Privacy Policy

1. Who we are

Submit Return® is a registered trademark of eEasy interMESH Private Limited, a company incorporated in India with its registered office in Jaipur, Rajasthan, India. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), eEasy interMESH Private Limited is the Data Fiduciary in respect of personal data collected through submitreturn.com.

2. What personal data we collect

We collect the following categories of personal data:

• Identification data: Name, PAN, Aadhaar reference (for ITR filing), date of birth.
• Contact data: Mobile number, email address, postal address.
• Financial data (for filing only): Form 16, salary details, bank statements, investment proofs, capital gains statements, business income, deductions claimed.
• Usage data: Pages visited, calculator inputs (locally processed), device type, IP address, referrer.
• Communication records: WhatsApp, call, and email exchanges with our team.

The calculator on this website processes all numerical inputs locally inside your browser. Income figures are not transmitted to our servers unless you choose to engage us for filing.

3. Purpose of processing

We process your personal data only for the following purposes:

• Providing ITR filing, tax computation, and related advisory services.
• Assigning your filing case to an empanelled Chartered Accountant.
• Responding to your queries via call, WhatsApp, or email.
• Sending you transactional updates (acknowledgments, status, reminders).
• Compliance with applicable tax, accounting, and audit laws.
• Improving the website and our services.

4. Lawful basis

We rely on the following lawful bases under the DPDP Act:

• Consent — provided by you when you submit your details, accept this policy, and tick the consent boxes.
• Legitimate use — performance of a contract you have entered into with us (ITR filing service).
• Legal compliance — statutory obligations under the Income Tax Act, 1961 and rules thereunder.

5. Sharing your data

We share your personal data only with:

• Empanelled Chartered Accountants assigned to your filing case — on a strict need-to-know basis, bound by confidentiality.
• Government and regulatory authorities — the Income Tax Department, when filing your ITR; or in response to a legally valid demand.
• Service providers — cloud hosting, document storage, communication tools — all bound by written data-protection agreements.

We do not sell, rent, or trade your personal data. We do not share it with marketers, advertisers, or unrelated third parties for their own purposes.

6. Your rights as a Data Principal

Under the DPDP Act, you have the following rights:

• Right to access — a summary of your personal data with us, and the parties it has been shared with.
• Right to correction and erasure — correct inaccurate data; erase data we no longer need.
• Right to grievance redressal — raise complaints to our Grievance Officer (details below).
• Right to nominate — appoint another individual to exercise your rights in case of death or incapacity.
• Right to withdraw consent — you may withdraw consent at any time. Note: this may prevent us from completing services already in progress.

To exercise any of these rights, write to grievance@submitreturn.com.

7. Data retention

We retain your data only as long as necessary for the stated purposes, or as required by applicable law. ITR filing records are retained for seven years from the end of the relevant assessment year, in line with the Income Tax Act's record-keeping requirements. After this period, data is securely deleted unless retention is needed for an ongoing legal matter.

8. Data security

We employ reasonable security safeguards including:

• TLS encryption for data in transit.
• Access controls on document storage (least-privilege access).
• Periodic security reviews.
• Confidentiality and non-disclosure undertakings from all empanelled CAs and team members.

While we follow industry best practices, no method of transmission or storage is 100% secure. If a Personal Data Breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required by the DPDP Act.

9. Cookies and similar technologies

This site uses essential cookies for session management and Google Analytics 4 for aggregated usage statistics. No personally identifying advertising cookies are set without your consent. You can disable cookies through your browser settings.

10. Children's data

Our services are intended for individuals aged 18 and above. We do not knowingly collect personal data of children under 18. If we become aware that such data has been collected without verifiable parental consent, we will delete it promptly.

11. Cross-border transfer

Your personal data is primarily processed and stored in India. Some of our service providers (e.g. cloud hosting, analytics) may process data outside India in jurisdictions notified by the Government of India. Such transfers comply with the DPDP Act and applicable safeguards.

12. Grievance Officer

If you are unsatisfied with our response, you may approach the Data Protection Board of India established under Section 18 of the DPDP Act.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email (where you have provided one) and posted prominently on this page. The "Last updated" date at the top reflects the most recent revision.

14. Contact

For any privacy-related questions, write to support@submitreturn.com or our Grievance Officer at grievance@submitreturn.com.

---

This Privacy Policy is governed by the laws of India. Any disputes arising from it shall be subject to the exclusive jurisdiction of the courts at Jaipur, Rajasthan.