Data Retention Policy

1. Scope of This Policy

This policy applies to all personal data and business information we collect, process, or store while delivering services such as company and LLP registration, GST registration and return filing, trademark and IP filing, FSSAI and other licensing, ROC and annual compliance, income tax return filing, and general website usage or marketing communication. It covers data in every format we hold it in — electronic files, emails, client-portal records, cloud backups, and physical paperwork at our offices.

2. Categories of Data We Handle

• Identity data — name, PAN, Aadhaar, passport, DIN, Digital Signature Certificate (DSC) details
• Contact data — email address, mobile number, residential or business address
• Financial data — bank account details, GST invoices, payment and refund records
• Business data — MOA/AOA, shareholding structure, incorporation certificates, statutory registers
• Correspondence — emails, WhatsApp chats, notes from calls with our team
• Technical data — IP address, browser type, cookies, login activity
• Filing records — copies of forms filed on your behalf with MCA, GSTN, the Trade Marks Registry, FSSAI, and the Income Tax Department

3. How Long We Retain Your Data

Our default position is to retain personal and operational data only for as long as it takes to complete and hand over your requested service. Once we confirm delivery, most working files, uploaded documents, and correspondence linked to that engagement are permanently deleted within 7 days.

Where a statutory minimum retention period is amended by the government, the revised period will apply automatically to the relevant category of records.

4. Storage & Security Measures

• Encrypted storage (AES-256) for digital records held during the active service period
• Role-based access controls — data is accessible only to the professionals directly working on your matter
• Secure cloud infrastructure hosted within India
• Regular backups with periodically tested restoration procedures
• Physical documents kept in locked storage at our registered office and shredded on schedule
• Periodic internal review of data holdings and access logs

5. Who We Share Data With

We do not sell, rent, or trade client data. Data is shared only in the following limited circumstances:

• Government authorities — MCA21, GSTN, the Trade Marks Registry, FSSAI, the Income Tax Department, and other regulators, as required by law
• Service partners — payment gateways, communication platforms, and cloud infrastructure providers, bound by data processing terms consistent with this policy
• Legal obligation — where required by a court order, regulatory direction, or lawful investigation
• Independent professionals — Chartered Accountants, Company Secretaries, or Advocates engaged on your specific matter, under confidentiality obligations

Where any sub-processor is located outside India, we take reasonable steps to ensure it offers a comparable level of data protection before sharing information with it.

6. Deletion & Secure Disposal

• Digital files and uploads — purged automatically from our systems and cloud storage through scheduled deletion jobs
• Email and chat records — cleared from active inboxes and communication archives linked to the closed matter
• Third-party sub-processors — issued a corresponding deletion instruction within the same retention window
• Backups — overwritten during the next scheduled backup rotation following deletion
• Physical documents — cross-cut shredded by authorised personnel

We maintain a deletion log recording the data category, date of deletion, and responsible team member — without retaining the underlying personal data itself — for internal audit purposes.

7. Your Rights Over Your Data

Under the Digital Personal Data Protection Act, 2023 and other applicable Indian law, you may exercise the following rights in relation to your personal data held by us:

To exercise any of these rights, contact our Grievance Officer using the details in Section 11. We aim to respond within 30 days. Certain rights may be limited where retention is required by law.

8. Data of Minors

Our services are intended for use by individuals aged 18 and above, or by businesses acting through an authorised adult representative. We do not knowingly collect personal data of minors except where it is directly relevant to a service (for example, a minor listed as a beneficiary in a trust or NGO registration), and in such cases only with verifiable consent of a parent or legal guardian.

9. Legal Holds

In limited circumstances, we may need to preserve specific data beyond its normal retention period. A legal hold may apply where:

• Litigation involving Setupfiling.in or a client is underway or reasonably anticipated;
• A government authority issues a preservation notice or summons;
• A regulatory investigation requires specific records to be preserved;
• An internal audit necessitates short-term preservation of particular records.

Legal holds are narrow and apply only to the specific data relevant to the matter, for only as long as necessary. Unaffected data continues to be deleted on its normal schedule, and holds are lifted once the matter is resolved.

10. Data Breach Notification

In the unlikely event of a data breach that is likely to affect your personal data, we will notify the relevant authority as required under applicable law and inform affected clients without undue delay, along with the steps being taken to contain and remediate the incident.

11. Changes to This Policy

We review this Data Retention Policy at least once a year, and whenever there is a material change in applicable law or our operating practices. When we make a significant update, we will revise the "Last Updated" date on this page and, where appropriate, notify registered clients by email or in-platform notice. Continued use of our services after an update constitutes acceptance of the revised policy.

12. Contact Our Grievance Officer

If you have questions about this policy, want to exercise a data right, or wish to report a data concern, please contact us: