1 Introduction & Statutory Legal Framework

Welcome to KarBandhu, India's specialized taxation, corporate compliance, and advisory portal operated by KarBandhu Advisory Services (hereinafter referred to as the "Platform", "Data Fiduciary", "KarBandhu," "we," "our," or "us", having its principal place of administration at Lucknow, Uttar Pradesh, India). This Data Retention and Destruction Policy governs the systematic archival, lifecycle retention, cryptographic protection, and irreversible disposal of digital personal data, tax computations, corporate records, financial filings, and system audit logs across www.karbandhu.in (the "Website").

As a regulated tax facilitation enterprise and technology intermediary, KarBandhu's data lifecycles are anchored in strict compliance with the following enactments of the Republic of India:

• Section 8(7) of the Digital Personal Data Protection Act, 2023 (DPDP Act), which mandates that a Data Fiduciary must erase personal data as soon as the specified purpose is fulfilled or consent is withdrawn, unless retention is required for compliance with any law for the time being in force;
• The Income Tax Act, 1961 (including Sections 44AA, 147, 148, and 149), governing the statutory maintenance and reassessment limitation periods for books of accounts and tax return dossiers;
• Section 36 of the Central Goods and Services Tax (CGST) Act, 2017, prescribing mandatory record preservation timelines for tax invoices, debit/credit notes, and input tax credit ledgers;
• Section 128(5) of the Companies Act, 2013, mandating the retention of corporate books of accounts and statutory registers;
• The Prevention of Money Laundering Act, 2002 (PMLA) and RBI Master Directions on Know Your Customer (KYC), mandating client identity verification retention;
• CERT-In Cyber Security Directions (April 28, 2022) issued under Section 70B of the Information Technology Act, 2000, governing system log preservation;
• Rule 3(1)(h) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, prescribing user registration data retention.

This Policy must be read in conjunction with our Privacy Policy, Terms & Conditions, and Grievance Redressal Policy.

2 Our Core Institutional Commitment

KarBandhu is committed to the foundational principle of Storage Limitation and Purpose Proportionality. We recognize that our platform handles highly confidential financial statements, bank account statements, PAN and Aadhaar credentials, military service records, profit & loss accounts, and corporate board resolutions.

Accordingly, KarBandhu commits that data entrusted to us shall never be stored indefinitely or commodified. Every digital record is tagged with an immutable retention lifecycle governed by statutory limitation periods, after which it undergoes automated cryptographic destruction or irreversible anonymization.

3 Retention Period Determining Factors

The retention duration for any given data artifact on KarBandhu is determined by balancing four interdependent criteria:

• Statutory Preservation Mandates: Explicit record-keeping periods mandated by Indian tax, corporate, banking, or anti-money laundering legislation;
• Limitation Periods for Legal Claims: Statutory timeframes under the Limitation Act, 1963 for defending against contractual claims, tax reassessment notices, or commercial disputes;
• Service Continuity & Taxpayer Utility: Preserving historical ITR acknowledgments and depreciation schedules so clients can demonstrate ongoing compliance or apply for credit/visas;
• Cybersecurity & Forensic Auditing: Preserving system access trails to detect intrusions, investigate fraud, and satisfy CERT-In forensic mandates.

4 Platform Statutory Data Retention Schedule

To provide complete regulatory transparency, KarBandhu establishes the following binding Data Retention Schedule across all platform domains:

5 Direct Tax & Income Tax Records

Under Indian tax jurisprudence, the Income Tax Department possesses statutory jurisdiction under Sections 147 and 148 of the Income Tax Act, 1961 to reopen assessments where escaped income is suspected for up to 3 years in normal cases, and up to 10 years in cases involving income exceeding Rs. 50 Lakhs or assets outside India.

To ensure our clients possess complete defense dossiers in the event of scrutiny notices under Section 143(2) or reassessment notices under Section 148A, KarBandhu maintains filed return XML/JSON schema files, computation sheets, capital gain registers, Form 10E relief claims, and government ITR-V acknowledgments in cold encrypted storage for up to 10 Assessment Years.

