1. Two roles
- For your account and billing — your name, e-mail, login, subscription, invoices and payments — we decide why and how the data is used. Under the DPDP Act we are the Data Fiduciary.
- For audit content — checklists, evidence, findings, reports and the client personal data in them — the certification body or auditor who records it decides why it is processed. We process it on their behalf as their Data Processor, only to provide the Portal. Requests about that data should go to the certification body; we will help them answer.
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | name, e-mail, role, organisation, password (stored hashed), authenticator secret (encrypted) | to give you secure access |
| Billing | billing name, address, state, GSTIN, invoices, payment references | to invoice you and meet GST and accounting law |
| Payment | handled by our payment gateway; we receive only a payment reference and status, never your full card or bank details | to confirm payment |
| Usage and security | sign-ins, IP address, browser, actions in the activity log | to keep the Portal secure and provide an audit trail |
| Audit content | entered by users (see section 1) | to provide the Portal |
| Messages | what you send through the contact form or e-mail | to answer you |
We do not use advertising cookies and we do not sell personal data. We do not use analytics cookies.
3. Legal basis
We process account, billing and usage data to perform our contract with you and to comply with law (for example GST records), and for the legitimate use of keeping the Portal secure. Where we need your consent, we ask for it clearly and you may withdraw it at any time, as easily as you gave it; withdrawal does not affect processing already done.
4. Who we share it with
Only with service providers who help us run the Portal, under contracts that require them to protect the data: hosting and backup storage, e-mail delivery, payment gateway (Razorpay), and our professional advisers. We disclose data to authorities only where the law requires it. Data is stored on servers located in Mumbai, India. Where data is transferred outside India, it is only to countries not restricted by the Government of India, and it remains protected as described here.
5. How long we keep it
- Account data: while the account is active and for 3 years after it is closed.
- Invoices and payment records: 8 years, as required by GST and accounting law.
- Activity log: 7 years, as part of the audit trail.
- Audit content: as set by the certification body (by default 7 years after a report is issued for evidence files); records may be kept longer where an issued report depends on them.
- Contact messages: 2 years.
6. Security
We protect data with encryption in transit (HTTPS), encryption of secrets at rest, hashed passwords, two-factor authentication (mandatory for administrators and lead auditors), role-based access, virus scanning of uploads, an append-only activity log and encrypted nightly backups. We follow reasonable security practices and procedures as required by the IT Act and its rules. If a personal-data breach occurs, we will inform the Data Protection Board of India and affected persons as the DPDP Act requires.
7. Your rights
As a Data Principal you may:
- obtain a summary of your personal data and how it is processed;
- have inaccurate or incomplete data corrected and updated, and data no longer needed erased;
- withdraw consent where processing is based on consent;
- have your grievance addressed;
- nominate another person to exercise your rights in case of death or incapacity.
You can see and correct most account and billing data yourself on My account and My subscription, and download your data on Backups. For anything else write to our Grievance Officer below. We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
8. Children
The Portal is for professionals aged 18 or over. We do not knowingly collect children's personal data.
9. Cookies
We use only cookies that are strictly necessary for the Portal to work: a session cookie that keeps you signed in and a security token that protects forms (XSRF-TOKEN). They are deleted when you sign out or close the browser, or expire after a short time.
10. Grievance Officer
[Grievance Officer — set in Administration], AUTHENTIC BUSINESS ASSESSMENT BUREAU, 3RD FLOOR, 67, ADITYA ESTATE, MIND SPACE, MALAD WEST, MUMBAI, MAHARASHTRA, 400064 E-mail: info@abab.org.in · Phone: +91 9892024202 We acknowledge grievances within 48 hours and resolve them within one month.
11. Changes
We will post any change on this page with a new date, and notify registered users by e-mail of material changes.