Data protection policy

1. Purpose

The purpose of this Policy is to define the standards followed by ZNI Ventures Private Limited, operating Kosha.Services, for collecting, using, storing, accessing, sharing, retaining, and protecting client data. It supports our obligations under applicable Indian data protection, information technology, tax, accounting, labour, corporate, and contractual requirements.

2. Scope

This Policy applies to personal data, business records, confidential information, and compliance documents received from prospects, clients, client employees, vendors, advisers, or authorised representatives. It covers information processed through our website, email, shared drives, document exchange channels, accounting tools, government portals, support tools, and internal service workflows.

3. Data Covered

• Contact information, company details, and authorised representative details.
• Employee and HR records, including payroll, attendance, leave, appointment letters, exit records, and statutory benefit details.
• Accounting, GST, TDS, income tax, invoice, bank statement, challan, return, and financial records.
• Corporate records such as incorporation documents, board resolutions, registers, agreements, ROC filings, and ownership information.
• Legal, notice, dispute, audit, compliance calendar, or advisory documents shared for review or service delivery.
• Technical logs and communication records needed for security, support, and operational tracking.

4. Data Protection Principles

• Purpose limitation: data is used only for agreed services, communication, support, compliance, security, billing, and lawful business administration.
• Data minimisation: we request only information reasonably needed for the relevant service, filing, review, or legal requirement.
• Accuracy: clients are responsible for providing accurate and current records; we may ask for clarifications where records appear incomplete or inconsistent.
• Confidentiality: client records are treated as confidential and accessed only by people or providers with a legitimate service need.
• Retention limitation: records are kept only for operational, statutory, contractual, audit, dispute, and legal periods that reasonably apply.

5. Roles and Responsibilities

For work performed on a client's instructions, the engagement identifies the purpose, records, permitted recipients and each party's responsibilities. The client must establish its authority to share employee, customer or vendor information. A contract label alone does not decide every data-protection role.

Kosha.Services separately determines the purposes of its own enquiry handling, billing and required business records. The privacy policy explains those uses and distinguishes our request process from legal rights whose operation depends on applicable law and commencement dates.

6. Document Exchange and Security

Keep sensitive records out of the public enquiry form. Before records are requested for an engagement, agree the document list, approved sharing channel, named recipients and the person responsible for permissions. Use restricted sharing rather than publicly accessible links.

• Share only the records and fields needed for the agreed work.
• Confirm the recipient and assignment before granting access or sending a file.
• Set appropriate access permissions and use password protection where the agreed method requires it; communicate a file password separately.
• Record who controls the shared location and who will revoke access at handover or when a role changes.
• Verify an unexpected request through the established engagement contact and report suspected disclosure promptly.

No method is completely risk-free. These handling requirements do not represent a certification of every client's system or every third-party provider. Website form delivery and browser tools are identified in the privacy policy.

7. Access Control and Confidentiality

Client records are for the personnel and providers who need them for the agreed assignment. Identify the access owner and recipients in the document-sharing arrangements; do not use a shared folder as a reason to give every participant access to unrelated records.

At handover or a change of personnel, the access owner must review the recipient list and remove permissions no longer required. Ending access does not by itself delete a copy already retained for a justified recordkeeping purpose; retained copies remain subject to the retention and confidentiality requirements below.

8. Sharing with Third Parties and Authorities

We may share relevant data with government portals, statutory authorities, banks, payment providers, auditors, professional advisers, technology vendors, courier or document service providers, and other parties needed to deliver services or comply with law. We do not sell client data. We share only what is reasonably necessary for the specific purpose.

9. Retention and Disposal

Distinguish active working records from records retained for a statutory, contractual, professional or dispute requirement. The engagement should identify the handover records, custodian and any continuing retention reason. The privacy policy explains the categories used for enquiries, engagement files and statutory records.

Archiving remains retention and requires a reason, restricted access and a review point. When that reason ends, delete the identifiable information or irreversibly anonymise it, subject to any applicable legal hold. A disposal decision must account for working copies and provider-held copies, rather than assuming that removing a shared link removes every copy.

10. Client Responsibilities

• Provide accurate, complete, lawful, and authorised data for service delivery.
• Inform employees, vendors, founders, directors, and other individuals where their data is shared with us.
• Obtain consents, approvals, or authorisations required under applicable law or internal policies.
• Use secure channels for sensitive documents and avoid sending unnecessary health, identity, payroll or other unrelated personal information.
• Promptly notify us if shared data is incorrect, outdated, unauthorised, or subject to deletion or restriction requests.

11. Data Incident Response

If we become aware of unauthorised access, loss, disclosure, alteration, or misuse of client data, we will take reasonable steps to investigate, contain, remediate, and document the incident. Where required by law or contract, we will notify affected clients or authorities within the applicable timeframe and cooperate on reasonable remediation steps.

12. Requests About Client Records

If your employer or another client supplied the record, identify that organisation when making a request. We may need to refer a decision to the organisation that controls the relevant processing, while dealing with any separate records for which we are responsible.

You can request an explanation, correction, a copy or deletion through the contact form, your established engagement contact or the postal address below. These request options do not imply that every right under every privacy law applies. Identity, authority, statutory retention and the operative law determine the response; see the privacy request process.

13. Awareness and Review

We review data handling practices periodically and communicate appropriate confidentiality and security expectations to personnel involved in client work. This Policy may be updated as our services, systems, vendors, or legal requirements change.

14. Contact