Privacy Policy

This policy explains what personal data Dizrupt collects, why we collect it, who we share it with, and the choices and rights you have over it.

1. Who we are

[LEGAL ENTITY NAME] (“Dizrupt”, “we”, “us”, “our”) is a full-stack digital marketing agency incorporated in India, operating the website dizrupt.in (the “Site”).

• Registered office: FLOOR-1, B-21, 4A, Sea Gull Apartment Wing B, Bhulabhai Desai Marg, Haji Ali Junction, Haji Ali, Mumbai, Maharashtra, 400026
• Email: shamit.g@dizrupt.in
• Phone: +91 99209 39203

For personal data collected through the Site and in the course of our own business, Dizrupt is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Data Controller under the GDPR. Where we process personal data on behalf of a client — for example running ad campaigns or CRM work using their customer lists — we act as a Data Processor and the client is the Data Fiduciary. See Section 7.

2. Scope

This policy covers personal data of Site visitors, prospective and existing clients and their representatives, job applicants, vendors, and anyone who contacts us. It does not cover third-party websites we link to, or our clients’ own websites and apps, which have their own policies.

3. Personal data we collect

You give us directly

• Enquiry form: name, email address, phone number, company name, and the contents of your message.
• Email, phone and WhatsApp correspondence: your contact details and what you write to us.
• Client onboarding: billing name and address, GSTIN, PAN, bank details for invoicing, and the names, emails and phone numbers of team members who work with us.
• Job applications: CV, education and employment history, portfolio links and contact details.
• Platform access: where you grant us access to your Google Ads, Meta Business, LinkedIn or analytics accounts, we access the data within them on your instruction.

Collected automatically when you use the Site

• IP address, approximate location derived from it, browser and device type, operating system, referring URL, pages viewed, time on page and clicks.
• Cookie and pixel identifiers — see Section 6.

From third parties

• Publicly available business contact data and enrichment data from lead-generation providers, used only for business-to-business outreach.
• Referral information when a client or partner introduces you to us.

We do not intentionally collect sensitive categories of personal data (health, biometric data, religious or political beliefs, sexual orientation) through the Site. Please do not include such details in the enquiry form.

4. Why we process it, and on what basis

We do not sell personal data, and we do not use data submitted through the Site’s enquiry form to build advertising audiences.

5. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by solely automated means. Advertising platforms we operate on a client’s behalf (Google, Meta, LinkedIn) do use automated audience targeting and bidding; that processing is governed by those platforms’ own terms and by the policies of the client whose campaigns we run.

6. Cookies and similar technologies

• Strictly necessary cookies — required for the Site to load, for form submission and for security. These cannot be switched off.
• Analytics cookies — [e.g. Google Analytics 4], to measure traffic and page performance.
• Advertising and remarketing pixels — [e.g. Meta Pixel, Google Ads tag, LinkedIn Insight Tag], to measure campaigns and show you our ads elsewhere.

Non-essential cookies are set only after you consent through our cookie banner. You can change or withdraw that choice at any time via [cookie settings link] or your browser settings. Blocking cookies may affect how parts of the Site work.

7. Data we handle on behalf of clients

In campaign management, CRM, lead generation and marketing automation work, we may process personal data belonging to a client’s own customers or prospects. In those cases:

• We act only on the client’s documented instructions, under a services agreement and, where required, a data processing agreement.
• We do not use that data for our own purposes and do not disclose it except as the client directs or the law requires.
• We return or delete it at the end of the engagement, as agreed with the client.
• Requests from a client’s customers to exercise their rights should go to that client. If such a request reaches us, we forward it to the client rather than act on it ourselves.

8. Who we share data with

• Service providers who process data for us: website hosting and CDN, email and CRM platforms, cloud storage, analytics providers, advertising platforms, accounting software and payment processors. Each is contractually bound to process data only for the purposes we specify.
• Professional advisers: lawyers, accountants and auditors, where needed.
• Authorities: where disclosure is required by law, court order or lawful government request.
• Business transfers: if Dizrupt is involved in a merger, acquisition or sale of assets, personal data may transfer as part of that transaction, subject to this policy.

9. International transfers

We serve clients across multiple countries and use service providers that store or process data outside India, including in the United States and the European Union. Where personal data of individuals in the EEA or UK is transferred outside those regions, we rely on Standard Contractual Clauses or another lawful transfer mechanism. Transfers out of India are made in accordance with Section 16 of the DPDP Act, 2023.

10. How long we keep it

• Unconverted enquiries: up to 24 months from last contact.
• Client records and project files: for the engagement and 3 years after it ends.
• Invoices, tax and accounting records: 8 years, as required under Indian tax and company law.
• Job applications: 12 months from the decision, unless you ask us to delete them sooner.
• Server logs and analytics: up to 14 months.

Where a longer period is required by law or needed to establish, exercise or defend legal claims, we retain the data for that period and then delete or anonymise it.

11. Security

We use access controls, encryption in transit (HTTPS), restricted administrative access and contractual safeguards with our vendors to protect personal data. No system is completely secure and we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the Data Protection Board of India as required under the DPDP Act, 2023.

12. Your rights

If you are in India, under the DPDP Act, 2023 you may:

• Ask for a summary of the personal data we hold about you and how we process it.
• Ask us to correct, complete, update or erase your personal data.
• Withdraw consent you previously gave, at any time. Withdrawal does not affect processing already carried out on that consent.
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Raise a grievance with us (Section 13) and, if unsatisfied with our response, complain to the Data Protection Board of India.

If you are in the EEA or UK, you additionally have the rights to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests or to direct marketing. You may complain to your local supervisory authority.

To exercise any of these, email shamit.g@dizrupt.in with the subject line “Privacy Request”. We may ask for information to verify your identity. We respond within 30 days, or sooner where the law requires. Exercising your rights is free; we may charge a reasonable fee for manifestly unfounded or excessive repeat requests.

You can unsubscribe from our marketing emails using the link at the bottom of any such email.

13. Grievance Officer

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000 and the rules made thereunder:

We acknowledge grievances within 24 hours and resolve them within 15 days of receipt. If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India under Section 13(3) of the DPDP Act, 2023.

14. Children

Our Site and services are directed at businesses and are not intended for children. Under the DPDP Act, 2023 a “child” is anyone under 18 years of age. We do not knowingly collect children’s personal data, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the current version. We will notify material changes on this page and, where required, by email.

16. Contact us