Privacy Policy & Data Protection Framework

1. Professional Secrecy & Scope of Commitment

Mantorius operates as a premier accounting and financial advisory practice governed by the stringent ethical canons of the Association of Chartered Certified Accountants (ACCA) and Certified Public Accountants (CPA). In professional accounting, client confidentiality is not merely a statutory obligation—it is the bedrock of our fiduciary existence.

This Privacy Policy governs the manner in which Mantorius ("we", "us", "our", or the "Practice"), managed under the leadership of partner Keshav Verma, collects, manages, encrypts, and retains personal, corporate, and financial information provided by clients, prospective scaleups, and web visitors accessing https://mantorius.com.

2. Information We Collect

To execute complex statutory accounting, fractional CFO engagements, period-end reconciliations, and tax strategy, we collect information within three distinct tiers:

A. Corporate & Financial Accounting Records

• General ledger transactions, chart of accounts hierarchies, and journal entries.
• Bank statements, reconciliation feeds, credit facility schedules, and merchant accounts.
• Invoices (accounts receivable), bills (accounts payable), and vendor tax dockets.
• Corporate entity documentation, Certificate of Incorporation, Memorandum & Articles, and statutory tax registers (PAN, TAN, GSTIN, VAT, Corporate Tax IDs).

B. Corporate Officer & Directorship Identifiers

• Full legal names, corporate titles, board designations, and identity numbers of directors.
• Direct business contact data including professional email addresses, phone numbers, and registered office addresses.

C. Digital Interaction & Inquiry Data

• Consultation request payloads, form inputs, notes, and specific service briefs submitted through our digital portals.
• Technical metadata: IP addresses, browser agents, operating systems, and page navigation metrics utilized solely for security diagnostics and fraud prevention.

3. Legal Basis for Processing Under Global Standards

We process corporate and personal data solely under legitimate, transparent, and lawful conditions, specifically:

• Contractual Necessity: Delivering accounting software migrations, chart of accounts restructuring, monthly bookkeeping, management reporting, and CPA backoffice support as codified in our formal Letter of Engagement.
• Statutory Mandate: Fulfilling non-negotiable legal requirements under company legislation, taxation statutes (CBDT, HMRC, IRS), anti-money laundering (AML) protocols, and know-your-customer (KYC) regulations.
• Legitimate Professional Interest: Protecting our enterprise and our clients against cyber threats, reconciling disputed financial entries, and compiling statutory compliance logs.
• Explicit Client Consent: Where you opt in to receive quarterly statutory advisory memos, technical newsletters, or tax deadline reminders.

4. Regulatory Compliance: GDPR & Indian IT Act / DPDPA

Mantorius serves an international clientele across India, the United Kingdom, Europe, North America, and the Middle East. Consequently, our infrastructure adheres simultaneously to:

• Indian Information Technology Act, 2000 & SPDI Rules (2011): Adherence to Section 43A and Section 72A concerning sensitive personal data or information (SPDI), ensuring reasonable security practices and procedures.
• Digital Personal Data Protection Act, 2023 (DPDPA - India): Rigorous data fiduciary protocols governing notice, consent mechanisms, purpose limitation, and grievance redressal.
• General Data Protection Regulation (GDPR - Regulation (EU) 2016/679 & UK GDPR): Lawful processing, data minimization, accuracy safeguards, and unrestricted execution of data subject rights for European and British entities.

5. Cross-Border Data Transfers & Cloud Infrastructure

All cloud-hosted accounting software (including QuickBooks Online, Xero, Sage Business Cloud, and NetSuite) utilized during our engagements is deployed within SOC-2 Type II, ISO 27001, and FedRAMP certified cloud datacenters.

Where data is transferred across international jurisdictions to support multi-national consolidation or outsourced CPA backoffice services, Mantorius implements European Commission-approved Standard Contractual Clauses (SCCs), robust Data Transfer Impact Assessments (DTIAs), and mandatory zero-knowledge encryption pipelines.

6. Statutory Archival Periods & Data Retention

In accordance with international accounting standards and statutory tax requirements:

• Statutory Accounting Workpapers: Maintained for a mandatory minimum period of eight (8) years following the conclusion of the relevant financial assessment year to satisfy statutory reporting and tax authority inspection guidelines.
• Prospective Inquiries: Unconverted advisory consultation submissions are automatically purged from our active CRM systems after twelve (12) months unless an ongoing engagement is formalized.
• Post-Engagement Destruction: Following the expiration of statutory retention periods, electronic ledgers and confidential documents are permanently deleted using cryptographic wiping algorithms.

7. Client Rights & Data Subject Access Requests (DSAR)

Every client and individual whose data is managed by Mantorius possesses clear statutory rights:

• Right to Inspection: Request confirmation of whether we hold your financial records and obtain verified copies.
• Right to Rectification: Require prompt correction of inaccurate, outdated, or incomplete corporate records.
• Right to Restriction / Objection: Contest the processing of data for purposes outside direct statutory compliance.
• Right to Data Portability: Obtain your general ledger dumps and chart of accounts architectures in structured, standardized digital formats (CSV, XML, JSON).

To lodge a verified request, email advisory@mantorius.com with the subject line "Statutory Data Subject Access Request". We fulfill validated requests within 30 calendar days at zero charge.

8. Encryption Protocols & Cybersecurity Measures

We implement defense-in-depth technical safeguards to shield your financial intelligence:

• Transit Encryption: Enforced TLS 1.3 encryption across all website interactions, client portals, and secure API webhooks.
• At-Rest Encryption: AES-256 bit hardware-level encryption on all cloud storage repositories, staging databases, and encrypted local backups.
• Access Controls: Role-based access control (RBAC) enforced via multi-factor authentication (MFA) hardware tokens. Only vetted ACCA/CPA personnel assigned directly to your engagement have visibility into your ledgers.

9. Cookies & Analytical Tracking Technologies

Our website utilizes minimal, privacy-centric cookies strictly required for security validation, CSRF defense, and session continuity. In full compliance with the EU ePrivacy Directive, GDPR, UK PECR, and India's Digital Personal Data Protection Act (DPDPA 2023), non-essential cookies (such as aggregate analytics) are disabled by default and deployed only upon affirmative user opt-in consent.

For a comprehensive breakdown of our cookie inventory, storage lifespans, and browser-level controls, please consult our dedicated Cookie Policy. You may alter or revoke your cookie choices at any moment by clicking below or using the "Cookie Preferences" link located in the site footer:

10. Data Protection Officer & Grievance Redressal

For any inquiries regarding this Privacy Policy, our data governance practices, or to exercise statutory privacy rights, contact our designated Grievance Officer and Senior Partner directly: