Privacy Notice
Last updated 26 September 2026
1. Who we are
SKAG and Associates, Chartered Accountants (“the firm”, “we”), is the data fiduciary for personal data collected through skagandassociates.com. Our address is Kh.No-84, Plot No -RZ-I-1, F/Floor, 12/2, Main Rd, opposite Yammaha Showroom, Mahavir Enclave, New Delhi, Delhi 110045. You can reach us at gaurav@skagandassociates.com or +91 88022 54567.
This notice covers the website and its forms. Information you share during a professional engagement is also covered by the confidentiality rules of the ICAI Code of Ethics (see section 11).
2. What we collect, and why
We collect only what each form needs. You do not have to use any form to read the website.
| Form or feature | Data collected | Purpose |
|---|---|---|
| Contact enquiry form | Name, mobile number, email, area of interest, your message, the page you sent it from, date and time, IP address | To reply to your enquiry and keep a record of it |
| Newsletter and document downloads | Email, name (optional), the document or topic you asked for | To email the document and, if you opted in, occasional general-information updates |
| Compliance due-date reminders | Email, name (optional), the reminder categories you chose | To send the reminders you asked for |
| AI chat assistant | The messages you type, and any name or phone number you choose to share in the chat | To answer your question and, if you ask, to pass your details to the firm for a call back |
| Career and exam application | Name, email, mobile, date of birth, state, ICAI registration number, articleship and training status, education, reference, your answers and test result | To assess your application for articleship or employment |
| Website analytics (only if you accept cookies) | Pages visited, device and browser type, approximate location, collected by Google Analytics | To understand which pages are used and improve the website |
Our web server also keeps short technical logs (IP address, browser, pages requested) to keep the website secure and to stop abuse of the forms.
3. Legal basis: your consent
We process personal data from the website forms on the basis of your consent, which you give by ticking the consent box when you send a form, or by clicking “Accept” for analytics cookies. Consent is specific to the purpose shown on that form. For each consent we keep a short record (what it was for, which form, the date and time, and the version of this notice in force, identified by its “Last updated” date) so that we can show when consent was given or withdrawn. This record holds your email address or phone number only in a scrambled (keyed hash) form. Where a law requires us to keep a record (for example, for professional or tax purposes after an engagement begins), we keep it for that legal purpose.
4. How long we keep it
| Data | Kept for |
|---|---|
| Contact enquiries | 3 years from the enquiry |
| Newsletter and document-download sign-ups | Until you unsubscribe, then deleted within 30 days |
| Compliance reminder sign-ups | Until you unsubscribe, then deleted within 30 days. A sign-up that is not confirmed is deleted after 30 days |
| AI chat transcripts | 90 days. Email addresses, phone numbers and identity numbers (PAN, GSTIN, Aadhaar, date of birth) are masked before a chat is saved |
| Career and exam applications | 1 year after the hiring decision. If no decision is recorded, 1 year after the test (or after the last update to the application, if no test was taken) |
| Records of consent given or withdrawn (email and phone held only as a keyed hash) | While we hold your other data, then 3 years after it is deleted. If you ask us to erase your data, these records are made anonymous and can no longer be linked to you |
| Unsubscribe list (email held only as a keyed hash) | Kept indefinitely, so that no further update emails are sent to an address that has unsubscribed |
| Email delivery records (masked email address only) | 1 year |
| Admin audit log (record IDs and a hashed IP address only) | 1 year |
| Analytics data (Google Analytics) | As set in Google Analytics, and not collected at all unless you accept |
After these periods the data is deleted automatically, unless a law requires us to keep it longer. Backup copies of the website data are replaced on a rolling basis, so data deleted from the website is also gone from the backups within 8 weeks. If you become a client, engagement records are kept for the periods required by law and professional standards.
5. Who we share it with
We do not sell or rent personal data, and we do not share it for marketing. It is shared only with service providers who process it for us:
- Email and hosting providers, which store the website and deliver our emails.
- An AI provider: messages you type into the AI chat assistant are sent to an AI provider so that it can generate a reply. Please do not type confidential financial details, passwords or identity numbers into the chat.
- Google Analytics, only if you accept analytics cookies.
- Government authorities or courts, only where the law requires it.
Some of these providers may store data outside India, as permitted under the DPDP Act.
6. Cookies and analytics
Google Analytics is not loaded and sets no cookies until you click “Accept” on the cookie banner. If you click “Reject”, it is not loaded at all. We remember your choice for 12 months in your browser (a first-party cookie named skag_consent and browser storage), so the banner does not appear on every page. The website does not use advertising trackers.
You can change your choice at any time: open cookie settings. The same link is in the footer of every page.
The website also loads Google Fonts and shows a Google Maps embed on the contact page. These services receive your IP address when they load, under Google’s own privacy policy.
7. Your rights
Under the DPDP Act, 2023 you have the right to:
- Access: ask for a summary of the personal data we hold about you and how it is used.
- Correction: ask us to correct, complete or update inaccurate data.
- Erasure: ask us to delete your data when it is no longer needed for the purpose you gave it for, unless a law requires us to keep it.
- Grievance redressal: complain to us about how your data is handled (see section 9).
- Nominate: name another person who can use these rights for you in the event of your death or incapacity.
To use any of these rights, email gaurav@skagandassociates.com with the subject “Personal data request”. We may ask you to confirm your identity before acting on the request.
8. How to withdraw consent
You can withdraw consent at any time, as easily as you gave it:
- Newsletter and document-download updates: use the unsubscribe link in the email we sent you (it opens a page with an Unsubscribe button, and an Undo button if you change your mind), or email us with the subject “UNSUBSCRIBE”.
- Compliance reminders: use the unsubscribe link in any reminder email, or email us.
- Analytics cookies: open cookie settings and click “Reject”.
- Enquiries, chat or applications: email us and we will delete your data, unless a law requires us to keep it.
Withdrawing consent does not affect processing done before you withdrew it. We record the withdrawal (see section 3), and no further emails of that kind are sent to you.
9. Grievance contact
For any question or complaint about your personal data, write to the firm’s grievance contact at gaurav@skagandassociates.com, or by post to SKAG and Associates, Kh.No-84, Plot No -RZ-I-1, F/Floor, 12/2, Main Rd, opposite Yammaha Showroom, Mahavir Enclave, New Delhi, Delhi 110045. We will respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
10. Children’s data
This website is meant for adults. We do not knowingly collect personal data from anyone under 18 without the verifiable consent of a parent or lawful guardian, and we do not track or target children. If you believe a child has sent us personal data, please email us and we will delete it.
11. Confidentiality of client information
Information shared in the course of a professional engagement is treated as confidential under the ICAI Code of Ethics. Records are accessed only by authorised personnel and are not disclosed to third parties except where required by law, by competent authorities, or with the client’s written consent. We use reasonable security measures to protect personal data, and if a personal data breach occurs we will inform affected people and the Data Protection Board as the law requires.
12. Changes to this notice
We may update this notice when our forms or the law change. The date at the top shows the latest version.