Overview
The Digital Personal Data Protection Act, 2023 and the rules under it (the "DPDP Act") set out how personal data must be handled in India. Nootus OS is designed to support CA and accounting firms in meeting their obligations under it. This statement explains how.
Using Nootus does not by itself make a firm compliant. Each firm remains responsible for its own notices, consents and decisions as a data fiduciary.
Who is responsible for what
For the personal data a firm keeps about its clients, their customers, vendors and employees, and its own staff, the firm is the data fiduciary and Nootus is its data processor.
For visitors to this website, people who submit our forms, and the account details of the people who sign in to Nootus, Nootus is the data fiduciary.
What we do as a processor
For firm data, Nootus:
- processes it only on the firm's instructions and to provide the Service;
- never uses it to train or fine-tune any AI model;
- keeps each firm's data apart, encrypted in transit and at rest, with an extra layer for PAN, bank details and portal passwords;
- limits its own staff to read-only support access, one record at a time, tied to a ticket and recorded;
- keeps an activity log of who did what, including every AI agent and the person it reports to;
- helps the firm answer requests from data principals to access, correct or erase their data;
- uses only the sub-processors listed on our sub-processors page, and tells firms before adding one;
- returns or deletes the data when the firm leaves, except what the firm or the law requires us to keep.
What firms do as fiduciaries
A firm gives its clients the notice the DPDP Act requires, obtains consent where consent is the basis for processing, and decides how long records are kept. Nootus gives firms the tools to do this: roles and approve permissions, the activity log, the password vault's view log, data export and deletion.
Before messaging clients on WhatsApp or email through Nootus, a firm must have their opt-in.
Rights of data principals
People whose data is in Nootus can ask for a summary of it, correct it, have it erased when it is no longer needed, withdraw consent, nominate someone, and have grievances addressed. Where a firm is the fiduciary, requests go to the firm and we help it respond. Where Nootus is the fiduciary, write to our Grievance Officer.
Breach notice
If we become aware of a personal data breach affecting a firm's data, we will notify the firm without undue delay and in any case within 72 hours, with what we know, what we are doing and what the firm may need to do. We will help the firm notify the Data Protection Board of India and affected people.
Where Nootus is the fiduciary, we notify the Board and affected people ourselves. Cyber security incidents are also reported to CERT-In within the time its directions require.
Statutory records
Nootus does not file returns on its own. Returns are filed by the firm, after a person at the firm approves them. Books of account, returns and related records are kept for the statutory period on the firm's instruction, and erasure requests for them are handled by the firm with that in mind.
Children's data
Firms may hold data about minors, for example dependants in payroll or minors' income in a family's returns. The firm obtains a parent's or guardian's consent where required. Nootus does not track children or use their data for advertising.
Transfers outside India
Nootus OS is hosted in India. Some services process data outside India, such as WhatsApp (Meta), Google services, Cloudflare Turnstile and an AI provider a firm chooses. We transfer data only as the DPDP Act permits and never to a country the Government of India has restricted.
Grievance Officer
Write to our Grievance Officer at privacy@nootus.ai. We respond within 7 days. If you are not satisfied, you may complain to the Data Protection Board of India.