Privacy Policy

This Privacy Policy describes how Vext Audit Capital, a division of SkyDasher Tech LLP ("the Firm", "we", "us"), collects, uses, stores, discloses, and protects personal data. It applies to all visitors of vextaudit.com, clients engaging our professional services, and subscribers of our VextIntel intelligence digest.

1. Identity and contact details

Data Fiduciary: SkyDasher Tech LLP, trading as Vext Audit Capital
Registered in: Tamil Nadu, India (serving clients globally)
Grievance Officer and Data Protection Contact: support@vextaudit.com
Website: vextaudit.com

2. Consent

Under the Digital Personal Data Protection Act 2023, consent must be free, specific, informed, unconditional, and unambiguous. The Firm collects consent as follows:

• Website contact form: By submitting the contact form, you confirm that you have read this Privacy Policy and consent to the Firm contacting you in relation to your enquiry. A consent checkbox is presented on the form prior to submission.
• VextIntel subscription form: By subscribing to VextIntel, you provide explicit consent to receive the VextIntel regulatory digest and related communications. A consent checkbox is presented on the subscription form prior to submission, with a direct link to this policy.
• Engagement onboarding: Clients provide consent to data processing through execution of the engagement letter, which incorporates this Privacy Policy and the Data Policy by reference.

Consent records, including timestamp, IP address, and the version of this policy shown at the time of consent, are stored in the Firm's subscriber and client records. You may withdraw consent at any time by contacting support@vextaudit.com. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

3. Personal data we collect

3.1 Data you provide directly

• Name, email address, phone number, designation, and company name, via contact forms, enquiry submissions, and engagement onboarding
• Business records, financial documents, transaction data, and compliance materials shared during audit engagements
• Correspondence by email, phone, or video call
• Payment information processed through Razorpay. The Firm does not store card numbers, UPI VPAs, or banking credentials at any time

3.2 Data collected automatically

• IP address (anonymised for analytics), browser type, device type, and operating system
• Pages visited, time spent, and referral source, collected via Google Analytics with IP anonymisation enabled
• Cookies and similar tracking technologies: see our Cookies Policy

4. Purposes and legal basis for processing

• Delivery of professional services: Legal basis: Contract. Necessary to perform the engagement letter or SOW.
• Client communication: Legal basis: Contract and legitimate interest.
• VextIntel digest and marketing: Legal basis: Consent (explicit opt-in). Withdrawable at any time.
• Invoicing and payment: Legal basis: Contract and legal obligation.
• Legal and regulatory compliance: Legal basis: Legal obligation under applicable laws including Indian tax, audit, and company laws, and equivalent obligations in the jurisdictions of international clients.
• Website analytics: Legal basis: Legitimate interest (anonymised data only).
• Security and fraud prevention: Legal basis: Legitimate interest and legal obligation.

5. Disclosure of personal data

The Firm does not sell, rent, or trade personal data. Disclosure is limited to:

• Service providers bound by data processing agreements: Google Workspace, Razorpay, Vercel, Make.com, Google Analytics
• Legal obligation: Court order, statutory authority, or regulatory body under Indian law
• Professional obligation: ICAI standards, regulatory inquiry, or peer review
• Consent: With your explicit written consent for any other purpose

All client data shared during an audit engagement is subject to professional confidentiality and is never disclosed to any third party without written client consent, except as required by law.

6. International data transfers

Primary operations are based in India and data is stored within India where possible. Service providers including Google and Razorpay may process data outside India. Where such transfers occur, adequate safeguards are in place through data processing agreements and the providers' compliance with applicable data protection laws including standard contractual clauses.

7. Data retention

• Client engagement records and audit work papers: Minimum 8 years from engagement completion (ICAI and Income Tax Act requirement)
• Client correspondence: 3 years from date of last engagement
• Payment records: 8 years (RBI and Income Tax Act requirement)
• Newsletter subscriber data: Until unsubscribe, then deleted within 30 days
• Website analytics: 26 months (Google Analytics default)

Important: interaction between retention and erasure rights: The right to erasure does not apply to data that the Firm is required to retain by applicable law, including but not limited to the Income Tax Act 1961, ICAI professional standards, the GST Act 2017, and the LLP Act 2008. Where an erasure request is received for legally retained data, the Firm will confirm in writing the legal basis for continued retention and will restrict processing of that data to the minimum necessary for the retention obligation only.

8. Your rights under the DPDP Act 2023

• Right to access: Summary of personal data processed and how it has been used
• Right to correction: Correction of inaccurate or incomplete personal data
• Right to erasure: Deletion of personal data no longer necessary, subject to legal retention obligations as described in Section 7 above
• Right to withdraw consent: For any processing based on consent, without affecting prior lawful processing
• Right to grievance redressal: Lodge a complaint with the Firm. If unresolved within 30 days, escalate to the Data Protection Board of India (Indian clients) or the relevant data protection authority in your jurisdiction (international clients).
• Right to nominate: Nominate an individual to exercise these rights on your behalf

To exercise any right, write to support@vextaudit.com with the subject line "Data Rights Request: [Your Name]". We will acknowledge within 2 Business Hours and respond with a decision within 7 Business Days. Where a request is refused, we will provide written reasons and information on how to escalate to the relevant data protection authority in your jurisdiction.

9. Children's data

Services are directed exclusively at businesses and professionals. The Firm does not knowingly collect data from individuals under 18. If such data is discovered, it will be deleted immediately and the relevant Data Fiduciary will be notified.

10. Amendment procedure

For new visitors and new engagements: changes take effect on the effective date shown at the top of this policy. For existing clients and active VextIntel subscribers: material changes take effect 30 days after written notice by email. "Material change" means any change that reduces your rights, expands the purposes for which data is used, or adds new categories of data collection. Non-material changes (such as clarifications, corrections, or additions that expand your rights) take effect immediately.

11. Contact and grievance officer