Privacy Policy
Last updated: August 2026
Introduction
J A & Associates Chartered Accountants ("we", "us", or "our") is committed to protecting your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website.
Under the DPDP Act, we are a 'Data Fiduciary' and you are a 'Data Principal'. This means we determine how and why your data is processed, and you have specific rights regarding your personal data.
What personal data we collect
| Data Category | Specific Data | Collection Point |
|---|---|---|
| Contact Information | Full name, phone number, email address | Contact Form |
| Inquiry Details | Matter type, message content | Contact Form |
| Application Data | Full name, email, phone, role applied for, cover note, resume/CV file | Careers Page |
| Technical Data | IP address, browser type (collected by Google Maps and Google Fonts when consent is given) | Automatic (with consent) |
| Preferences | Language preference, cookie consent choice | Browser storage |
Why we collect your data
We process your personal data only for specific, clearly defined purposes as required under Section 4 of the DPDP Act:
- Client Inquiries: To receive, review, and respond to your consultation requests and inquiries.
- Job Applications: To evaluate your candidacy for open positions at our firm and contact you regarding the outcome.
- Website Functionality: To remember your language preference and display our office location on an interactive map (with your consent).
- Data Rights Requests: To process and respond to your requests to access, correct, erase, or withdraw consent for your personal data.
How long we retain your data
As required under Section 8(7) of the DPDP Act, we retain your personal data only for as long as necessary to fulfil the purpose for which it was collected:
- Contact Inquiries: Retained for 1 year from the date of submission, then securely deleted.
- Job Applications & Resumes: Retained for 2 years from the date of submission, or until you withdraw consent — whichever is earlier. Resumes are securely deleted after the retention period.
- Consent Records: Retained for 3 years as evidence of lawful processing under the DPDP Act.
Third-party services
We use the following third-party services to operate this website. Each service may process some of your data as described below:
| Service | Purpose | Data Shared |
|---|---|---|
| Sanity.io | Content management & data storage | Contact inquiries, job applications, resumes, data rights requests |
| Resend | Email notifications for job applications | Applicant name, email, phone, resume |
| Google Maps | Interactive office location map (consent required) | IP address, browser data |
| Google Fonts | Typography rendering | IP address, browser metadata |
| WhatsApp (Meta) | Direct messaging link (user-initiated) | Phone number, message content (when you choose to contact us) |
Your rights as a Data Principal
Under Sections 11–14 of the DPDP Act, 2023, you have the following rights:
- Right to Access (Section 11): You can request a summary of your personal data that we hold and the processing activities associated with it.
- Right to Correction (Section 12): You can request correction of inaccurate or incomplete personal data.
- Right to Erasure (Section 12): You can request deletion of your personal data when it is no longer necessary for the purpose it was collected.
- Right to Withdraw Consent (Section 6): You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing done before the withdrawal.
- Right to Grievance Redressal (Section 13): You can register a complaint with our Grievance Officer. If unsatisfied with our response, you may approach the Data Protection Board of India.
To exercise any of these rights, please use our Data Rights Request Form.
Consent
We collect your personal data only with your explicit, informed consent as required under Section 6 of the DPDP Act. Consent is obtained through clearly worded, unticked checkboxes at each data collection point on our website. You are free to refuse or withdraw consent at any time without any adverse consequences.
For non-essential services such as Google Maps, we display a consent banner that allows you to choose whether to load these services.
Security measures
We implement reasonable security safeguards as required under Section 8(5) of the DPDP Act to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS), secure server-side storage, and restricted access to personal data within our organization.
Grievance Officer
As required under Section 8(10) of the DPDP Act, we have designated the following Grievance Officer to address your concerns:
Name: Jibin Jose, FCA
Designation: Lead Partner & Grievance Officer
Email: mail.jaandassociates@gmail.com
Phone: +91 9652 633 511
Address: 4/496K, First Floor, Menachery Plaza, Near KSRTC Bus Stand, Angamaly, Ernakulam - 683572
We aim to acknowledge your complaint within 48 hours and resolve it within 30 days. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any significant changes will be communicated through a notice on our website. We encourage you to review this page periodically.