Privacy Policy

Website Privacy Policy

Adbuffs Media Private Limited
Website: https://adbuffs.com/

Document Status : Full Version | V.1
Effective Date : 3 November 2026

1. Introduction

This Website Privacy Policy (the “Policy”) explains how Adbuffs Media Private Limited (“Adbuffs”, “Company”, “we”, “us” or “our”) collects, receives, uses, stores, discloses, retains and otherwise processes personal data when an individual visits or interacts with our website at https://adbuffs.com/ (the “Website”), contacts us, submits an enquiry, requests a discovery call, communicates with us, applies for a role through a channel made available by us, or otherwise interacts with our Website-related services.

This Policy describes our practices in a manner consistent with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). Different provisions of the DPDP Act and Rules come into force on different dates, and some obligations will apply only from 13 May 2027. Until the relevant provisions take effect, and to the extent they remain in force, we also handle personal data in accordance with the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable Indian laws. We have chosen to follow the DPDP framework in advance of its full commencement.

This Policy is intended to be read together with any short-form privacy notice displayed at the point of collection and, where applicable, our separate service agreements, employment notices, vendor notices and product-specific privacy policies. Where a specific notice or agreement governs a particular processing activity, it will apply to that activity to the extent of any inconsistency.

2. Who This Policy Applies To

This Policy applies to natural persons whose personal data is processed by us in connection with the Website, including:

visitors who browse or interact with the Website;
individuals who submit the Contact Us form, request a consultation or discovery call, or otherwise enquire about our services;
representatives, employees, founders or other contact persons of prospective, existing or former clients, vendors, partners and business associates, where their personal data is processed through Website-related interactions;
individuals who contact us by email, telephone or another channel identified on the Website; and
job applicants or prospective personnel, but only where their personal data is submitted through a Website-linked recruitment channel or otherwise provided to us in connection with recruitment.

This Policy does not apply to information that does not identify, and cannot reasonably be linked to, an individual. It also does not govern personal data of a client’s customers that Adbuffs accesses or processes solely on the client’s documented instructions while providing marketing or technology services, including through the Adbuffs On-board Shopify application. Such processing is governed by the relevant client agreement, data-processing terms and the separate Adbuffs On-board Data Protection & Privacy Policy.

3. Our Role Under Data Protection Law

3.1 Website interactions

For personal data collected through our own Website, enquiry forms, Website communications and related business-development activities, Adbuffs generally determines the purposes and means of processing and acts as the Data Fiduciary under the DPDP Act, where that Act applies.

3.2 Client-directed processing

When we access or process personal data of a client’s customers strictly on the client’s documented instructions to deliver advertising, campaign optimisation, analytics or related services, our role is generally that of a Data Processor, while the client generally acts as the Data Fiduciary. The actual role of each party depends on the facts and the relevant contractual and operational arrangements.

3.3 Separate product policy

The Adbuffs On-board Shopify application is governed by a separate Data Protection & Privacy Policy. That policy describes the client authorisation recorded through the application and the limited processing of the client’s Shopify store data. This Website Policy does not expand the purposes for which client-store customer data may be processed and does not make Adbuffs the independent Data Fiduciary of that customer data merely because it is accessed through the application.

4. Personal Data We May Collect

The categories of personal data collected will depend on how an individual interacts with the Website and which features are enabled. Based on the forms and content presently visible on the Website, the following categories are relevant:

CATEGORY	EXAMPLES
Identity and contact details	Name, first name, last name, email address, telephone or mobile number and other contact details supplied by the individual.
Business and professional details	Business or brand name, business website or URL, city or location of business, job title, role, organisation and professional contact details, where supplied.
Enquiry and qualification information	Monthly average advertising-spend range, services or solutions of interest, business requirements, preferred contact method, referral source (for example, how the individual heard about us), and information included in an enquiry or discovery-call request.
Communications	The contents of emails, messages, call notes, meeting requests, feedback, attachments and other information an individual chooses to provide when communicating with us.
Recruitment information	Where a person applies for a role, information in a CV or résumé, employment history, qualifications, skills, portfolio, contact details, interview notes and other information voluntarily provided for recruitment. This category applies only if and when such a recruitment channel is used.
Technical and usage information	Depending on Website configuration, information such as IP address, device and browser type, operating system, referring URL, pages viewed, interactions, timestamps, approximate location derived from IP address, cookie identifiers and diagnostic or server-log information.
Preferences and consent records	Communication preferences, marketing choices, cookie preferences and records showing when and how a relevant choice or consent was given, changed or withdrawn.