6 Indirect Tax & GST Records

Pursuant to Section 36 of the CGST Act, 2017, every registered taxpayer is legally obligated to retain books of accounts and related records until the expiry of 72 months (6 years) from the due date of furnishing the annual return for the relevant financial year.

Where an empanelled CA files monthly GSTR-1, quarterly GSTR-3B, or annual GSTR-9 returns on behalf of a registered enterprise, all underlying sales registers, purchase registers, Input Tax Credit (ITC) reversal calculations, and ARN generation slips are archived for a minimum period of 6 to 8 years to withstand departmental GST audits under Section 65 or special audits under Section 66.

7 Corporate, ROC & Accounting Records

In accordance with Section 128(5) of the Companies Act, 2013, the books of account of every company relating to a period of not less than 8 financial years immediately preceding a financial year must be kept in good order. Furthermore, permanent company records—including the Certificate of Incorporation, Memorandum of Association (MOA), Articles of Association (AOA), and share transfer registers—must be maintained permanently by the corporate entity.

KarBandhu archives MCA filing acknowledgments, SRN transaction receipts, digital director signatures logs, and statutory audit workpapers prepared by empanelled professionals for the mandatory 8-year duration.

8 Customer Identity, KYC & PMLA Records

Under the Prevention of Money Laundering Act, 2002 and the Prevention of Money Laundering (Maintenance of Records) Rules, 2005, professional tax advisors and financial reporting entities are mandated to preserve client verification records for a period of 5 years after the business relationship with the client has ended or the account has been closed.

Customer identification files—including UIDAI-compliant masked Aadhaar files, PAN verification tokens, address proofs, and representative authorizations—are retained for 5 years following account closure, after which they are flagged for cryptographic purging.

9 Empanelled Professional Information

For independent Chartered Accountants, Company Secretaries, Cost Accountants, and Tax Advocates registered under the KarBandhu Professional Network (KB-P), KarBandhu retains professional verification files throughout their empanelment and for 7 years following dissociation. This information includes:

• ICAI / ICSI / Bar Council registration certificates, COP validations, and educational credentials;
• Banking account verification records, PAN, and GST registration details for payout settlement;
• Case token engagement logs, client communication transcripts, and internal peer-review quality ratings;
• Disciplinary records, client complaint dockets, and escrow payout reconciliations.

Retention is strictly required for legal defense, contractual indemnity enforcement, and responding to statutory regulatory summons.

10 Technical Telemetry & CERT-In Cyber Logs

Pursuant to Direction No. 20(3)/2022-CERT-In issued by the Indian Computer Emergency Response Team under Section 70B(6) of the IT Act, 2000, all ICT organizations are legally required to enable and maintain logs of all ICT systems for a rolling duration of 180 consecutive days within Indian territorial jurisdiction.

KarBandhu maintains firewall transaction records, portal login timestamps, OTP authentication logs, user IP addresses, and database query audit trails for 180 days to 1 year. These logs are stored in tamper-proof, append-only repositories and utilized exclusively for cyber defense and forensic verification.

11 Erasure Requests vs. Statutory Override

Under Section 12(1)(d) of the Digital Personal Data Protection Act, 2023, every Data Principal possesses the right to request the erasure of their personal data. However, the DPDP Act expressly recognizes that this right is subordinate to statutory compliance obligations under Section 8(7) and Section 17 of the Act.

12 Media Sanitization & Destruction Standards

Upon the expiration of the statutory retention periods stipulated in Section 4, KarBandhu executes irreversible data destruction protocols adhering to industry-leading international sanitization benchmarks:

Electronic & Cloud Data Sanitization (NIST SP 800-88 Rev. 1)

All digital records scheduled for disposal undergo media sanitization conforming to NIST Special Publication 800-88 Rev. 1 (Guidelines for Media Sanitization) Clear and Purge standards:

• Cryptographic Erasure (CE): Irreversible deletion of Master Decryption Keys from Key Management Services (AWS KMS / Cloud HSM), rendering ciphertext mathematically unrecoverable;
• Multi-Pass Overwriting: For virtual disk blocks and database partitions, overwriting data sectors with pseudo-random cryptographic bit patterns;
• Immutable Log Purging: Permanent cascading deletion across primary database clusters, search indexes, and operational caches.

