Privacy Policy

1. Who we are

Adstorm Media (“we”, “us”, “our”) is a digital marketing agency based in Mumbai, India. We act as a Data Fiduciaryunder the Digital Personal Data Protection Act, 2023 (“DPDP Act”) when we collect and process your personal data. Our website is adstorm.media.

2. Data we collect and why

We collect information in two ways — forms and, with your consent, cookies and trackers.

A. Forms

When you submit a contact or quote form, we collect:

• Full name
• Work email address
• Company name and website (quote form)
• Services of interest, budget range, and project brief (quote form)
• Subject and message (contact form)

B. Cookies & trackers (with your consent only)

If you consent via the cookie banner, we use:

• Google Analytics 4 (GA4) — anonymous page view and traffic data to understand how visitors use the site. Data processed by Google LLC, USA. We use Google Consent Mode, so no analytics cookies are set until you accept.

Analytics is not loaded without your explicit consent. You can withdraw consent at any time by clearing your browser cookies or revisiting the cookie preference banner. We do not collect sensitive personal data as defined under the DPDP Act.

3. Lawful basis — consent

Under the DPDP Act 2023, we process your personal data only on the basis of your explicit, informed, and voluntary consent, which you give by ticking the consent checkbox on our forms before submitting. Each form clearly states the purpose for which your data will be used. You may withdraw your consent at any time by emailing us at hello@adstorm.media. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

4. How we use your data

We use your data solely to: (a) respond to your enquiry; and (b) prepare a marketing proposal for your business where requested. We do not use your data for any other purpose without obtaining fresh consent. We do not sell, rent, or share your personal data with third parties for their marketing purposes.

5. Data processors and third parties

Your form submission is transmitted via encrypted HTTPS and delivered to us as an email through Resend (a transactional email delivery service). Resend acts solely as a delivery mechanism — it does not retain your personal data after delivery. We do not store your data in any database or CRM. The only copy of your data after delivery is the email in our inbox. No other third parties receive your personal data. Our website may contain links to external sites — we are not responsible for their privacy practices.

6. Data retention and erasure

Your personal data exists solely as an email in our inbox. We retain that email for no longer than 24 months after your last interaction with us, or until you request erasure — whichever comes first. If you request deletion, we will permanently delete the relevant email(s) from our inbox and any backups within 30 days and confirm this to you in writing.

7. Security safeguards

We implement appropriate technical and organisational safeguards to protect your personal data from unauthorised access, disclosure, alteration, or destruction. In the event of a personal data breach that is likely to harm you, we will notify you and the Data Protection Board of India within the timeframe prescribed by the DPDP Act.

8. Your rights as a Data Principal

Under the DPDP Act 2023, you have the following rights, which you can exercise at any time:

• Right to access:Request a summary of the personal data we hold about you and how it is being processed.
• Right to correction:Request correction of inaccurate or incomplete personal data.
• Right to erasure:Request deletion of your personal data where we no longer need it for the stated purpose.
• Right to withdraw consent:Withdraw your consent for processing at any time, with future effect.
• Right to grievance redressal:Lodge a complaint with our Grievance Officer (see Section 9) and receive a response within 48 hours.
• Right to nominate:Nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email hello@adstorm.media with the subject line Data Rights Request. We will acknowledge your request within 48 hours and resolve it within 30 days.

9. Grievance Officer

In accordance with the DPDP Act 2023, we have designated a Grievance Officer to address privacy-related complaints:

If you are unsatisfied with our response, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act.

10. Children's data

Our services are directed at businesses and professionals, not children. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected such data, we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy to reflect changes in law or our practices. We will notify you of material changes via the email address you provided (where applicable). The date at the top of this page always reflects the most recent revision.