We do not ask individuals to provide sensitive personal data through the Website enquiry forms. Please do not submit passwords, payment-card details, bank credentials, government identity documents, health information or other sensitive information through a general enquiry form unless we specifically request it through a secure and appropriate process.

5. How We Collect Personal Data

We may collect personal data:

directly from the individual when they complete a form, send an email, call us, request a discovery call, submit a CV or otherwise communicate with us;
automatically through the Website, server logs, cookies or similar technologies, where these technologies are enabled;
from a person acting on the individual’s behalf or from the organisation with which the individual is associated, where the information is provided for a business enquiry or relationship;
from service providers that support Website operations, communications, security, analytics or customer relationship management, where they provide information to us in accordance with our instructions and applicable law.

Where we obtain personal data from a source other than the individual, we will use it only for a lawful and reasonably connected purpose and will provide any notice required by applicable law.

6. Why We Process Personal Data

Subject to the applicable legal basis and the individual’s choices, we may process personal data for the following specified purposes:

Responding to enquiries. To receive, review and respond to Contact Us submissions, service enquiries, requests for information and messages; to contact the individual through the details provided; and to maintain a record of the enquiry.

Discovery calls and business development. To assess the nature of a business requirement, understand the organisation’s advertising or marketing needs, schedule and conduct a discovery call, determine whether our services may be suitable, and prepare or discuss a proposal or quotation.

Providing and managing services. To communicate with prospective, current or former clients; negotiate, enter into and administer commercial arrangements; coordinate service delivery; and manage client relationships.

Website operation and improvement. To operate, maintain, troubleshoot, secure and improve the Website, its content, functionality, accessibility and user experience.

Security and fraud prevention. To detect and investigate malicious activity, spam, abuse, unauthorised access, technical errors and other threats to the Website, our systems, personnel or users.

Marketing and business communications. To send relevant business updates, event information, insights or marketing communications only after obtaining the individual’s separate consent. An individual may opt out of marketing communications at any time, at which point the Company and its assigned processors shall cease to process such data with immediate effect.

Recruitment. Where applicable, to receive and assess applications, communicate with candidates, conduct interviews, verify information where lawful, and administer recruitment decisions.

Legal and regulatory compliance. To comply with applicable laws, lawful directions, regulatory requirements, record-keeping obligations and requests from competent authorities; and to establish, exercise or defend legal claims.

The table below summarises how the categories of personal data described in Section 4 are used for the purposes set out in this Section, the basis on which we rely, and the main recipients.

DATA CATEGORY	PURPOSE	BASIS	MAIN RECIPIENTS
Identity and contact details; business and professional details; enquiry and qualification information; communications	Responding to enquiries; discovery calls and business development	Voluntarily provided for the specified purpose (Section 7(a) of the DPDP Act), unless the individual indicates that they do not consent	Authorised internal teams; CRM, email, telephone and scheduling providers; hosting providers
The same categories, for clients and their contact persons	Providing and managing services; managing client relationships	Voluntarily provided for the specified purpose (Section 7(a)); consent where required	Authorised internal teams; professional advisers
Identity and contact details; preferences and consent records	Marketing and business communications	Separate, specific consent, which may be withdrawn at any time	Email and marketing-communication providers; authorised internal teams
Recruitment information; identity and contact details	Recruitment	Voluntarily provided for the specified purpose (Section 7(a)); employment-related uses permitted by the DPDP Act	HR and hiring teams; recruitment tools, where used
Technical and usage information (server logs, IP address, device and browser data)	Website operation; security and fraud prevention; legal compliance	Notice at first visit; processing limited to what is necessary to operate and secure the Website and to meet legal obligations; consent where required	Hosting, cybersecurity and infrastructure providers; authorities where required by law
Technical and usage information (cookie identifiers, analytics and advertising data)	Website improvement; campaign measurement and attribution	Consent given through the cookie preference tool	Analytics and advertising-measurement providers, only if consent is given
Preferences and consent records	Evidencing consent and choices; legal compliance	Compliance with legal obligations and the need to demonstrate consent	Authorised internal teams
All categories	Legal and regulatory compliance; establishing, exercising or defending legal claims	Compliance with legal obligations; legal claims	Professional advisers; authorities where required by law

7. Legal Basis And Choice

We will process personal data only where a lawful ground recognised under applicable law is available. Under the DPDP Act, the relevant grounds include consent and the “certain legitimate uses” specifically set out in the Act. The DPDP Act does not create a general, unrestricted legitimate-interests basis.

