Privacy Policy.

1.1 Information you provide to us

Contact information: name, email address, phone number, company name, designation, and other details you provide when you enquire, book a call, sign an engagement letter, or communicate with us.

Business and financial information: financial records, management accounts, transaction data, banking details, accounting records, vendor and customer information, tax records, and other business data shared in connection with our services.

Communications: the content of emails, messages, and other communications you send us.

1.2 Information we collect automatically

Usage data: pages viewed, features used, and actions taken on our website.

Device and technical data: IP address, browser type, operating system, and device identifiers.

Cookies and similar technologies: used to understand how our website is used; you can manage these through your browser settings.

1.3 Information from third parties

• Connected tools and service providers you authorise us to access in order to deliver the services.
• Publicly available sources, such as records filed with the Ministry of Corporate Affairs (MCA), GST portals, and other public registries.

• To provide our services, including financial reporting, MIS, cash-flow and compliance oversight, and advisory work as set out in your engagement.
• To communicate with you, including responding to enquiries, sending service-related notices, and delivering reports.
• To process payments for our services.
• To improve our services, including analysing usage and developing our processes, using aggregated, de-identified data.
• To meet legal and regulatory obligations, including responding to lawful requests from authorities and maintaining records as required by law.
• To protect our rights and yours, including preventing fraud and security incidents and enforcing our agreements.

We do not sell your personal information. We may share it in the following circumstances:

3.1 Service providers

We share information with trusted service providers who perform functions on our behalf — such as cloud hosting, software platforms, payment processing, and professional advisers — under confidentiality and data-protection obligations.

3.2 With your consent

We share information with third parties where you have given us consent to do so.

3.3 Legal compliance and protection

We may disclose information where required by law, regulation, or legal process, or where we believe in good faith that disclosure is necessary to comply with the law, protect our rights, prevent wrongdoing, or protect the safety of our clients or others.

3.4 Business transfers

If we are involved in a merger, acquisition, reorganisation, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

3.5 Aggregated and de-identified data

We may share aggregated or de-identified data that cannot reasonably be used to identify you.

We implement reasonable security practices and procedures as required under the Information Technology Act, 2000 and applicable rules, designed to protect your information from unauthorised access, use, alteration, or disclosure. These include:

• Encryption of sensitive data in transit and, where appropriate, at rest;
• Access controls limiting access to authorised personnel who need it;
• Multi-factor authentication for systems holding client data;
• Monitoring and logging of access to client data;
• Vendor obligations requiring our providers to maintain appropriate safeguards.

No method of transmission or storage is completely secure. While we use reasonable measures to protect your information, we cannot guarantee absolute security.

We retain your information for as long as necessary to provide our services, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. When information is no longer required, we securely delete or de-identify it in accordance with applicable law.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may have the right to:

• Access the personal information we hold about you;
• Correct, complete, or update inaccurate or incomplete information;
• Request erasure of your personal information, subject to legal and contractual retention requirements;
• Withdraw consent previously given, without affecting processing already carried out;
• Nominate another individual to exercise your rights in the event of death or incapacity;
• Grievance redressal through our Grievance Officer (see Section 11).

To exercise any of these rights, contact us at info@cfocraft.com. We may verify your identity before responding.

Our website uses cookies and similar technologies to understand usage and improve your experience. You can manage or disable cookies through your browser settings, though some features may not function as intended if you do.

Our services are directed to businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. Where the processing of a child's data is involved, we will obtain verifiable consent from a parent or lawful guardian as required by law. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.

Our website may contain links to third-party websites and services. We are not responsible for their privacy practices, and we encourage you to review the privacy policies of any third-party services you use.

Where we transfer or store data outside India, we do so in accordance with applicable law and require that the receiving parties maintain appropriate data-protection safeguards.

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, you may contact our Grievance Officer with any concern or complaint regarding the processing of your personal information:

We will acknowledge and address grievances within the timelines prescribed by applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Where changes are material, we will post the updated policy on our website and, where required, provide direct notice. The "Last updated" date above indicates when the policy was last revised.

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at: