Legal
Privacy Policy
- We collect only what you send us and what we need to deliver Zoho projects.
- We never sell or rent personal data, and this website uses no advertising or cross-site tracking cookies.
- Client data stays in your own Zoho account; we work in it only on your instructions.
- You can ask us to access, correct, export or delete your data at any time. We reply within 30 days.
1. Who we are
Cornerstonebookkeeping Services LLP, trading as CORNERSTONE BUSINESS SUITE LLP ("Cornerstone", "we", "us"), a limited liability partnership incorporated in India, with its principal place of business at Flat No. 206, 2nd Floor, H.No. 5-2-210/212, Y Yadireddy Complex, Rani Gunj Street No. 8, Ranigunj, Secunderabad, Hyderabad, Telangana 500003, India.
Grievance Officer and privacy contact: Jeevan Prasad Macharla, Managing Partner · jeevan@cornerstonebsuite.com · +91 98668 13909. He handles all privacy questions, requests and complaints, including grievances under India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.
2. Scope and our role
This policy covers personal data we handle when you visit this website, contact us, sign up for Zoho through our links, or work with us as a client or partner.
| Situation | Our role | What that means |
|---|---|---|
| Enquiries, proposals, contracts, billing, marketing | Controller (Data Fiduciary in India) | We decide why and how the data is used, and this policy applies in full. |
| Your business data inside your Zoho account during a project (customers, vendors, employees, payroll, transactions) | Processor (Data Processor in India) | We act only on your written instructions and under our contract and NDA. You remain responsible for that data towards the people it concerns. |
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, company, job title, work email, phone, country | You, through the form, email, phone or WhatsApp |
| Enquiry details | Zoho apps of interest, current systems, project needs | You |
| Contract and billing data | Billing address, tax registration numbers, invoices, payments | You, your finance team |
| Communication records | Emails, call notes, meeting notes, support tickets | Our conversations with you |
| Project data (as processor) | Data held in your Zoho organisation that we need to configure or migrate | Your Zoho account and files you share |
| Business contact data for outreach | Publicly listed business names, roles and work emails | Company websites, professional networks, public directories |
We do not ask for sensitive personal data such as health, religion or biometric data. Please do not send it to us unless a project requires it and we have agreed how to handle it.
4. How and why we use it
| Purpose | Legal basis |
|---|---|
| Replying to enquiries and preparing proposals | Your consent; steps you ask for before a contract |
| Delivering implementation, migration, training and support | Performance of our contract with you |
| Invoicing, accounting and tax records | Legal obligation |
| Business-to-business follow-up about our services | Legitimate interest or consent where the law requires it, always with an opt-out |
| Protecting our rights, preventing fraud, handling disputes | Legitimate interest; legal obligation |
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not train AI models on client data.
5. Who we share it with
We do not sell, rent or trade personal data, and we do not "share" it for cross-context behavioural advertising. We share data only with:
- Service providers who help us run the business, under contracts that require confidentiality and security: Zoho Corporation (our CRM, where enquiry-form submissions are stored, and our email), Netlify, Inc. (website hosting, which processes your IP address and standard server logs to deliver the site), and our file-storage providers. If you message us on WhatsApp, WhatsApp (Meta) processes that conversation under its own terms.
- Zoho Corporation, when you sign up through our reseller links, so your subscription is linked to us. Zoho's own privacy policy then applies to your Zoho account.
- Professional advisers such as auditors, lawyers and tax advisers, under confidentiality.
- Authorities, when the law requires it or to protect our legal rights.
- A successor business, if Cornerstone is reorganised, merged or sold, under this policy's protections.
6. International transfers
We are based in India and serve clients in the USA, Canada, the UAE, the UK and Europe, so your data may be accessed from India. Where the law of your country requires it, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum in our client agreements. Your Zoho data stays on the Zoho data centre selected for your account; we access it remotely and do not copy it out except where a migration requires it.
