Data Security Policy

1. Scope

This policy applies to all information Numeriq Global Consulting ("we", "us") receives from clients, prospective clients and visitors to www.numeriqglobal.com, in connection with our bookkeeping, taxation and compliance services for the United Kingdom, United States, Canada and India. It applies to our promoters, employees, trainees and anyone else who works on client engagements.

2. Information we handle

• Enquiry details you submit on our website or by WhatsApp or email: name, company, email, phone, country, the service needed and your message.
• Engagement data needed to deliver our services, such as accounting records, bank and card statements, invoices and bills, payroll information, tax returns and notices, registration documents, and tax identifiers (for example PAN, GSTIN, UTR, EIN or Business Number).
• Access to your systems that you grant us, such as user access to QuickBooks, Xero, Sage, Zoho Books, Tally, payroll software or bank feeds.

We ask only for information we need for the work agreed in your engagement letter.

3. How we use information

• To respond to your enquiry and prepare a proposal.
• To perform the services in your engagement, such as bookkeeping, reconciliations, returns, filings and advisory.
• To meet our legal, regulatory and professional obligations.
• To bill for our services and keep our own records.

We do not sell client information, use it for marketing to third parties, or share it except as described in this policy or as required by law.

4. Professional confidentiality

As a firm promoted by members of the Institute of Chartered Accountants of India (ICAI), we treat client information as confidential, in line with the ICAI Code of Ethics. In particular:

• Every team member signs a confidentiality and non-disclosure agreement before working on client files, and the obligation continues after they leave.
• We can sign a client-specific NDA or data-processing terms on request.
• We disclose client information to a third party, such as a tax authority, only with your authorisation, or where we are legally or professionally required to.

5. Access control

• Need-to-know: access to a client's data is limited to the team members assigned to that engagement, and is reviewed by a Chartered Accountant.
• Individual logins: each person uses their own credentials. Logins are not shared between team members.
• Multi-factor authentication is switched on wherever the software supports it.
• Prompt removal: access is withdrawn when a team member leaves or no longer works on an engagement, and when an engagement ends.
• Our internal admin portal for enquiries, quotations and billing is restricted to authorised promoter logins.

6. Secure sharing & storage

• Software access: we ask you to invite us as a user or accountant in your accounting or payroll software, so you control and can revoke our access at any time. We do not ask for your personal login password.
• Documents: we exchange files through secure, access-controlled cloud folders or encrypted links rather than ordinary email attachments where possible.
• Encryption: our website and the systems we use are accessed over encrypted HTTPS/TLS connections. Data held with our cloud providers is encrypted at rest by those providers.
• Passwords and bank credentials are never requested over WhatsApp, SMS or email.
• Client files are kept in organised, access-restricted folders, separated by client.

7. Devices & office

• Work devices are password-protected, lock automatically when idle, and have current operating-system updates and anti-malware protection.
• Client data is not copied to personal devices, USB drives or personal email accounts.
• Physical documents are kept in a secured office and are shredded when no longer required.

8. Third-party services

We use reputable service providers to run our practice. These include cloud accounting platforms (the ones you use, or ones agreed with you), secure document storage, email, our website host (Vercel) and our database provider (Supabase), which stores website enquiries and our billing records. These providers process data under their own security and privacy commitments. We only use them for the purposes described here.

9. Cross-border work

Our team works from India. For clients in the United Kingdom, United States and Canada, this means information may be accessed or processed in India. We apply the same safeguards to all clients, wherever they are located, and we are happy to agree contractual terms that support your obligations under the data-protection laws that apply to you. Examples include the UK GDPR, Canada's PIPEDA, applicable US state privacy laws and India's Digital Personal Data Protection Act, 2023.

10. Retention & deletion

• We keep engagement records for the period required by applicable law and professional standards, and for any longer period you agree with us.
• Website enquiries that do not lead to an engagement are deleted after a reasonable period.
• When an engagement ends, we remove our access to your systems. On request, we return or securely delete your data, except records we are legally required to keep.

11. Incident response

If we become aware of unauthorised access to, or loss of, client information, we will:

• act immediately to contain it;
• notify the affected client without undue delay, with the facts known at that time;
• help the client with any notifications they need to make; and
• review what happened and strengthen our controls.

12. Your rights

You may ask us at any time to:

• tell you what personal information we hold about you;
• correct inaccurate information;
• delete information we are not required to retain; or
• withdraw consent to being contacted about an enquiry.

Send requests to info@numeriqglobal.com. We respond within a reasonable time and may need to verify your identity first.

13. How you can help

• Share files through the secure channel we provide rather than by WhatsApp or plain email.
• Never send passwords, one-time passcodes (OTPs) or full card numbers. We will never ask for them.
• Tell us promptly when someone on your side who has been in contact with us leaves or changes role.
• Verify any unexpected request for payment or for a change to our bank details by calling us on +91 95884 06033.

14. Changes & contact

We review this policy periodically and post any changes on this page, with a new "last updated" date.