Legal

For clients of firms

A short note for people who upload documents, pay invoices or sign in to a client portal through CA Bundals. Effective 1 October 2026.

Items in highlighted brackets are still to be completed. Until they are, this page is a draft and not in force.

1. Who has your data

You are seeing this because your accountant, CA, CS or tax practitioner (the "firm") uses CA Bundals to request documents, share information or collect fees. The firm is responsible for your data. It decides what to ask for and why, and it is the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023.

CA Bundals is software run by Bundals Private Limited. We store and process your data only for the firm, on its instructions, as its "Data Processor". We do not use it for our own purposes, do not sell it and do not advertise to you.

2. What happens to what you send

  • Documents you upload through a link go straight to the firm’s secure file store in CA Bundals. Only the firm (and people it gives access to) can see them.
  • If you pay an invoice through a payment link, the payment is processed by Razorpay. We never see your full card or UPI details. The payment is for the firm’s fees; questions about the amount or refunds go to the firm.
  • If you sign in to the client portal, we send an OTP to your mobile number by SMS to confirm it is you.
  • The firm may send you reminders and updates by WhatsApp from its own business number, or by SMS or email.
  • Your data is stored mainly on servers in India and protected with encryption and access controls.

3. Your rights — contact the firm first

To ask what data the firm holds about you, to correct or delete it, to withdraw consent, or to complain, please contact the firm directly — its name is shown on the upload or payment page. The firm must respond under the DPDP Act.

If you cannot reach the firm, or you think a link reached you by mistake, email our Grievance Officer at info@bundals.com. We will pass your request to the firm and help it respond. If your complaint is not resolved, you may approach the Data Protection Board of India.

4. Keep your links private

Upload and payment links work without a password, so anyone who has the link can use it. Do not forward them. If you think someone else has your link, ask the firm to cancel it and send a new one.

5. More detail

Our full Privacy Policy explains how CA Bundals handles personal data.

Other legal pages: Terms of Service · Privacy Policy · Data Processing Agreement · Refund & Cancellation · Acceptable Use · Notice to clients of firms