Evotax Staff mobile app privacy policy

1. Who we are

Evotax is a tax practice based in India, trading as Evotax and registered as Evo Consulting Services Private Limited. It operates the Evotax Staff app and is the data fiduciary — the controller — for the personal data described in this policy. That includes both the data we hold about you as a staff user and the client data you handle on Evotax’s behalf.

Controller identity

The app this policy covers

2. Data we collect about you, the app user

This is everything the app collects about you as an Evotax staff member. There is nothing else.

3. Client data you handle through the app

The app gives you access to personal data belonging to Evotax’s tax clients. Evotax is the controller of that data. You handle it on Evotax’s behalf, and only for genuine work purposes.

4. What the app does not collect or do

Each statement below was verified against the app’s source code, not assumed from a template.

5. Device permissions

The app asks for each permission only when you first use the feature that needs it, never at launch. The app stays usable if you decline any of them — only that one feature is disabled. You can change your mind at any time in your device settings.

6. What is stored on your device

7. Why we process this data

• Authenticating you and keeping you signed in.
• Applying the permissions attached to your role and business unit, so you see only what your work requires.
• Assigning, tracking and completing client tax work.
• Sending you work notifications about assignments, payments and deadlines.
• Recording who changed what and when, so a client file has a reliable history.
• Keeping the service secure, detecting abuse and diagnosing faults.
• Meeting Evotax’s own obligations as a tax practitioner, including statutory record-keeping.

We do not process any of it for advertising, for resale, or for profiling people.

8. Legal basis for processing

9. Who we share data with

We use the service providers below to run the app and the systems behind it. Each processes data on Evotax’s instructions and for no purpose of its own. This is the full list.

Other disclosures

• When we are legally compelled. We disclose data where a court, a tax authority or a regulator lawfully requires it. We check that a request is valid and disclose only what it covers.
• On a merger or acquisition. If Evotax is merged with or acquired by another business, data may transfer as part of that. The receiving business would be bound by this policy until it publishes a replacement, and we would tell affected people.
• Nothing else. We do not sell personal data and we do not share it for advertising.

10. International transfers

Some of the providers listed in section 9 process data outside India, in the United States and the European Union. Where that happens, the transfer is covered by the contractual protections in our agreement with that provider, which restrict the provider to processing on our instructions and require it to protect the data. We do not transfer personal data to any country that the Central Government has restricted under the DPDP Act.

11. How long we keep data

Statutory tax record-keeping is the one thing that overrides a deletion request. As a tax practitioner Evotax must be able to produce books, records and filing evidence for the periods Indian tax law prescribes, so those records are kept until the relevant period expires even if the person concerned asks for erasure. When we act on a deletion request we tell the person exactly which records we kept and how long we must keep them.

12. Security measures and breach notification

• TLS encryption for everything in transit between the app and our servers.
• Hardware-backed secure storage for session tokens — iOS Keychain and Android Keystore, through the operating system API.
• Passwords stored only as salted hashes. We cannot read them.
• Encryption at rest for sensitive stored credentials, including client tax portal passwords.
• Role-based access control, so a staff member sees only the records their role and business unit permit.
• Audit logging of record changes and of every view of a client tax portal credential.
• Rate limiting on login attempts, to slow credential-guessing.
• Automatic sign-out when a session expires.

If there is a breach

If personal data is breached, we notify each affected person and the Data Protection Board of India, in the form and within the time the DPDP Act requires. The notice tells the affected person what happened, what data was involved, what we are doing about it, and what they can do to protect themselves.

13. Your rights under the DPDP Act

As a data principal under the Digital Personal Data Protection Act, 2023, you have the rights below.

To exercise any of them, email info@evotaxes.com from your work email address. We respond within 30 days. If you are not satisfied with how we handle it, you can complain to the Data Protection Board of India.

14. Account and data deletion

Accounts in this app are provisioned by an Evotax administrator, not created by the user, so there is no in-app delete button. Deletion is handled by request, and we act on every request we receive.

How to request deletion

1. Email info@evotaxes.com with the subject line Account deletion request, or call +91 901 963 5151.
2. We verify that the request genuinely comes from the account holder.
3. We disable the account, so it can no longer sign in.
4. We delete the push notification tokens and session data associated with it.
5. We delete your personal data, except for records we are legally required to retain — see section 11.
6. We tell you what was deleted, what was kept, why it was kept, and for how long we must keep it.

Deleting the app

Removing the app from your device deletes the files it kept locally — the session token in secure storage, and any documents or CSV exports saved in the app’s private storage. It does not delete your account or the data held on our servers, so use the request process above for that.

15. Children

This is a workplace tool for adults. It is not directed at anyone under 18, it is not available to the general public, and accounts are issued only to Evotax staff and authorised contractors. We do not knowingly collect personal data from children through this app.

16. Changes to this policy

We update this policy when the app’s data practices change. The effective date and the last updated date are both shown at the top of this page, so you can tell at a glance whether anything has moved since you last read it. For a change that materially affects you, we notify staff users directly rather than relying on you to re-read the page. This version is effective from 22 September 2026 and was last updated on 22 September 2026.

17. Contact us

For anything about this policy, a data request, or a privacy concern: