What Nishant S Mehta & Co does with personal data that reaches us through this website. Last updated 15 October 2026.
Nishant S Mehta & Co is a firm of chartered accountants in Mumbai, working since 1999 in audit, tax advisory and legal drafting. For the personal data described on this page we decide why and how it is used, which under India's Digital Personal Data Protection Act, 2023 makes us the Data Fiduciary. You are the Data Principal.
For any question about this notice, or to use the rights listed below, get in touch through the contact page and say it is a privacy matter. The same route takes complaints about how we handle your data.
Almost nothing. The site has no forms, no visitor accounts, no analytics and no advertising, and it sets no cookies, so there is no cookie banner. Our hosting company, Hostinger, keeps ordinary server logs (your IP address, the time, the page you opened and your browser type) to keep the site running and secure.
The Community page sometimes shows a YouTube video or a Google Drive file that Dr Mehta has posted. Those are not loaded when the page opens. You choose to load each one, and when you do, Google receives your IP address and may set its own cookies under its own policy. The contact page also links out to WhatsApp, Instagram, Spotify, YouTube, X and Facebook. Following one of those links puts you under that service's privacy policy.
If you email or call us, we keep what you send: your name, your contact details, your company if you mention it, and the message itself. We use it for one purpose, which is to answer you and, if you become a client, to start the work. We do not use it for marketing and we do not share it outside the firm except where the work needs it or the law requires it.
We rely on your consent, which you give by contacting us. You can take it back at any time by getting in touch as described above. In a few cases the Act lets us use data without consent, for example to meet a legal obligation, and we keep to those uses.
Personal data we receive while acting for a client is covered by the engagement terms we agree with that client and by our professional duty of confidentiality. This notice covers the website and first contact only.
A message from someone who does not become a client is kept for 24 months after our last contact, then deleted. Client records are kept for as long as the engagement and the law on record keeping require. Server logs are kept by the host for as long as it needs them for security.
If you withdraw consent or ask us to erase your data sooner, we do it unless a law says we must keep a record.
This site is served over HTTPS. The page for posting updates sits behind a password and limits repeated failed log-ins. If a personal data breach affects you, we will tell you and report it to the Data Protection Board of India as the law requires.
The website itself sends nothing abroad except what you trigger yourself by loading a Google embed or following a link to an overseas service. The Government of India can restrict transfers to particular countries, and we follow that list.
Anyone under 18 counts as a child under the Act. This site is written for businesses and professionals and is not aimed at children. We do not knowingly collect their data and we do not track anyone.
You can ask us for a summary of the personal data we hold about you and how we use it. You can ask us to correct or update it, or to erase it. You can withdraw your consent, and doing so is as easy as giving it: tell us you want to withdraw it. You can name another person to exercise these rights for you if you die or cannot act for yourself. And you can raise a grievance with us.
Get in touch through the contact page and say it is a privacy request. We reply within 30 days. If it is still unresolved, you can complain to the Data Protection Board of India.
If we change how we handle data, we will update this page and its date.