Physical Media & Hardcopy Document Shredding

Where physical hardcopies (such as physical bank statements or paper authorizations delivered to our Lucknow administrative office) are slated for destruction, they are subjected to cross-cut micro-shredding conforming to DIN 66399 Security Level P-4 or higher, reducing physical fibers to un-reassembleable particles.

13 Disaster Recovery & Encrypted Backups

KarBandhu maintains encrypted, geo-redundant backups for disaster recovery and operational continuity within enterprise Tier-IV data centers located within the Republic of India. Backup snapshots are encrypted with AES-256 and undergo automatic rolling rotation.

When records are deleted from active databases, they are aged out of cyclical backup snapshots in accordance with our 30-day backup retention lifecycle. Restoring a disaster recovery snapshot automatically re-applies deletion logs to prevent deleted data from being restored.

14 Legal Holds & Regulatory Inquiries

Notwithstanding anything contained in the routine retention schedule, when KarBandhu receives formal notice of an ongoing judicial proceeding, regulatory investigation by CBDT, CBIC, or MCA, an arbitration petition, a criminal complaint, or a tax reassessment inquiry, routine destruction protocols are immediately suspended under a Mandatory Legal Hold.

Relevant digital evidence, communication threads, and computational workpapers are frozen and preserved until the legal matter has achieved final judicial disposal and all limitation periods for appeal have expired.

15 Data Security & Cryptographic Safeguards

All retained records are protected through defense-in-depth technical and organizational controls:

• Encryption at Rest & Transit: Retained files are encrypted at rest using AES-256 and transmitted across public networks using TLS 1.3 cryptographic tunnels;
• Principle of Least Privilege: Role-Based Access Control (RBAC) ensures that only the empanelled professional assigned to an active token possesses access to client tax documents;
• Multi-Factor Authentication (MFA): Mandatory time-based OTP (TOTP) verification for all administrative and professional portal logins;
• Zero Third-Party Commodification: Client data is never sold, leased, or monetized for commercial advertising or third-party behavioral profiling.

16 User Self-Archival Responsibility

While KarBandhu maintains an encrypted vault for customer convenience throughout statutory timeframes, the platform operates as a tax and compliance facilitator, not an indefinite free document repository. Clients are strongly advised to:

• Download and independently archive their ITR-V acknowledgments, computation sheets, capital gain registers, and tax challans immediately upon filing completion;
• Maintain offline encrypted backups of original financial records, audited balance sheets, and GST invoices;
• Ensure their registered email and phone numbers remain active to receive critical statutory alerts and filing acknowledgments.

17 Anonymized & Aggregated Analytics

In accordance with the DPDP Act 2023, data that has been irreversibly anonymized, de-identified, or aggregated such that it can no longer identify or be associated with an individual Data Principal ceases to constitute digital personal data.

KarBandhu reserves the right to retain anonymized analytical metrics indefinitely for platform latency monitoring, financial calculator benchmarking, statistical research, and capacity planning.

18 Policy Amendments & Regulatory Updates

KarBandhu Advisory Services reserves the right to modify, amend, or update this Data Retention and Destruction Policy periodically to maintain alignment with judicial interpretations, circulars issued by CBDT/CBIC, directions from MeitY, or rules promulgated under the DPDP Act 2023.

All modifications will be published on www.karbandhu.in with an updated revision date. Continued utilization of our services constitutes voluntary acceptance of the amended policy.

19 Governing Law & Exclusive Jurisdiction

This Data Retention & Destruction Policy shall be governed by, interpreted, and construed in accordance with the laws of the Republic of India.

Any dispute, controversy, claim, or proceeding arising out of or in connection with the retention, storage, archival, or destruction of data by KarBandhu shall be subject to the exclusive jurisdiction of the competent courts situated at Lucknow, Uttar Pradesh, India.