Privacy Policy

1.1          Srutio is a sole proprietorship, and the Explanation to section 43A of the Information Technology Act, 2000 defines a body corporate to include a sole proprietorship engaged in commercial or professional activities. Srutio therefore follows section 43A and the Information Technology Rules, 2011 on reasonable security practices and sensitive personal data, which apply today. This Policy is the privacy policy that Rule 4 of those Rules requires.

1.2          The Digital Personal Data Protection Act, 2023 became law in 2023, and the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Most duties of a Data Fiduciary begin 18 months after that date, on 13 May 2027. Srutio applies the notice, consent, security and rights standards of the Act and the Rules now, and this Policy is written to serve as the notice that section 5 of the Act describes. The Act omits section 43A when the provision that says so comes into force.

1.3          In this Policy, Data Principal means the person to whom personal data relates, and Data Fiduciary means the person who decides why and how personal data is processed. You are the Data Principal and Srutio is the Data Fiduciary.

2.1          Srutio handles the following personal data, for the purposes and for the periods shown.

Your name, email address, chosen topic and the content of your message

• How Srutio receives it: You type it into the contact form or send it by email
• Purpose: To read and reply to your message and to keep a record of the exchange
• How long it is kept: The form entry is deleted 365 days after it is sent. Email correspondence is deleted 12 months after the last message

A record that you ticked the agreement box, and the date and time of the submission

• How Srutio receives it: Recorded by the form when you send it
• Purpose: To show that you agreed to the use of your details
• How long it is kept: Same period as the form entry

Technical details sent with a form entry: IP address, browser and device details, and the page you sent it from

• How Srutio receives it: Your browser sends them automatically
• Purpose: To prevent abuse and to investigate misuse of the form
• How long it is kept: Same period as the form entry

Server and security logs: IP address, browser and device details, pages requested, dates and times

• How Srutio receives it: Your browser sends them automatically when you visit any page
• Purpose: To run the site, keep it secure and find and stop misuse
• How long it is kept: One year

Your cookie choice

• How Srutio receives it: Stored in your browser when you make a choice on the cookie banner
• Purpose: To remember your choice
• How long it is kept: Up to 365 days, or until you clear your browser storage

Records of grievances, data requests and withdrawals of consent

• How Srutio receives it: You send them to Srutio, and Srutio records how it dealt with them
• Purpose: To show how each matter was handled and to defend legal claims
• How long it is kept: Three years after the matter is closed

Business records, if you later engage Srutio: identity and contact details, GST details, invoices and correspondence

• How Srutio receives it: You provide them when an engagement is agreed
• Purpose: To perform the engagement and to meet tax and accounting law
• How long it is kept: Until 72 months after the due date of the annual GST return for the year, and for longer if an appeal or an investigation needs it

2.2          The IP address and browser details listed under technical details sent with a form entry are recorded by the form plugin together with each entry.

2.3          Srutio does not sell personal data and does not use it for marketing, advertising or profiling. Srutio does not send newsletters or promotional email through this site.

3.1          At the date of the last update, the site has no user accounts, no comments, no payment page and no analytics or advertising tools. It does not knowingly ask for sensitive personal data such as passwords, financial account details, health information or biometric data, and it takes no decision about you by automated means.

3.2          If Srutio adds a tool that changes this, for example an analytics service or a checkout provider, Srutio updates this Policy and the Cookie Policy before the tool goes live and names the provider.

4.1          Srutio handles personal data for these purposes:

• to read and answer your messages
• to decide whether and how to work with you and, if an engagement follows, to carry it out
• to keep the records that tax and accounting law require
• to run and secure the site
• to establish, exercise or defend legal claims

4.2          The basis for handling the details in your message is your consent, which you give by ticking the box beside the form. The basis for server and security logs is the set of security safeguards and logs that the law requires, and your browser sends that data when it asks for a page. The basis for tax and accounting records is the law that requires them. Srutio uses personal data only for the purposes above.

5.1          Consent on this site is given by a clear action. The agreement box beside the form is never ticked in advance, and the form cannot be sent until you tick it.

5.2          You may withdraw consent at any time by writing to contact@srutio.com with the subject line Withdraw consent. Withdrawal is as easy as consent was to give. Once you withdraw, Srutio stops using the personal data that rested on your consent and deletes it, except where the law requires Srutio to keep it. Withdrawal does not affect what was done before you withdrew, and it may mean that Srutio can no longer continue a conversation with you.

6.1          Srutio shares personal data only with the following, and only as far as each needs it:

• service providers that act on Srutio’s instructions to host the site, deliver email, store backups and protect the site against attack
• professional advisers, such as accountants and lawyers, who are bound by duties of confidentiality
• a court, a tribunal, a regulator or a law enforcement agency, where the law or a lawful order requires it
• a successor to Srutio’s business, including a company that takes over the business on a change of legal form, on the condition that the successor keeps to this Policy

6.2          Srutio does not sell, rent or trade personal data to anyone.

8.1          Retention periods are shown in the list in section 2. When a period ends, Srutio deletes the data or removes anything that identifies you.

8.2          Deleted data may remain in a backup copy until that copy is overwritten in the normal rotation of backups. It is not restored or used for any other purpose in the meantime.

8.3          Srutio may keep data for longer where a legal claim is pending or reasonably expected, or where the law requires it, and only for as long as that need lasts.

9.1          You have the right to:

• obtain a summary of the personal data Srutio holds about you and of how it is used
• know the identities of the other parties with whom Srutio has shared your personal data, and what was shared
• have inaccurate data corrected, incomplete data completed and out-of-date data updated
• have your personal data erased, unless the law requires Srutio to keep it
• withdraw your consent at any time, as section 5 describes
• have a grievance dealt with, as section 12 describes
• nominate another person to exercise these rights for you if you die or become unable to do so

9.2          To use a right, write to contact@srutio.com with the subject line Data request and say which right you wish to use. Srutio may ask for reasonable information to confirm who you are before it acts, so that nobody else can obtain or change your data. There is no charge for a request. Srutio answers within one month, or within any longer period that the law allows, and it says why if it needs longer.

9.3          Srutio may refuse a request, in whole or in part, where the law requires or allows it, and Srutio says why when it does.

9.4          From the date its provisions take effect, the Digital Personal Data Protection Act, 2023 also places duties on you as a Data Principal. They include giving information that is accurate, not impersonating another person, and not filing a false or frivolous complaint.

9.5          This Policy is available in English on this page. You may ask Srutio for it in any language listed in the Eighth Schedule to the Constitution of India, and Srutio will give it to you in that language.

10.1        Srutio protects personal data with reasonable security safeguards. These include an encrypted connection to the site, a firewall and malware scanning, two-factor authentication on the administration account, regular updates of the site software, regular backups, and limits on who can reach the data.

10.2        No method of storage or transmission is completely secure, and Srutio cannot promise that personal data will never be accessed without authority. That fact does not reduce the duty of Srutio to keep reasonable safeguards, and it does not limit any right you have to compensation. Please do not send sensitive information through the site or by email.

10.3        If a personal data breach affects you, Srutio tells you without delay, and tells the Data Protection Board of India without delay and again with detail within 72 hours. Srutio reports the cyber incidents that the CERT-In Directions of 28 April 2022 list to CERT-In within six hours.