Data Retention Policy

  • Effective Date: 1 April 2013
  • Last Updated: May 2026

This policy applies to all personal and business data processed by SetupFiling.in in the course of providing professional services.

SetupFiling.in (“we”, “us”, “our”) is committed to responsible data stewardship. This Data Retention Policy sets out how long we retain personal and business information, why we retain it, and how it is securely disposed of when no longer required. It should be read alongside our Privacy Policy and Terms of Service.

1. Scope & Applicability

This policy applies to all personal data and business information collected, processed, or stored by SetupFiling.in in connection with the delivery of our professional services, including but not limited to:

  • Company and LLP Registration services
  • GST Registration, filing, and compliance
  • Trademark filing and intellectual property services
  • FSSAI, Import Export Code (IEC), and other licensing
  • Annual compliance, ROC filings, and advisory services
  • General website usage, marketing, and communications

This policy governs data held in all formats — electronic records, physical documents, email correspondence, client portals, and cloud storage systems operated by or on behalf of SetupFiling.in.

2. Data We Collect

In the course of providing services, we may collect and retain the following categories of data:

  • Identity Data — Name, PAN, Aadhaar, passport details, DIN, DSC
  • Contact Data — Email address, mobile number, residential / business address
  • Financial Data — Bank account details, GST invoices, payment records
  • Business Data — MOA/AOA, shareholding patterns, incorporation certificates, statutory registers
  • Correspondence — Emails, WhatsApp messages, notes from client calls
  • Technical Data — IP addresses, browser data, cookies, login logs
  • Government Filings — Copies of all forms filed on your behalf with MCA, GSTN, Trade Marks Registry, FSSAI, etc.

3. Retention Schedule

Our default retention period is 7 days from the date of service delivery. Once we confirm that your requested service has been completed and delivered, all personal and operational data associated with that engagement is permanently deleted within 7 days. The table below details how this applies across data types.

⚠️Statutory Exception: Certain records are subject to mandatory minimum retention periods under Indian law (e.g. GST Act, Companies Act). We retain only those specific records for only as long as the law strictly requires — nothing more. All other data is deleted at the 7-day mark.

Data Category Retention Period Basis

Documents uploaded for service processing (IDs, address proof, PAN, Aadhaar, photos)

7 days after service delivery

Our Policy

Client correspondence (emails, chat, call notes) related to service

7 days after service delivery

Our Policy

Draft forms and working documents prepared during service

7 days after service delivery

Our Policy

Support tickets & service-related complaints

7 days after resolution & delivery

Our Policy

Website usage & analytics data

7 days (rolling, anonymised after)

Consent

Marketing communication preferences

Until opt-out (no personal data retained)

Consent

4. Storage & Security

All data retained by SetupFiling.in is stored with appropriate technical and organisational safeguards, including:

  • Encrypted storage (AES-256) for all digital records
  • Access controls — data accessible only to authorised professionals on a need-to-know basis
  • Secure cloud infrastructure hosted within India
  • Regular backups with tested restoration procedures
  • Physical document storage in locked cabinets at our registered offices
  • Annual internal audits of data holdings and access logs

5. Data Sharing

We do not sell, rent, or trade client data. Data may be shared only in the following limited circumstances:

  • Government authorities — MCA21, GSTN, Trade Marks Registry, FSSAI, Income Tax Department, and other regulatory bodies as mandated by applicable law
  • Service partners — Third-party tools (e.g., payment gateways, communication platforms, cloud storage) under data processing agreements that bind them to equivalent standards
  • Legal obligation — In response to a lawful court order, regulatory direction, or investigation
  • Professional advisors — Chartered Accountants, Advocates, or Company Secretaries engaged in your matter, under confidentiality obligations

6. Deletion & Disposal

Upon the 7-day mark following service delivery, all non-statutory personal and operational data is permanently deleted using the following methods:

  • Digital files & uploads — Automatically purged from our systems and cloud storage via scheduled deletion jobs running daily
  • Email & chat records — Cleared from active inboxes and archived communication logs
  • Cloud & third-party sub-processors — Deletion instructions issued to all service partners within the same 7-day window
  • Backups — Overwritten on the next backup rotation cycle following the 7-day period
  • Physical documents — Cross-cut shredded within 7 days by authorised personnel

A deletion confirmation log is maintained for audit purposes, recording category, date of deletion, and responsible team member — without retaining the underlying personal data.

7. Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable Indian law, you have the following rights in relation to your personal data:

🔍 Right to Access

Request a summary of the personal data we hold about you and the purposes for which it is processed.

✏️ Right to Correction

Ask us to correct any inaccurate or incomplete personal data without undue delay.

🗑️ Right to Erasure

Request deletion of your personal data where we no longer have a legitimate or legal basis to retain it.

📤 Right to Portability

Receive your personal data in a structured, commonly used format to transfer to another service provider.

🚫 Right to Object

Object to processing based on legitimate interests, including direct marketing communications.

👶 Nominee Rights

Designate a nominee to exercise data rights on your behalf in the event of death or incapacity.

To exercise any of the above rights, please contact our Grievance Officer (see Section 10). We will respond within 30 days. Please note that certain rights may be limited where retention is required by law.

 

8. Legal Holds

In exceptional circumstances, we may be required to preserve specific data beyond the 7-day period. A legal hold may be imposed when:

  • Litigation is commenced or reasonably anticipated involving SetupFiling.in or a client
  • A government authority issues a preservation notice or summons
  • A regulatory investigation requires specific records to be preserved
  • An internal audit or investigation necessitates short-term preservation

Legal holds are narrow exceptions — only the specific data directly relevant to the matter is held, and only for as long as necessary. All unaffected data continues to be deleted at the 7-day mark. Holds are formally lifted by our compliance team as soon as the matter is resolved.

9. Policy Changes

We review this Data Retention Policy at least annually and whenever there is a material change in applicable law or our business operations. When we make significant changes, we will:

  • Update the “Last Updated” date at the top of this page
  • Notify registered clients via email or in-platform notification
  • Maintain a version archive of previous policies on request

Your continued use of our services after the effective date of any revision constitutes your acceptance of the updated policy.

10. Contact Us

If you have any questions about this policy, wish to exercise your data rights, or need to report a data concern, please reach out to our designated Grievance Officer:

SetupFiling.in
Email: help@setupfiling.in
Phone: +91 9818209246
Address: E-30, Jawahar Park, Laxmi Nagar, Delhi 110092, India