Where an individual voluntarily provides personal data to us for a specified purpose, such as submitting a business enquiry and asking us to contact them about that enquiry, we may process that information for that specified purpose to the extent permitted under the “certain legitimate uses” provision of the DPDP Act, unless the individual indicates that they do not consent to that processing. Where consent is required, we will request consent through an appropriate notice or mechanism before the relevant processing begins.

Where we rely on consent:

the request will be presented in clear and understandable language and will identify the personal data and purpose(s) for which consent is sought;
consent will be free, specific, informed, unconditional and unambiguous, and indicated by a clear affirmative action;
a request for marketing communications, optional cookies or other optional processing will be separated from a request necessary to respond to a business enquiry, wherever appropriate;
the individual may withdraw consent through a method that is as easy as the method used to provide it, subject to applicable law; and
withdrawal will not affect the lawfulness of processing undertaken before withdrawal. It may affect our ability to continue providing a feature or service that depends on the relevant processing. On withdrawal, we will cease, and will cause our Data Processors to cease processing the relevant personal data within a reasonable time, unless processing is required or permitted by law.

Where processing is necessary to comply with a legal obligation, we may retain or disclose relevant information to the extent required by law. We will not use a personal data field collected for one purpose for an unrelated purpose unless a lawful basis and any required notice or consent are in place.

When you visit the Website, certain technical information, such as your IP address, device and browser type, and the pages you view, is collected automatically through server logs and similar technologies. We collect only the information needed to operate and secure the Website, detect and investigate abuse, and meet our legal record-keeping obligations. We do not use this information to profile individuals or for advertising. Analytics, advertising and other non-essential technologies are used only if you choose to accept them through our cookie preference tool, and you can change that choice at any time.

Consent Managers and language. Where a Consent Manager registered with the Data Protection Board of India is available, an individual may give, manage, review or withdraw consent through that Consent Manager. On request, this Policy and any request for consent will be made available in English or in any language specified in the Eighth Schedule to the Constitution of India.

8. Cookies, Pixels And Similar Technologies

The Website may use cookies, pixels, tags, SDKs, local storage and similar technologies. These technologies may be placed by us or by third-party providers whose tools are integrated into the Website.

8.1 Types of technologies

Strictly necessary technologies: used to enable core Website functions, security, network management, form submission, load balancing or other functions requested by the user or necessary to operate the Website.
Analytics and performance technologies: where enabled, used to understand aggregate Website traffic, page performance, navigation and usage patterns so that we can improve the Website.
Advertising and attribution technologies: where enabled, used to measure campaign performance, attribute visits or enquiries to marketing channels, or support relevant advertising and remarketing.
Preference technologies: where enabled, used to remember settings or preferences selected by the individual.

8.2 Choices and consent

Non-essential analytics, advertising or preference technologies will be activated only after the individual has made an affirmative choice through the Website’s cookie or privacy preference mechanism. The mechanism permits the individual to accept, reject or manage non-essential categories, and to change or withdraw a choice later. Essential technologies may continue to operate where necessary for the Website or a function expressly requested by the individual.

Browser settings may also allow an individual to block or delete cookies. Disabling certain technologies may affect the availability or functionality of parts of the Website. A detailed, vendor-by-vendor description of the cookies and similar technologies in use is available through the Website’s cookie preference tool.

8.3 Third-party tools

Where the Website uses tools such as website analytics, advertising pixels, conversion APIs, embedded media, scheduling tools, chat tools or social-media plug-ins, those providers may collect information through their technologies in accordance with their own terms and privacy notices. We identify the tools deployed in our cookie preference tool and configure them consistently with the individual’s choices and applicable law.

9. Disclosure And Sharing Of Personal Data

We do not sell personal data collected through the Website. We may disclose or make personal data available only to the extent reasonably necessary for the purposes described in this Policy, including to the following categories of recipients:

our directors, employees, authorised personnel and professional teams who require access for legitimate business purposes and are subject to confidentiality obligations;
website hosting, domain, content management, cloud storage, cybersecurity, infrastructure and technical support providers;
form-management, email, telephone, customer relationship management, scheduling and business-communication providers;
analytics, measurement, advertising attribution and website-performance providers, where deployed and subject to applicable consent requirements;
professional advisers, including lawyers, accountants, auditors, insurers and consultants, subject to confidentiality and professional obligations;
a potential or actual successor, investor, acquirer or transferee in connection with a restructuring, merger, financing, sale or transfer of all or part of our business, subject to appropriate confidentiality and lawful-use restrictions; and
governmental, regulatory, judicial, law-enforcement or other competent authorities where disclosure is required or authorised by law, or is necessary to establish, exercise or defend legal claims.

