How we handle your data, and what you can require of us

TheGSTCo is a brand operated by Aspera Technologies Private Limited, a company incorporated in India (CIN U72900PN2022PTC211370), with its registered office at Office No. 305, ICON IT Park, Narhe, Pune 411041, Maharashtra.

For the personal data described in this policy, we are the Data Fiduciary — the entity that determines why and how your data is processed — and you are the Data Principal. Where we process data on the instructions of another business (for example, a marketplace or a channel partner who engages us for its sellers), we act as a Data Processor for that business and its own privacy terms will also apply.

This policy covers thegstco.com, our forms, WhatsApp and email channels, and all services delivered under the TheGSTCo brand, including virtual place of business (VPOB), virtual office, GST registration and amendment, return filing, and related compliance services.

We collect only what a specific service requires. We do not ask for documents "for the file" or retain material a service did not need.

Each purpose below is a specified purpose for which your consent is sought, or a use permitted by law. We do not process your data for any purpose outside this list without obtaining fresh consent.

• Delivering the service you engaged us for — preparing and filing applications, returns and amendments; corresponding with the GST department; responding to notices.
• Verifying identity and eligibility — confirming that the person instructing us is authorised to do so, and that documents submitted are complete and genuine.
• Meeting our own legal obligations — maintaining books, issuing tax invoices, filing our own returns, and retaining records for the periods the law prescribes.
• Responding to lawful requests — providing information to tax or law enforcement authorities where we are legally required to.
• Supporting and improving the service — handling queries, resolving complaints, and maintaining a record of the engagement.
• Communicating with you — service updates, renewal and filing reminders, and, where you have consented, marketing about related services.

Where we rely on consent, we ask for it before or at the time of collection, through a notice that sets out the data sought, the purpose, how to withdraw, and how to complain to the Data Protection Board of India. That notice is available in English and, on request, in any language listed in the Eighth Schedule to the Constitution.

Consent is specific and unbundled. Agreeing to a GST registration service does not constitute consent to marketing, and declining marketing does not affect the service.

Withdrawing consent

You may withdraw consent at any time, by the same channel through which you gave it or by writing to our Grievance Officer. Withdrawal is as easy as giving consent. On withdrawal we stop the processing that depended on it, and erase the associated data unless retention is required by law.

Withdrawal is not retrospective — it does not undo processing already carried out lawfully, and it does not reverse a filing already made. Where withdrawal prevents us from delivering a service you have engaged, we will tell you what the consequence is before it takes effect.

This clause exists because credentials are the most sensitive thing our clients hand us, and the area where the industry is loosest.

• Credentials are held for the engagement only. GST portal user IDs and passwords are stored in a controlled system, accessible only to the personnel assigned to your account.
• OTPs are used once, for the transaction they were shared for. We will tell you what we are about to file before requesting an OTP, and we will not use an OTP obtained for one purpose to authorise another.
• Digital signature tokens remain yours. Where a DSC is required, it is used under your instruction for the specific filing. We do not retain custody of DSC tokens beyond the engagement.
• We will never ask for your banking passwords or net-banking OTPs. No employee of ours has any legitimate reason to request them. Treat any such request as fraudulent and report it to the address in clause 11.
• Change your password when the engagement ends. On completion or termination we release credentials from our systems, and we recommend you reset the portal password as a matter of course.

We disclose personal data only in the circumstances below, and only to the extent each requires.

Every processor acting on our behalf is engaged under a written contract requiring confidentiality, purpose limitation, security safeguards, breach reporting to us, and deletion or return of data on termination.

We erase personal data once the purpose it was collected for is no longer served, unless a law requires us to retain it. Because GST and company law impose long retention periods, some records outlive the engagement.

Where erasure is scheduled and the law permits us to notify you first, we will give you at least 48 hours' notice so you can ask us to preserve the record or supply a copy.

We maintain reasonable security safeguards proportionate to the sensitivity of the data we hold. These include:

• Access control — role-based access to client records, granted on assignment, reviewed periodically, and revoked on role change or exit as part of a documented offboarding checklist.
• Encryption — encryption in transit for all data submitted through our website and forms, and encryption at rest for stored identity documents and credentials.
• Logging — access and activity logs retained for at least one year and monitored for anomalous access patterns.
• Segregation — client data held in systems of record rather than personal drives, mailboxes or devices. Sharing client documents over personal messaging accounts is a disciplinary matter.
• Backups and continuity — regular backups held with equivalent protection, and a tested restoration process.
• People — confidentiality obligations in every employment and contractor agreement, and training on handling KYC and credential data.
• Vendors — security and data protection terms reviewed before a processor is engaged.

No system is immune. We do not claim our safeguards are absolute; we claim they are current, documented, and reviewed.

On becoming aware of a personal data breach, we contain and investigate it, and we notify:

• The Data Protection Board of India, without delay on discovery, with a description of the breach, the categories and approximate number of Data Principals affected, its likely consequences, and the measures taken.
• You, within 72 hours, in plain language — what happened, what data was involved, what you can do to protect yourself, and who to contact with questions.

We follow up with the Board with the findings of our investigation, the remedial measures taken to prevent recurrence, and confirmation of the notifications issued, within the period the law prescribes. We do not treat delay or silence as a containment strategy.

You may exercise any of these rights by writing to our Grievance Officer. We will verify that the request comes from you before acting on it, and respond within [30] days.

Our Grievance Officer is the point of contact for any question or complaint about this policy or our handling of your data.

If you are not satisfied with our response, or we do not respond within the stated period, you may complain to the Data Protection Board of India through the channels it publishes.

Some of the technology platforms we use, and our group entity Aspera Pte Ltd in Singapore, may process personal data outside India. Indian law permits such transfers except to countries the Central Government has restricted by notification, and we do not transfer data to any restricted territory.

Where a transfer occurs, it is covered by written terms requiring protection equivalent to this policy, and any sector-specific localisation requirement that applies to the data — including payment data — continues to be observed.

Our services are intended for businesses and are not directed at children. We do not knowingly collect the personal data of a child except where a child is a partner, director or beneficial owner and their data forms part of a statutory filing — in which case we process it on the verifiable consent of a parent or lawful guardian.

We do not track children, serve them targeted advertising, or process their data in any way likely to cause detrimental effect. Where a Data Principal has a lawful guardian, we process their data on the guardian's verifiable consent.

If you believe a child's data has been provided to us without proper consent, write to our Grievance Officer and we will investigate and erase it where required.

thegstco.com uses cookies and similar technologies for three purposes: keeping the site working, understanding how it is used, and — where you have consented — measuring advertising.

• Essential cookies keep sessions, forms and security functions working. The site does not function without them.
• Analytics cookies tell us which pages are used and where visitors drop off. Data is aggregated and used to improve the site.
• Advertising cookies are set only with your consent, and let us measure campaigns and show relevant services to people who have visited the site.

You can refuse non-essential cookies through the consent banner and change your choice at any time through your browser settings.

Marketing communications

We send service messages — filing reminders, renewal notices, status updates — as part of delivering the service. Marketing communications by email, WhatsApp or phone are sent only where you have consented or where permitted by law, and every one carries a means of opting out. Opting out of marketing does not stop service messages, which you need to receive.

We review this policy at least annually and whenever the law, our systems or our services change materially. The version and review dates are recorded at the foot of this page.

Where a change materially affects how we process data you have already given us, we will notify you before it takes effect and, where the law requires it, seek fresh consent. Continuing to use our services after a non-material change indicates acceptance of the updated policy.