins, or counterparty ledgers with any advertisers, financial brokers, or third parties.

6. Data Principal Statutory Rights (Sections 11–14, DPDP Act 2023)

In strict compliance with Chapter III of the Digital Personal Data Protection Act 2023, every registered individual and enterprise representative (Data Principal) possesses the following sovereign, legally enforceable statutory rights regarding their personal and corporate data:

(a) Right to Access Information (Section 11, DPDP Act):

You have the right to request a complete summary of digital personal data being processed by akcount.in, a description of processing activities undertaken, and the identities of all authorized third-party Data Processors or Fiduciaries (such as banking aggregators or government filing gateways) with whom data has been shared.

(b) Right to Correction & Completion (Section 12(1)(a), DPDP Act):

You are entitled to request immediate correction of inaccurate, obsolete, or misleading personal data, and to complete any incomplete customer, vendor, or ledger profile records directly through the ERP dashboard or by submitting a rectification request.

(c) Right to Erasure / Right to be Forgotten (Section 12(1)(b), DPDP Act):

You possess the right to demand permanent erasure of personal data that is no longer necessary for the commercial purpose for which it was collected. Statutory Non-Derogable Exception: In accordance with Section 128 of the Companies Act 2013, Section 44AA of the Income Tax Act 1961, and GST audit rules, financial vouchers, audit trails, and tax invoices filed with authorities must be retained for the statutory 8-year period and cannot be purged prematurely.

(d) Right of Grievance Redressal & DPBI Escalation (Section 13, DPDP Act):

You have the right to a dedicated, easily accessible grievance redressal mechanism managed by our Data Protection Officer. All grievances receive formal acknowledgement within 24 hours and final resolution within 15 calendar days. Under Section 13(3), if your grievance is not resolved to your satisfaction within 15 days, you have the statutory right to escalate your complaint directly to the Data Protection Board of India (DPBI).

(e) Right to Nominate (Section 14, DPDP Act):

Every Data Principal has the right to nominate an individual through the platform security settings who shall, in the event of death or legal incapacity of the Data Principal, exercise all rights of the Data Principal in accordance with DPDP regulations.

(f) Right to Withdraw Consent (Section 6(4), DPDP Act):

Where processing is based on consent, you may withdraw your consent at any time via your account settings as smoothly as it was provided. Upon withdrawal, non-statutory data processing will cease immediately.

7. Protocol for Exercising Statutory Rights

To exercise any statutory rights under Sections 11 through 14 of the DPDP Act 2023, please transmit an authenticated communication to [email protected] with the subject line "DPDP Statutory Rights Request" or submit an escalation via our Support & Grievance Redressal Desk. In accordance with statutory guidelines, zero administrative fees are charged for statutory rights requests.

Grievance & Data Protection Officer

For DPDP inquiries or data rectification requests: Email: [email protected] · Desk: +91 6203699390 · Main Office: Khagaul Anisabad Rd, Phulwari Sharif, Patna, Bihar – 800002.