Data Protection Policy

1. Purpose

The purpose of this Policy is to define the standards followed by ZNI Ventures Priviate Limited, operating Kosha.Services, for collecting, using, storing, accessing, sharing, retaining, and protecting client data. It supports our obligations under applicable Indian data protection, information technology, tax, accounting, labour, corporate, and contractual requirements.

2. Scope

This Policy applies to personal data, business records, confidential information, and compliance documents received from prospects, clients, client employees, vendors, advisers, or authorized representatives. It covers information processed through our website, email, shared drives, document exchange channels, accounting tools, government portals, support tools, and internal service workflows.

3. Data Covered

• Contact information, company details, and authorized representative details.
• Employee and HR records, including payroll, attendance, leave, appointment letters, exit records, and statutory benefit details.
• Accounting, GST, TDS, income tax, invoice, bank statement, challan, return, and financial records.
• Corporate records such as incorporation documents, board resolutions, registers, agreements, ROC filings, and ownership information.
• Legal, notice, dispute, audit, compliance calendar, or advisory documents shared for review or service delivery.
• Technical logs and communication records needed for security, support, and operational tracking.

4. Data Protection Principles

• Purpose limitation: data is used only for agreed services, communication, support, compliance, security, billing, and lawful business administration.
• Data minimization: we request only information reasonably needed for the relevant service, filing, review, or legal requirement.
• Accuracy: clients are responsible for providing accurate and current records; we may ask for clarifications where records appear incomplete or inconsistent.
• Confidentiality: client records are treated as confidential and accessed only by people or providers with a legitimate service need.
• Retention limitation: records are kept only for operational, statutory, contractual, audit, dispute, and legal periods that reasonably apply.

5. Roles and Responsibilities

For client-provided personal data, the client generally determines the purpose and lawful basis for processing and remains responsible for obtaining required notices, consents, authorizations, and employee or vendor approvals. Kosha.Services processes such data to perform requested services, follow lawful instructions, protect systems, and comply with applicable legal obligations.

6. Security Measures

• Reasonable access controls for systems, files, and client workspaces.
• Restricted internal access based on work requirements and role relevance.
• Use of secure channels and reputable tools where practical for document exchange and storage.
• Administrative safeguards for handling sensitive tax, payroll, financial, and legal records.
• Periodic review of operational practices, vendor access, and data handling workflows.

No security system is completely risk-free. Clients should avoid sharing unnecessary sensitive information and should use appropriate password protection, access permissions, and secure transfer channels for high sensitivity documents.

7. Access Control and Confidentiality

Access to client data is limited to personnel, consultants, advisers, or service providers who need it to perform the relevant work. People handling client data are expected to maintain confidentiality and use the information only for authorized purposes. Where access is no longer required, we aim to remove or restrict access within a reasonable operational period.

8. Sharing with Third Parties and Authorities

We may share relevant data with government portals, statutory authorities, banks, payment providers, auditors, professional advisers, technology vendors, courier or document service providers, and other parties needed to deliver services or comply with law. We do not sell client data. We share only what is reasonably necessary for the specific purpose.

9. Retention and Disposal

Client data is retained for as long as needed for service delivery, statutory recordkeeping, tax and accounting obligations, audits, disputes, legal claims, contractual obligations, and legitimate business administration. When data is no longer required, we may delete, archive, anonymize, or securely dispose of it based on the format, sensitivity, legal requirement, and operational feasibility.

10. Client Responsibilities

• Provide accurate, complete, lawful, and authorized data for service delivery.
• Inform employees, vendors, founders, directors, and other individuals where their data is shared with us.
• Obtain consents, approvals, or authorizations required under applicable law or internal policies.
• Use secure channels for sensitive documents and avoid sending unnecessary special-category or unrelated information.
• Promptly notify us if shared data is incorrect, outdated, unauthorized, or subject to deletion or restriction requests.

11. Data Incident Response

If we become aware of unauthorized access, loss, disclosure, alteration, or misuse of client data, we will take reasonable steps to investigate, contain, remediate, and document the incident. Where required by law or contract, we will notify affected clients or authorities within the applicable timeframe and cooperate on reasonable remediation steps.

12. Requests and Individual Rights

Requests to access, correct, delete, restrict, or obtain a copy of personal data should be submitted through the relevant client organization where the client controls the data. Where a request is made directly to us, we may redirect it to the client or verify authority before acting, subject to applicable law and statutory recordkeeping obligations.

13. Awareness and Review

We review data handling practices periodically and communicate appropriate confidentiality and security expectations to personnel involved in client work. This Policy may be updated as our services, systems, vendors, or legal requirements change.

14. Contact