GDPR Alignment

GDPR requirement: Personal data must be processed lawfully, fairly, and transparently.

How we apply it: We process personal data only on the lawful bases described in our Privacy Policy — primarily contractual necessity (to provide the service you signed up for), legitimate interests (to improve our products and prevent fraud), legal obligation (to comply with Indian law), and consent (for marketing and analytics). We document our lawful basis for each processing activity. We publish our Privacy Policy, DPDP Act Compliance page, and this GDPR Alignment page to be transparent about how we process data.

GDPR requirement: Data collected for one purpose must not be used for a different, incompatible purpose.

How we apply it: We collect data for specific purposes described in our Privacy Policy and do not repurpose it for incompatible uses without obtaining fresh consent. For example, operational data entered into BoSS by a client is used to provide the BoSS service — not for Sahayogi's marketing or analytics.

GDPR requirement: Only data that is necessary for the specified purpose should be collected.

How we apply it: We collect only the personal data fields required to provide each product or service. We review our data collection practices periodically to ensure we are not collecting data that is not needed. For example, Tax Sahayogi collects tax-related information relevant to query resolution — not broader personal data fields that are not relevant to that service.

GDPR requirement: Personal data must be accurate and kept up to date.

How we apply it: Users can update their account information at any time through their account settings or by writing to us. We encourage users to keep their information current. Where we hold data provided by client organisations (such as employee data in BoSS), we rely on the client to maintain accuracy for that data, as the client is the Data Fiduciary for that data.

GDPR requirement: Personal data should not be kept longer than necessary for the purpose.

How we apply it: We maintain data retention periods for all categories of personal data, as described in our Privacy Policy. Data is deleted or anonymised when its retention period expires or when the purpose for which it was collected no longer applies (subject to mandatory legal retention requirements under Indian law).

GDPR requirement: Personal data must be processed securely, protected against unauthorised access, loss, or destruction.

How we apply it: We implement security measures aligned with ISO 27001 principles across our products and infrastructure — including encryption in transit and at rest, role-based access controls, access logging, and regular security reviews. Full details are in our Security Policy (/legal/security-policy).

GDPR requirement: The data controller must be able to demonstrate compliance with all principles.

How we apply it: We maintain internal records of our data processing activities. We document our lawful bases, retention periods, and data sharing arrangements. We publish our privacy documentation publicly. We have a designated contact for data protection queries and grievances (see Section 6).

You have the right to obtain a copy of your personal data and information about how it is processed.

You have the right to have inaccurate personal data corrected and incomplete data completed.

You have the right to request deletion of your personal data where it is no longer necessary, where consent has been withdrawn, where you object to processing, or where processing was unlawful. This right is subject to mandatory retention periods.

You have the right to request that processing of your personal data is restricted in certain circumstances — for example, while the accuracy of data is contested, or where processing is unlawful but you prefer restriction to erasure.

Where processing is based on consent or contract and is carried out automatically, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.

You have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is for the establishment, exercise, or defence of legal claims.

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You have the right to lodge a complaint with your national data protection supervisory authority in the EEA if you believe your rights under GDPR have been violated.