DPDP Act 2023 CompliantData Residency: AWS ap-south-1 (Mumbai, India)

Privacy Policy & Data Protection

Prime Business operates a production-grade Chartered Accountancy, Corporate Law, Tax, and Regulatory Compliance platform for Indian enterprises and entrepreneurs. This policy describes how we process, secure, retain, and respect your personal and corporate data under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian regulatory standards.

Effective Date: 1 January 2026•Last Updated: 27 September 2026•Version: 2.1 (Production)

1. Scope & Legal Framework

This Privacy Policy applies to all users, clients, promoter applicants, directors, shareholders, authorized signatories, and visitors accessing the Prime Business platform via primebusiness.in, api.primebusiness.in, our client and professional portals, and our verified Meta WhatsApp Business communication channels.

Prime Business operates as a digital-first platform facilitating professional statutory compliance, corporate registrations, tax filing orchestration, and legal documentation in India. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), Prime Business serves as a Data Fiduciary regarding user account data and direct platform interactions, and as a Data Processor when acting on specific documented instructions of our corporate clients and licensed professional partners (Chartered Accountants and Advocates).

2. Categories of Data Collected & Processed

We adhere strictly to the principle of Data Minimization: we collect and process only the data necessary to establish accounts, verify identities, satisfy Indian statutory Know-Your-Customer (KYC) regulations, and prepare regulatory filings.

Identity & Statutory KYC

Permanent Account Number (PAN), masked Aadhaar details (strictly compliant with UIDAI masking requirements; unmasked Aadhaar numbers are never stored in plaintext), passport numbers, and Director Identification Numbers (DIN).

Corporate & Entity Records

Corporate Identification Number (CIN), LLPIN, GSTIN, registered office address details, promoter shareholding distributions, and Board Resolutions required for corporate formation.

Statutory Document Vault Uploads

Proof of registered address (utility bills, rent agreements, owner NOCs), identity proofs, and digital signatures. Files are stored with AES-256 encryption in dedicated private S3 vaults.

Communication & Audit Logs

Transaction notifications, delivery receipts, WhatsApp interaction timestamps, and immutable, cryptographically chained SHA-256 audit logs of state transitions and professional reviews.

3. Lawful Basis & Purpose Limitation

We process personal and corporate data strictly under lawful bases recognized by the DPDP Act 2023, specifically:

  • Statutory Mandates & Legal Obligations: Processing required under the Companies Act 2013, Limited Liability Partnership Act 2008, Income Tax Act 1961, and Central Goods and Services Tax Act 2017.
  • Explicit Consent: Captured during client onboarding and service initiation for intake collection, professional attestation, and communication preferences.
  • Contractual Performance: Providing application workflow orchestration, document verification, filing receipt delivery, and client support.
AI Governance & Accounting Boundaries: Prime Business AI assistants are utilized exclusively for metadata extraction, document classification, and intake preparation. AI never independently certifies legal forms, approves statutory filings, or acts as an autonomous professional. All filings require qualified human professional oversight. Prime Business does not operate an internal double-entry accounting engine or general ledger.

4. Security Architecture & Indian Data Residency

Prime Business implements state-of-the-art defense-in-depth technical and organizational measures to protect all sensitive business information:

100% India Data Residency

All primary databases, document vaults, and API container services reside exclusively in the AWS Mumbai region (ap-south-1).

Cryptographic Isolation

PostgreSQL Row-Level Security (RLS) ensures strict tenant separation. Files in S3 vaults are encrypted at rest via AWS KMS with short-lived pre-signed URLs.

Tamper-Evident Audit

Every sensitive data access, state transition, and document view is recorded in an immutable, append-only audit log chained with SHA-256 hashes.

5. Meta WhatsApp Business & Communications

Prime Business utilizes the official Meta WhatsApp Business Cloud API (v21.0) to deliver timely, transactional updates regarding statutory applications, government approval notices, and SLA deadlines.

  • Messages sent via WhatsApp are strictly transactional and related to active applications or client inquiries.
  • We do not send unsolicited marketing messages or commercial spam via WhatsApp.
  • WhatsApp conversation records and metadata are transmitted securely via TLS and verified webhooks, and are never shared with external advertising networks.
  • Clients can opt out of non-critical messaging at any time from the Client Portal or by replying "STOP".

6. Statutory Data Retention & Preservation Mandate

While Prime Business respects the right to data erasure, Indian statutory regulations impose mandatory record preservation periods on corporate and tax filings:

Companies Act, 2013 (Section 128):Books of account and related vouchers, filings, and statutory records must be preserved for a minimum of eight (8) financial years immediately preceding a relevant financial year.
Income Tax Act, 1961:Returns, tax audit reports, challans, and supporting documents must be maintained for the full duration of the statutory reassessment window (typically up to 8 to 10 years).
GST Act, 2017 (Section 36):Every registered person must retain accounts and records until seventy-two (72) months from the due date of furnishing the relevant annual return.

Where personal data forms an integral part of completed government filings, certificates, or statutory audit trails, it cannot be destroyed until the expiration of these statutory retention mandates. In such circumstances, account credentials and non-statutory metadata will be erased or anonymized, and retained statutory archives will be placed under restricted cryptographic cold storage.

7. Your Rights under the DPDP Act, 2023

As a Data Principal, you possess statutory rights under the Digital Personal Data Protection Act, 2023:

Right to Access Information:

You may request a summary of the personal data being processed, along with details of the processing activities and third parties with whom data has been shared.

Right to Correction and Completion:

You may request the correction of inaccurate data, the completion of incomplete data, or the updating of obsolete records.

Right to Erasure (Data Deletion):

You may request deletion of your personal data that is no longer necessary for the purpose for which it was collected, subject to the statutory retention mandates outlined in Section 6. For step-by-step instructions, see our User Data Deletion Instructions.

Right of Grievance Redressal:

You may file a grievance with our designated Data Protection Officer regarding the processing of your personal data.

Right to Nominate:

You have the right to nominate any other individual who shall, in the event of death or incapacity, exercise your data subject rights.

8. Grievance Redressal & Data Protection Officer (DPO)

In accordance with the DPDP Act 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, Prime Business has designated a Grievance Officer and Data Protection Officer:

Prime Business Grievance & Privacy Office

Designation: Data Protection & Grievance Redressal Officer

Primary Privacy Contact: privacy@primebusiness.in

DPO Contact: dpo@primebusiness.in

Operational Jurisdiction: Republic of India

SLA for Acknowledgment: Within 48 business hours

SLA for Resolution: Within thirty (30) calendar days