splanly is committed to full compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act). This page outlines how we meet our obligations as a Data Fiduciary and how we protect the rights of Data Principals (our users).
1. Data Fiduciary SkilledCA Enterprises
Under the DPDP Act, SkilledCA Enterprises is the Data Fiduciary — the entity that determines the purpose and means of processing personal data. We are responsible for ensuring that personal data is processed in accordance with the Act.
| Detail | Information |
|---|---|
| Entity Name | SkilledCA Enterprises |
| Platform | splanly — Staffing & Resource Planning for CA Firms |
| Nature of Business | SaaS platform for professional services firms |
| Jurisdiction | India |
| Contact | samarth@skilledca.in |
2. Purpose of Data Processing
We process personal data only for specific, lawful purposes. As a Data Fiduciary, we ensure that every data processing activity has a clear legal basis:
| Purpose | Legal Basis | Data Types |
|---|---|---|
| Service delivery & account management | Consent & Contractual necessity | Name, email, firm details |
| Authentication & security | Consent & Legitimate interest | Email, encrypted passwords |
| Communication & notifications | Consent | Email address |
| Analytics & platform improvement | Consent | Anonymized usage data |
| Legal & regulatory compliance | Legal obligation | As required by law |
We do not process personal data for purposes beyond what is necessary for the functioning of the splanly platform.
3. Consent Management
In accordance with Section 6 of the DPDP Act, we obtain free, specific, informed, unconditional, and unambiguous consent from Data Principals before processing their personal data.
- At Registration — Consent is obtained explicitly when users create an account, with clear disclosure of what data is collected and why.
- Granular Control — Users can manage their consent preferences through their account settings.
- Withdrawal of Consent — Data Principals may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Upon withdrawal, we will cease processing the relevant data within a reasonable period.
- Consent for Minors — splanly is designed for professional use and is not intended for individuals under 18. We do not knowingly collect data from children or minors. If we become aware that a minor's data has been collected, we will delete it promptly.
4. Data Principal Rights
Under the DPDP Act, Data Principals (users) have the following rights. We provide mechanisms to exercise each of these rights:
Right to Access Information
You have the right to obtain a summary of the personal data we process about you and the purposes for which it is processed. To request this, contact us at samarth@skilledca.in.
Right to Correction & Erasure
You may request correction of inaccurate or incomplete personal data. You may also request erasure of your personal data, subject to any legal retention obligations we may have. We will process correction or erasure requests within 30 days.
Right to Grievance Redressal
If you believe your data protection rights have been violated, you have the right to file a grievance with our designated Grievance Officer (see Section 8 below). We will acknowledge your grievance within 48 hours and resolve it within 30 days.
Right to Nominate
In the event of your death or incapacity, you have the right to nominate another individual to exercise your data protection rights on your behalf. You can set a nominee through your account settings.
5. Data Retention Policy
We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law:
| Data Category | Retention Period | After Expiry |
|---|---|---|
| Account & identity data | Duration of subscription + 90 days | Permanently deleted |
| Firm & engagement data | Duration of subscription + 90 days | Permanently deleted |
| Usage & analytics data | 24 months (anonymized) | Anonymized data retained indefinitely |
| Authentication logs | 12 months | Permanently deleted |
| Support communications | 12 months after resolution | Permanently deleted |
Upon account deletion, all personal data is erased within 30 days, except where retention is mandated by law (e.g., tax or regulatory requirements in India).
6. Data Security Safeguards
As required under Section 8(5) of the DPDP Act, we implement reasonable security safeguards to protect personal data:
- Encryption — All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
- Access Controls — Role-based access ensures that only authorized individuals can access personal data. Multi-factor authentication is supported.
- Infrastructure Security — Our hosting provider (Render) and database provider (Supabase) maintain SOC 2 and ISO 27001 compliance.
- Audit Logging — Access to personal data is logged for accountability and audit purposes.
- Incident Response — We maintain a data breach response plan. In the event of a breach, we will notify affected Data Principals and the Data Protection Board of India as required by the Act.
7. Cross-Border Data Transfers
splanly's primary data storage and processing infrastructure is located in India and jurisdictions approved by the Central Government under the DPDP Act.
If data is transferred to or processed in jurisdictions outside India (for example, through third-party service providers such as cloud hosting or analytics), we ensure that:
- The transfer is to a jurisdiction approved by the Central Government, or
- Appropriate contractual and technical safeguards are in place to protect the data to a standard equivalent to the DPDP Act.
We continuously monitor government notifications regarding restricted jurisdictions and update our practices accordingly.
8. Grievance Officer
In compliance with the DPDP Act, we have designated a Grievance Officer to address complaints and concerns related to personal data processing:
Grievance Officer
SkilledCA Enterprises
Email: samarth@skilledca.in
Response Timeline:
Acknowledgement: Within 48 hours
Resolution: Within 30 days of receipt
If you are not satisfied with the resolution provided by our Grievance Officer, you have the right to file a complaint with the Data Protection Board of India as established under the DPDP Act.
9. Changes to This Policy
We may update this DPDP compliance page to reflect changes in our practices, legal requirements, or regulatory guidance. Material changes will be communicated via email or in-app notification at least 15 days before taking effect.
10. Related Policies
For additional details, please refer to:
- Privacy Policy — Comprehensive information on data collection, use, and sharing.
- Cookie Policy — Details on cookies and tracking technologies used.
- Terms of Service — General terms governing use of splanly.