Where a third party processes personal data on our behalf, we will use appropriate contractual and organisational measures to require the service provider to process the information only for authorised purposes, maintain confidentiality and implement appropriate security safeguards. We remain responsible for processing undertaken on our behalf to the extent provided by applicable law.

We do not authorise service providers to use Website enquiry data for their own unrelated advertising or independent marketing purposes. Any separate use by a third party in its own capacity must be disclosed and supported by an appropriate legal basis.

10. Cross-border Processing

Some of our service providers or technology infrastructure may operate from, or store or process information in, locations outside India. Accordingly, personal data collected through the Website may be transferred to or accessed from jurisdictions outside India where necessary for the purposes described in this Policy.

Any such transfer will be subject to applicable Indian law, including restrictions or requirements notified by the Central Government, and to appropriate contractual, technical and organisational safeguards. Personal data collected through the Website is not necessarily stored exclusively in India.

11. Data Retention And Deletion

We retain personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected, to maintain the relevant business relationship, to comply with applicable legal or regulatory requirements, to resolve disputes, to establish or defend legal claims, or to maintain security and processing records where required by law.

Retention periods will vary by category and context. In determining the applicable period, we consider the nature and sensitivity of the information, the purpose of processing, the period for which the information is reasonably required, applicable statutory limitation and record-keeping requirements, and whether the information can be deleted, anonymised or aggregated. A more detailed internal retention schedule will govern operational deletion timelines.

When personal data is no longer required, we will securely delete or irreversibly anonymise it, subject to lawful retention requirements. Where data is held by a service provider on our behalf, we will cause it to be deleted or returned in accordance with the applicable contract and law. Copies retained in routine backups may remain until overwritten in the normal backup cycle, provided they are protected and are not restored or used except for legitimate recovery, security or legal purposes.

Notwithstanding the above, we retain system logs, server logs and related records of processing for the minimum periods required by the directions of the Indian Computer Emergency Response Team (CERT-In) and by the DPDP Rules, whichever is longer. These records are kept securely and used only for security, incident investigation, legal compliance and responding to lawful requests from competent authorities. Where such legal requirements apply, they prevail over any shorter retention period set forth in this Policy.

The table below sets out the indicative retention periods for the main categories of personal data. Where a longer period is required by law, or is necessary to establish, exercise or defend legal claims, the longer period applies.

CATEGORY	RETENTION PERIOD
Enquiries and discovery-call data (where no engagement follows)	12 months from the last interaction, after which the data is erased or anonymised.
Client and commercial relationship records	For the duration of the relationship and afterwards for the period required by applicable tax, company-law and limitation requirements.
Recruitment information	12 months after the recruitment process closes, unless the candidate agrees to a longer period.
Marketing preferences and consent records	While the preference is active, and afterwards for the period needed to evidence consent and defend legal claims.
Cookie and analytics data	As stated in the cookie preference tool, and deleted when no longer needed for the stated purpose.
System, server and security logs	For the longer of the minimum periods required by CERT-In directions and the DPDP Rules.
Rights requests and grievances	For the period needed to evidence our response and defend legal claims.

12. Security Safeguards

We implement and maintain reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction. Depending on the systems and risks involved, safeguards may include:

role-based access controls and access on a need-to-know basis;
password, authentication and account-management controls;
encryption, masking or other protective measures where appropriate;
secure transmission and storage practices;
logging, monitoring and periodic review of access and system activity;
backups, recovery measures and business-continuity arrangements;
confidentiality obligations, employee awareness and access revocation on role change or exit; and
periodic assessment of vendors and service providers that process personal data on our behalf.

No method of transmission or storage is completely secure. We will continually review and improve our safeguards in light of the nature of the data, the risks involved, technological developments and applicable legal requirements.

13. Personal Data Breach Management

We maintain an incident-response process for identifying, assessing, containing, investigating and remediating actual or suspected personal data breaches. Personnel and service providers who become aware of a suspected incident must promptly report it through the designated internal escalation channel.

Where a personal data breach occurs, we will take steps prescribed by law to contain the incident, preserve relevant evidence, assess the nature and extent of the impact, mitigate potential harm, address the root cause and document the response. We will notify each affected individual without delay. That notice will describe the nature, extent, timing and location of the breach, its likely consequences for the individual, the measures taken or being taken to mitigate the risk, the safety steps the individual can take to protect their interests, and the business contact details of a person who can answer their questions. We will also notify the Data Protection Board of India without delay, and will follow that initial intimation with a detailed report within seventy-two (72) hours, or within any longer period the Board allows. Where an incident is of a type that must be reported under the directions issued by the Indian Computer Emergency Response Team (CERT-In) under the Information Technology Act, 2000, we will also report it to CERT-In within the time and in the manner those directions require.