7. How long we keep it
| Data | Retention |
|---|---|
| Enquiries that do not become projects | Up to 24 months from last contact, then deleted |
| Contracts, invoices and tax records | As long as Indian tax and LLP law requires (generally 8 years) |
| Project working files and exports | Deleted after go-live, unless you ask us to keep them for support |
| Our access to your Zoho account | Removed at go-live or at the end of support |
| Marketing opt-outs | Kept as long as needed to honour your choice |
8. How we protect it
- Named user accounts with two-factor authentication; no shared passwords.
- Role-based, least-privilege access to client systems.
- NDAs with clients, partners and anyone working on a project.
- Client data worked on inside Zoho; exports kept only as long as needed.
- Password-protected, encrypted devices for client work.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Your rights
Depending on where you live, you may have the right to:
- know what personal data we hold and get a copy;
- correct, complete or update it;
- have it deleted;
- receive it in a portable format;
- object to or restrict certain processing, including direct marketing;
- withdraw consent at any time, as easily as you gave it (for example by replying "unsubscribe" or emailing us), without affecting earlier lawful processing;
- nominate someone to exercise your rights if you die or become incapacitated (India);
- complain to a data protection authority.
How to make a request: email jeevan@cornerstonebsuite.com with the subject "Privacy request". We will confirm your identity, usually by replying to the email address we hold, and respond within 30 days, or tell you if the law allows more time. Requests are free unless they are clearly excessive. We will not treat you differently for exercising your rights.
Complaints: please contact us first at the address above. We acknowledge every complaint within 30 days and tell you what we are doing about it. You can still complain to the authority listed for your region below.
Language: on request we will provide this notice in any of the 22 languages listed in the Eighth Schedule to the Constitution of India.
10. Rights by region
| Where you are | Main law | Where to complain |
|---|---|---|
| India | Digital Personal Data Protection Act, 2023 | Our grievance contact first, then the Data Protection Board of India |
| European Union / EEA | General Data Protection Regulation (GDPR) | Your national data protection authority |
| United Kingdom | UK GDPR and Data Protection Act 2018 | Information Commissioner's Office (ICO) |
| Canada | PIPEDA and Canada's Anti-Spam Legislation (CASL) | Office of the Privacy Commissioner of Canada |
| United Arab Emirates | Federal Decree-Law No. 45 of 2021 (PDPL) | UAE Data Office |
| United States | State privacy laws such as the California Consumer Privacy Act (CCPA/CPRA) | Your state attorney general or privacy agency |
California residents: in the last 12 months we have collected the categories in section 3 for the purposes in section 4. We have not sold or shared personal information, and we do not knowingly sell or share data of anyone under 16.
11. Marketing messages
We send business-to-business emails only about our Zoho services, and only where the law allows it: with your consent, or on legitimate interest to a business address. Every message says who we are, gives our postal address, and includes a one-click way to opt out. We record opt-outs the same day.
12. Cookies, children and third-party links
Cookies: this website sets no advertising cookies and no cookies at all until you tick the consent box on our enquiry form, which loads Zoho CRM's form script and its cookies. See Cookies and accessibility.
Children: our services are for businesses. We do not knowingly collect personal data from anyone under 18; if we learn we have, we delete it.
Links: links to Zoho and other websites are governed by those websites' own privacy policies.
13. Data breaches
If a personal data breach affects you, we will notify you and the relevant authorities where the law requires it, without undue delay, and tell you what happened and what we are doing about it. When we act as a processor for a client, we notify that client so they can meet their own obligations.
14. Changes and contact
We may update this policy as our services or the law change. The effective date at the top shows the current version; if a change is significant, we will tell clients by email.
Questions or complaints: jeevan@cornerstonebsuite.com · +91 98668 13909 · Cornerstonebookkeeping Services LLP, Flat No. 206, 2nd Floor, H.No. 5-2-210/212, Y Yadireddy Complex, Rani Gunj Street No. 8, Ranigunj, Secunderabad, Hyderabad, Telangana 500003, India.