The Services are provided to professional firms (each a "Firm") and their authorised users, who use the platform to manage engagements on behalf of their own clients. Our privacy responsibilities depend on the type of information involved:

• Account information — where we collect and use information about Firms and their users to create accounts, provide the Services, bill for them, and communicate with you, we act as the entity that determines the purposes and means of processing that information.
• Client information handled on a Firm's behalf — where a Firm uploads or generates information about its own clients (for example, filing details, documents, and correspondence), the Firm decides how that information is used, and we process it only on the Firm's documented instructions to deliver the Services. In that role, the Firm is responsible for providing notices to, and obtaining any consents from, its clients.

If you are an individual whose information was provided to us by a Firm, please direct requests about that information to the relevant Firm in the first instance; we will support the Firm in responding.

Information you provide to us

• Account and profile details such as your name, work email address, phone number, role, and the Firm you belong to.
• Authentication information used to secure your account, including credentials and multi-factor verification details.
• Content you submit into the Services, including client records, documents, notes, messages, and other materials you choose to store.
• Billing and transaction details where applicable, such as plan, invoices, and payment status. Payment card details, when used, are handled by our payment partners and are not stored by us.
• Communications with us, such as support requests, feedback, and survey responses.

Information we collect automatically

• Usage information about how you interact with the Services, such as pages viewed, features used, and actions taken.
• Device and connection information, such as browser type, operating system, approximate location derived from your network address, and identifiers used for security and diagnostics.
• Log and audit information, including access times and activity records that help us keep the Services secure and reliable.
• Cookies and similar technologies, as described in the "Cookies" section below.

We do not intentionally collect special or sensitive categories of information beyond what is necessary to provide the Services. Where the Services are used to process such information, that processing is carried out on the instructions of the relevant Firm.

We use information for the following purposes:

• To provide, operate, and maintain the Services and their features.
• To authenticate users, secure accounts, and prevent fraud, abuse, and unauthorised access.
• To personalise and improve the Services, and to develop new features.
• To process transactions and manage billing and subscriptions.
• To communicate with you about the Services, including service updates, security alerts, and administrative messages.
• To provide customer support and respond to your requests.
• To monitor performance, diagnose problems, and maintain the reliability and integrity of the Services.
• To comply with legal obligations and enforce our agreements.

We do not sell your personal information, and we do not use client content you store in the Services to build advertising profiles.

We process personal information where it is necessary to provide the Services you or your Firm have requested, to comply with our legal obligations, to pursue our legitimate interests in operating and securing the Services, and — where required by applicable law — on the basis of consent.

Where we rely on consent, you may withdraw it at any time using the contact details below or the in-product controls, without affecting processing carried out before withdrawal or processing that rests on another lawful basis.

We use cookies and similar technologies to keep you signed in, remember your preferences, maintain security, and understand how the Services are used so we can improve them. Some of these are strictly necessary for the Services to function; others help us measure and enhance performance.

You can control non-essential cookies through your browser settings or any in-product controls we provide. Disabling certain cookies may affect the availability or functionality of parts of the Services.

We share personal information only as described in this policy and never sell it. We may share information:

• Within your Firm — with authorised users of your Firm's account, according to the roles and permissions your Firm configures.
• With service providers — trusted partners who perform services on our behalf, such as hosting, communications, analytics, and payment processing. They may access information only to perform those services and are bound by confidentiality and data-protection obligations.
• For legal and compliance reasons — where we believe in good faith that disclosure is required to comply with applicable law, regulation, legal process, or a lawful governmental request, or to protect the rights, safety, and security of users, the public, or Taxos.
• In connection with a business transaction — such as a merger, acquisition, financing, or sale of assets, in which case information may be transferred subject to appropriate confidentiality and continuity of this policy.
• With your direction or consent — where you otherwise instruct us to share information.

We retain personal information for as long as needed to provide the Services, to maintain security and audit records, to comply with our legal, tax, accounting, and regulatory obligations, and to resolve disputes and enforce our agreements.

Content that a Firm stores in the Services is retained according to the Firm's use of the platform and applicable retention settings. When information is no longer required, we take reasonable steps to delete or anonymise it. Certain records may be retained in secured backups for a limited period before they are overwritten in the ordinary course.

We maintain administrative, technical, and organisational safeguards designed to protect personal information against unauthorised access, disclosure, alteration, and loss. These include encryption of information in transit and at rest, strict access controls on a need-to-know basis, multi-factor authentication, activity logging, and regular review of our security practices.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect any unauthorised use of your account.

Subject to applicable law, you may have the following rights in relation to your personal information:

• Access — to obtain a summary of the personal information we hold about you and how it is processed.
• Correction — to request that inaccurate or incomplete information be corrected or updated.
• Erasure — to request deletion of personal information that is no longer required for the purposes for which it was collected, subject to legal retention requirements.
• Withdraw consent — to withdraw any consent you have given, on a going-forward basis.
• Grievance redressal — to raise a concern about how your information is handled and to have it addressed.
• Nomination — where provided by applicable law, to nominate another individual to exercise your rights in the event of death or incapacity.

To exercise these rights, contact us using the details in the "Grievance redressal and contact" section. If your information was provided to us by a Firm, we will refer your request to that Firm and support its response. We may need to verify your identity before acting on a request.

If you have questions, concerns, or complaints about this Privacy Policy or our handling of personal information, please contact us:

• Privacy queries: hello@taxos.pro
• Grievance Officer: hello@taxos.pro
• Postal address: India

We will acknowledge and address grievances within the timelines required by applicable law. If you are not satisfied with our response, you may have the right to escalate the matter to the relevant data-protection authority.

We primarily store and process information within India. Where information is transferred to or accessed from another country — for example, by a service provider — we take steps to ensure it continues to be protected consistent with this policy and applicable law, and we transfer information only to jurisdictions permitted under applicable law.

The Services are intended for use by professional firms and their authorised users and are not directed to children. We do not knowingly collect personal information directly from children. Where information about a minor is processed within the Services, it is provided by a Firm in the course of its engagement and handled on the Firm's instructions and responsibility.

The Services may contain links to, or integrations with, third-party websites and services that we do not control. This policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice within the Services or by other means. Your continued use of the Services after an update takes effect constitutes acceptance of the revised policy.

For any questions about this Privacy Policy, contact us at hello@taxos.pro or write to Taxos, India.