Where a service provider reports an incident involving personal data processed on our behalf, we will coordinate with that provider and take the steps required by law and the applicable contract.

14. Rights And Requests Of Individuals

Subject to the DPDP Act, the DPDP Rules, applicable commencement dates and any lawful exemptions, an individual whose personal data we process may have the right to:

obtain information about the personal data being processed and a summary of the processing activities, including the identities of the other Data Fiduciaries and Data Processors with whom personal data has been shared and a description of the personal data shared, as provided by law;
request correction, completion or updating of inaccurate, incomplete or misleading personal data;
request erasure of personal data where retention is no longer necessary for the specified purpose or otherwise required by law;
withdraw consent where processing is based on consent;
use our grievance-redressal mechanism; and
nominate another individual to exercise rights in the event of death or incapacity, in accordance with applicable law.

To make a request, please write to rajarshi.adhikary@adbuffs.com with the subject line “Privacy Rights Request”. Please identify the nature of the request and provide sufficient information for us to locate the relevant records, such as the name, email address and telephone number you used when you contacted us and any enquiry reference you were given. We may request reasonable information to verify the identity and authority of the person making the request. We will not ask for more information than is reasonably necessary for verification.

We will acknowledge a request within seven (7) working days and provide a substantive response within thirty (30) days, or within any shorter period prescribed by applicable law. If additional time is reasonably necessary, we will communicate the reason and the expected next steps.

A request to erase information may not be actioned to the extent we are required or permitted by law to retain it, or where retention is necessary for the establishment, exercise or defence of legal claims. We will explain the applicable limitation where we cannot fully comply with a request.

15. Grievance Redressal And Privacy Contact

For questions, concerns, requests or complaints relating to this Policy or our processing of personal data, an individual may contact our designated Privacy and Grievance Contact using the details below:

Organisation	Adbuffs Media Private Limited
Privacy / Grievance Contact	Rajarshi Adhikary - Senior Corporate Legal Counsel
Email	rajarshi.adhikary@adbuffs.com
Postal address	Unit 901, 9th Floor, Aurora Waterfront, Block GN, GN 34/1, Opposite Nalban Food Park, Bidhannagar, Salt Lake, Sector V, North 24 Parganas, West Bengal - 700091.

We will acknowledge a grievance within seven (7) working days and address it within thirty (30) days from the date of receipt, and in any event within the maximum period prescribed under the DPDP Rules. An individual must first raise the concern with the Company in writing and give us the opportunity to address it before approaching the Data Protection Board of India. The individual may approach the Data Protection Board of India through the mechanism made available by the Board, in accordance with the DPDP Act and applicable rules, where the statutory conditions for doing so are satisfied.

16. Third-party Websites And Embedded Content

The Website may contain links to third-party websites, social-media pages, videos, maps, forms or other embedded content. When an individual follows such a link or interacts with embedded content, the third party may collect information directly from the individual or the individual’s browser in accordance with its own privacy policy and terms. Adbuffs does not control third-party websites or their independent processing practices. Individuals should review the relevant third-party notices before interacting with those services.

17. Children’s Personal Data

The Website and our business enquiry channels are intended for business and professional interactions and are not directed to children. We do not knowingly seek to collect personal data of individuals under eighteen (18) years of age through general Website enquiry forms. Individuals should not submit a child’s personal data through the Website.

If we become aware that personal data of a child has been collected in circumstances requiring parental or lawful guardian consent or other safeguards under applicable law, we will take appropriate steps to verify the circumstances, restrict processing and erase the information where required, unless retention or processing is otherwise permitted or required by law. We do not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children. Where the DPDP Act and Rules require the verifiable consent of a parent or lawful guardian, including for a person with a disability who has a lawful guardian, we will obtain it before undertaking the relevant processing.

18. Changes To This Policy

We may update this Policy from time to time to reflect changes in our business, Website, data-processing practices, technology, service providers or applicable law. The updated version will be published on the Website with a revised “Last Updated” date. Where a change is material or applicable law requires it, we will provide an appropriate notice or obtain fresh consent before undertaking processing that requires such consent. Continued use of the Website does not by itself constitute consent to processing for which consent is required.

19. Contact Details And Effective Date

This Policy is issued by Adbuffs Media Private Limited. It will take effect from the date stated at the beginning of the published version. This Policy was last updated on 3 November 2026.

Privacy enquiries and rights requests: rajarshi.adhikary@adbuffs.com (subject line: Privacy Rights Request).