Visbig is built for Indian tax practice. Signing up requires an Indian PAN and Aadhaar verification, billing is in rupees, and every workflow is an Indian statutory filing. So the law that governs us first is India's Digital Personal Data Protection Act, 2023.
The GDPR is not incidental here, though. Our servers are in the European Union, so the processing itself happens inside the EEA and is carried out to that standard for everyone, whether or not they could invoke it. This page sets out both regimes.
Data storage
The application, the PostgreSQL database holding every client record and filing, and the session store run on infrastructure we operate ourselves in Vienna, Austria. Not on a managed cloud platform, and not in India.
Uploaded documents are held separately, in Cloudflare R2.
The consequence runs in the direction people rarely expect from an Indian tax product: data leaves India to reach us. The DPDP Act, 2023 permits that unless the government restricts the destination, and it has restricted none.
Under the DPDP Act, 2023
For your account, identity and billing data, VISBIG LLP is the data fiduciary. For the client data you put into Visbig, we are a data processor acting on your instructions; your firm is the fiduciary to your clients.
As a data principal you may:
- Ask what we hold and get a copy. Settings, then Security, then Export my data.
- Have inaccurate data corrected, or ask us to complete or update it.
- Have your data erased when we no longer need it, subject to the retention limits below.
- Withdraw consent as easily as you gave it.
- Nominate someone to exercise these rights if you die or become incapacitated.
- Raise a grievance with us, and escalate to the Data Protection Board if we fail you.
Grievances go to [email protected] and are answered within thirty days.
Under the GDPR and UK GDPR
When this applies
We are established in India, not the EU or the UK, and we do not market or offer Visbig to consumers in either, so we have not appointed an Article 27 representative. We say that plainly rather than implying a footprint we do not have.
What we do not do is treat that as a reason to apply a lower standard. Because the processing runs on EU infrastructure, the rights below are available to anyone whose personal data we hold, in the EEA or the UK or not.
What we rely on to process data
| Purpose | Lawful basis |
|---|---|
| Running your account and delivering the service | Performance of a contract |
| Identity verification | Legal obligation, and our legitimate interest in preventing fraud |
| Billing, invoices and tax records | Legal obligation |
| Security, audit logging and abuse prevention | Legitimate interests |
| Service and security emails | Performance of a contract |
| Client data you upload | Processed on your documented instructions, as processor |
Your rights
- Access a copy of your data, in a portable machine-readable format.
- Rectification of anything inaccurate.
- Erasure, subject to records we must keep by law.
- Restriction of processing while a dispute is resolved.
- Portability of the data you gave us.
- Objection to processing based on legitimate interests.
- Withdrawal of consent, without affecting what was lawful beforehand.
Access and erasure are self-service in the app. For everything else, write to [email protected]. We respond within one month and will not charge you for it.
Automated decision-making
There is none with legal or similarly significant effect. Visbig drafts; it does not decide. No return is filed and no computation is acted on until a qualified professional has reviewed and approved it. That is enforced in the product, not just promised here.
International transfers
Data crosses a border twice, and the two crossings are governed by different law.
| Transfer | What moves | On what basis |
|---|---|---|
| India to the EU | Everything you enter, upload or save. It rests here | Permitted under the DPDP Act, 2023. No destination country is currently restricted |
| EU to the United States | Conversation text, and document contents while being read | The data-protection terms in our contract with each provider, including standard contractual clauses where the provider offers them |
| EU to India | PAN, GSTIN, Aadhaar at the moment of verification, and return payloads | Same, with our compliance provider |
The outward transfers happen only while a request is being served. They are not a second copy at rest. Which provider does what, and where each one processes, is on the Subprocessors page.
Complaints
Come to us first, at [email protected]. If we do not resolve it, you can complain to your local supervisory authority, or in the UK to the Information Commissioner's Office.
Data processing agreement
If your firm needs a signed DPA covering our role as processor for your client data, email [email protected] and we will send one.
Retention and security
How long each category is kept is set out in the Privacy Policy. The technical measures behind it, and their current limits, are on the Security page.