GDPR Compliance & Data Rights

Protecting personal data and respecting client confidentiality is fundamental to my practice at NovaRock Advisory. This statement outlines the data protection principles adhered to in accordance with the General Data Protection Regulation (GDPR), the Digital Personal Data Protection Act (DPDPA) in India, and statutory US Internal Revenue Service (IRS) preparer standards.

1. Client Data Rights

1.1 Right of Access

You have the right to request confirmation of whether your personal data is being processed and to receive a clear copy of the personal and financial records held in your client file.

1.2 Right to Rectification

If any personal, banking, or tax details are inaccurate or incomplete, you have the right to request immediate correction upon verification.

1.3 Right to Erasure

You may request the deletion of your personal records. Please note that requests for erasure remain subject to mandatory statutory retention rules prescribed by SEBI, AMFI, and the US IRS, which require financial and tax workpapers to be maintained for regulatory audit periods (typically 7 to 10 years).

1.4 Right to Restrict Processing

You have the right to request limits on the processing of your personal data while the accuracy of records is being verified or contested.

1.5 Right to Data Portability

You may request your financial schedules and submitted documentation in a structured, commonly used, machine-readable format.

1.6 Right to Object

You have the right to object to the processing of your data for discretionary communications or advisory newsletters at any point.

1.7 Right to Withdraw Consent

Where data processing relies on explicit consent, you retain the authority to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to the withdrawal.

2. Data Protection & Security Measures

2.1 Transport Layer Security

All data transmitted across this website and its intake portals is protected using industry-standard TLS/SSL encryption protocols to prevent unauthorized interception.

2.2 Access Restrictions

Client workpapers, government identifiers, and financial records are restricted strictly to authorized administrative workflows and are not accessible to external third parties.

2.3 Data Minimization

I collect only the specific documentation necessary to fulfill regulatory Know Your Customer (KYC) requirements, execute mutual fund transactions via authorized RTAs, and prepare US tax returns. Personal records are never sold, rented, or commercialized.

2.4 Statutory Retention

Records are retained only for the duration of the active advisory relationship and for mandatory statutory periods required under Indian financial laws and US Department of the Treasury regulations.

3. Exercising Your Rights

To submit a formal data request or exercise your rights, contact my desk directly:

All verified privacy inquiries will be acknowledged and processed within 30 days.

4. Cross-Border Data Transfers

My practice operates primarily out of India while delivering cross-border tax preparation for clients subject to US tax jurisdiction. When cross-border transmission of tax filings occurs (e.g., electronic filing directly to the IRS), standard encryption and approved regulatory transmission gateways are utilized to ensure confidentiality.

5. Supervisory Authority & Grievance Redressal

If you have unresolved concerns regarding data handling, you have the right to lodge a formal complaint with the relevant supervisory body. In India, regulatory oversight falls under the Ministry of Electronics and Information Technology (MeitY) and the Data Protection Board. For mutual fund grievances, complaints may be directed through the SEBI SCORES portal[cite: 4, 6].

6. Governing Statement

This compliance summary functions alongside the comprehensive Privacy Statement and Terms & Conditions of NovaRock Advisory.