Data Processing Agreement
DPA between Ldelight Solutions Private Limited and subscribing CA firms — defines controller/processor roles under the DPDP Act 2023.
1. Introduction and Scope
This Data Processing Agreement ("DPA") is incorporated into and forms part of the Terms of Service between Ldelight Solutions Private Limited ("Data Processor", "we", "us") and the subscribing CA firm ("Data Controller", "you") using TaxZeo.
This DPA applies to Personal Data processed by us on your behalf when you use TaxZeoto store and manage information about your clients, employees, and contacts ("Client Personal Data").
2. Definitions
- "Personal Data" means any data relating to an identified or identifiable natural person
- "Data Principal" means the individual to whom Personal Data relates (e.g., your client)
- "Data Fiduciary / Controller" means the entity that determines the purpose and means of processing (you)
- "Data Processor" means the entity that processes data on behalf of the Controller (us)
- "Processing" means any operation performed on Personal Data including collection, storage, use, disclosure, and deletion
- "DPDP Act" means the Digital Personal Data Protection Act, 2023
3. Roles and Responsibilities
3.1 You (Data Controller / Fiduciary) are responsible for:
- Ensuring lawful basis for collecting and uploading client data into TaxZeo
- Obtaining necessary consents from your clients for processing their data
- Ensuring the accuracy and completeness of data entered
- Responding to Data Principal requests (access, correction, erasure) from your clients
- Issuing a privacy notice to your clients regarding their data being stored in cloud software
- Ensuring you are using TaxZeo for lawful CA practice management purposes only
3.2 We (Data Processor) are responsible for:
- Processing Client Personal Data only on your documented instructions
- Maintaining the security measures described in this DPA
- Informing you if, in our opinion, an instruction violates applicable law
- Notifying you of any data breach affecting Client Personal Data within 72 hours of becoming aware
- Deleting or returning Client Personal Data upon termination of the Service
- Making available information necessary to demonstrate compliance with this DPA
4. Details of Processing
Nature and Purpose
Storing, organising, and providing access to client financial, compliance, and contact data to enable CA practice management services.
Types of Personal Data Processed
- Contact data: names, email addresses, phone numbers, postal addresses
- Financial identifiers: PAN, GSTIN, TAN, Aadhaar (if provided)
- Financial data: income, tax filings, compliance deadlines, invoices
- Business data: company names, registration numbers, director details
- Documents: ITR, GST returns, financial statements (uploaded by you)
Categories of Data Principals
Your clients (individuals, HUFs, partnerships, companies, LLPs) and their authorised representatives.
Duration
For the duration of your active subscription plus 90 days post-termination for data export.
5. Technical and Organisational Security Measures
- Encryption at rest: AES-256 for database and file storage
- Encryption in transit: TLS 1.3 for all API and web communications
- Access control: RBAC — data accessible only to authorised firm users
- Infrastructure: AWS ap-south-1 (Mumbai) with VPC isolation
- Logging: comprehensive audit logs of data access and modifications
- Backup: automated daily encrypted backups retained 30 days
- Incident response: documented procedure with 72-hour breach notification obligation
- Personnel: all staff with data access are bound by confidentiality obligations
- Vendor assessment: sub-processors evaluated for security before engagement
6. Sub-processors
We use the following sub-processors to deliver the Service. All sub-processors are bound by data protection obligations equivalent to this DPA:
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting and storage | India (ap-south-1) |
| Razorpay Software Pvt. Ltd. | Payment processing | India |
| Postmark / AWS SES | Transactional email delivery | India/US |
| Cloudflare | Security and CDN | Global |
We will notify you of any changes to sub-processors with 14 days' advance notice.
7. Data Breach Notification
In the event of a personal data breach affecting Client Personal Data, we will:
- Notify you within 72 hours of becoming aware of the breach
- Provide details: nature of breach, categories and volume of data affected, likely consequences, and measures taken or proposed
- Cooperate with you to fulfil any notification obligations you have to affected Data Principals or the Data Protection Board of India
8. Assistance with Data Principal Rights
We will provide reasonable technical assistance to enable you to respond to Data Principal requests (access, correction, erasure, portability) as required under the DPDP Act. Contact us at support@zeohq.com with the request details.
9. Deletion or Return of Data
Upon expiry or termination of your subscription, you may export all Client Personal Data via Settings → Export within 90 days. After 90 days, we will permanently delete all Client Personal Data from our systems and backups (within a further 30 days for backups).
Ldelight Solutions Private Limited
CIN: U47912UP2024PTC196580
A7 Second Floor, Sector 10, Noida, Uttar Pradesh – 201301, India
© 2026 Ldelight Solutions Private Limited. All rights reserved. TaxZeo is a registered trademark of Ldelight Solutions Private Limited.