Privacy policy

1. Scope

This Policy applies to information collected through kosha.services, enquiry forms, consultation requests, email or phone interactions, and documents shared with us for providing compliance services. It does not apply to websites, applications, or services that we do not own or control.

2. Information We Collect

• Contact and enquiry details such as name, work email, phone number, company name, service needs, and messages submitted through our forms.
• Business and compliance information you provide for service delivery, including registration details, employee or payroll information, GST, TDS, income tax, accounting, ROC, legal, and corporate documents.
• Billing and transaction information, including invoices, payment status, tax information, and records needed for accounting and statutory compliance.
• Technical and usage information such as IP address, browser type, device details, referral page, form submission metadata, logs, and website interaction data.
• Communications exchanged with us by email, phone, support channels, or messaging tools.

3. How We Use Information

• To respond to enquiries, schedule consultation calls, and provide proposals.
• To deliver HR, labour, GST, accounting, income tax, TDS, legal, and corporate compliance services.
• To prepare filings, reports, registers, notices, advisory notes, and other service deliverables requested by you.
• To manage billing, accounting, tax records, service administration, and customer support.
• To improve our website, service workflows, forms, communication quality, and operational security.
• To comply with applicable laws, statutory obligations, audits, government requests, and dispute resolution needs.

4. Purposes, Consent and Applicable Law

The enquiry form asks for permission to contact you about the message you submit. It does not enrol you in marketing. You may withdraw that permission or ask us to stop following up through the contact route below.

• Enquiries: we use the contact details and business summary you provide to respond, establish availability and prepare a scope.
• Engagement records: the agreed assignment determines which client, employee or transaction records are needed. Your authority to share another person's information must be established for that purpose.
• Required records: accounting, tax, filing and dispute records may need to be retained or disclosed under the specific law or obligation governing them, even after a request to stop optional contact.
• Website operation: session data protects form submissions and carries their outcome; the third-party tools and their purposes are described below.

Indian legal requirements apply according to the activity and their commencement dates. Under the DPDP Act, consent and the specific uses listed in section 7 are distinct routes; a general business interest is not a substitute for that statutory list. The Act's main processing and rights provisions have phased commencement. See the phase guide and official commencement notification. This policy does not represent all those provisions as already operative.

5. Sharing and Disclosure

We do not sell personal information. We may share information only as needed with our team members, professional advisers, technology vendors, payment or communication providers, government portals, statutory authorities, banks, auditors, or other parties required for lawful service delivery. Where a third party processes information for us, we expect appropriate confidentiality and security safeguards.

6. Website Tools and Your Choices

The website uses the following services. The status shown for optional browser integrations follows this deployment's configuration; submitting the native enquiry form is a separate action.

Enquiry session — Kosha.Services

The form uses a first-party session cookie to protect submissions, retain fields after a validation error and display a submission outcome. It is not an advertising subscription. Blocking this cookie can prevent submission. Avoid using a shared browser for confidential messages.

Enquiry delivery — ZNICRM / Intuerias Technology Private Limited

The form's delivery service receives the submitted name, contact details, optional business name, selected topic and message, together with the submission page and IP address. This lets us receive and follow up on the enquiry. Its API operates on the intueri.io domain. Provider privacy, retention and international-transfer policy.

ZNICRM engagement widget — enabled on this deployment

When enabled, the widget loads from engage.znicrm.com. Loading or using it can share browser and page-interaction information with the provider; information entered in the widget follows its service workflow. You can use the native contact form without interacting with the widget. The provider policy linked above describes its processing.

Google Ads tag — enabled on this deployment

When enabled, the Google tag supports advertising measurement. Google can receive page URLs, IP addresses and browser identifiers and use cookies under its settings and policies. See how Google uses information from partner sites and Google's advertising choices. Turning off personalised ads is not the same as stopping all measurement.

Bootstrap stylesheet — jsDelivr

The browser requests the pinned Bootstrap stylesheet from jsDelivr. That request shares network information needed to deliver the file; it does not submit the contact form's fields.

You can block or clear third-party cookies using your browser and manage Google advertising preferences through the linked control. Those actions do not erase an enquiry already submitted to us. This website does not describe optional tags as anonymous or as blocked until consent. Provider retention and overseas processing depend on the relevant service and settings; our retention criteria for enquiry and engagement records appear below.

7. Sharing Documents Safely

Do not send PAN, Aadhaar, payroll files, bank statements, passwords or confidential documents through the public enquiry form. Once the scope is agreed, we confirm the document list, approved sharing channel and intended recipients before asking for records.

Access should be limited to the people working on the assignment, with permissions removed when that access is no longer needed. If a request arrives through an unfamiliar address or channel, verify it with your established engagement contact before sending records. No channel can guarantee absolute security; report a suspected disclosure through the contact route below.

8. Retention and Disposal

Retention depends on the record and the purpose for keeping it, rather than one period for all information.

• Enquiries and follow-up: retained while the request, proposed engagement or related issue is being handled. You may ask us to close the enquiry and delete information no longer needed.
• Engagement working records: retained for delivery, handover and the applicable contractual, professional or dispute requirements.
• Invoices, tax and statutory records: retained for the period required by the law applicable to the record. A deletion request does not override that requirement.
• Website and provider records: session and operational records support form operation and security. Provider-held records also depend on the provider's retention arrangements described in its linked policy.

Archiving is continued retention, not deletion. An archived record must still have a documented legal or business reason for being kept and restricted access. When retention is no longer justified, the appropriate outcome is deletion or irreversible anonymisation, not moving the same identifiable record to an archive indefinitely. A request can ask which category and retention reason apply to your information.

9. Requests About Your Information

You can ask us to explain our use of your information, correct it, stop enquiry follow-up, provide a copy or consider deletion. These are request options under this policy; the existence, scope and timing of a statutory right depend on the applicable law and its commencement. We do not present every request option as a currently operative DPDP right.

Use the contact form, your established engagement contact, or the postal address below. Describe the request and the original enquiry or engagement without attaching identity documents to the initial message. We may need to verify identity or authority through an agreed channel. Required retention, another person's rights or a client-controlled record may limit what can be provided or deleted; the response should explain the applicable reason and next step.

10. Data Transfers

Information may be stored or processed in India or in other locations where our service providers operate. When cross-border processing occurs, we use reasonable safeguards appropriate to the nature of the data and applicable law.

11. Children

Our services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children through this website. If you believe a child has provided information to us, please contact us so we can review and delete it where required.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or operational practices. The latest version will be posted on this page with an updated effective date.

13. Contact