Effective Date: 8 October 2026 · Compliant with DPDPA 2023 & IT Act 2000
AddMads ("we", "us", "our") is committed to protecting the privacy and personal data of our clients, website visitors, and business contacts. This Privacy Policy explains how we collect, use, store, and protect personal data in accordance with:
• Digital Personal Data Protection Act, 2023 (DPDPA 2023)
• Information Technology Act, 2000 (IT Act)
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)
• All other applicable Indian laws
By using our website or engaging our services, you acknowledge that you have read and agree to this Privacy Policy.
AddMads operates as a Data Fiduciary under DPDPA 2023 for all personal data processed in connection with our own marketing, website, and business operations.
For all privacy-related matters:
Email: info@addmads.com
Phone: +91 92208 72212
Website: addmads.com
When you contact AddMads, submit an enquiry, or engage our services, we collect:
• Identity Data: name, designation, company name
• Contact Data: email address, phone number, postal address
• Project and Engagement Data: briefs, requirements, feedback, files and media shared during engagement
• Usage Data: IP address, browser type, pages visited, referring URLs (collected via analytics tools)
• Communication Data: emails, WhatsApp messages, and enquiries sent to us
• Payment Data: billing name and address (payment card details are processed by third-party payment gateways; we never store card numbers)
We do not knowingly collect personal data from individuals below 18 years of age.
When AddMads builds websites, admin panels, CRM systems, or marketing funnels for clients, we may have access to the Client's own business data stored in those systems. This includes:
• Lead and enquiry data collected through forms and landing pages we build
• CRM records in Zoho Bigin or other platforms we set up
• Website user registrations and client portal data
• Google Ads and Meta Ads audience data, conversion data, and campaign data
• WhatsApp Business conversation data and contact lists
• Google Business Profile review data and customer messages
This client business data belongs entirely to the Client. AddMads processes it only for service delivery and has no ownership claim over it. We do not use client business data for our own marketing, analytics, or any other purpose. Upon termination of engagement, all access to client business data systems is revoked within 7 business days.
We process personal data on the following lawful bases under DPDPA 2023:
• Consent: when you submit a contact form, enquiry, or opt into communications
• Contractual Necessity: to provide agreed digital and marketing services
• Legitimate Interests: to respond to enquiries, improve our services, and maintain security
• Legal Obligation: to comply with applicable Indian laws, court orders, or regulatory directions
Purposes include: delivering services, project communication, billing and invoicing, improving our website, and legal compliance.
We do not sell or rent your personal data. We may share data with:
• Service Providers: cloud hosting (Vercel), email delivery, analytics (Google Analytics), and payment gateway providers - all bound by confidentiality obligations
• Platform Operators: Google and Meta, where necessary for running campaigns on your behalf - data shared with these platforms is subject to their own privacy policies
• Professional Advisors: lawyers and accountants under legal professional privilege
• Regulatory Authorities: government agencies, courts, or law enforcement when legally required
All third-party processors are contractually required to handle data securely and only for the specified purpose.
When we manage Google Ads, Meta Ads, WhatsApp Business API, Zoho CRM, or other platforms on behalf of clients:
• Data in those platforms is governed by the respective platform's own privacy policies (Google Privacy Policy, Meta Data Policy, Zoho Privacy Policy)
• AddMads acts as a data processor in relation to client business data on these platforms
• The Client is the data controller and is responsible for ensuring their own privacy policy covers how their customers' data is collected through these platforms
• We recommend all clients maintain their own Privacy Policy and Cookie Policy on their website, specifically covering the use of Google Analytics, Meta Pixel, and any lead forms
Our website (addmads.com) may use:
• Essential cookies: required for basic website functionality
• Analytics cookies: Google Analytics, to understand visitor behaviour in aggregate
You may control cookie settings through your browser. Disabling essential cookies may affect site functionality. We do not use cookies to build advertising profiles or share visitor data with ad networks for targeting on our own behalf.
We retain personal data only as long as necessary for the purpose it was collected:
• Active client project data: duration of engagement plus 3 years
• Enquiry and lead data: 12 months from last contact
• Accounting and billing records: 7 years as required by Indian tax law
• Website analytics data: 26 months (aggregated and anonymised thereafter)
• Client business data on managed platforms: access revoked within 7 business days of engagement termination
After the retention period, data is securely deleted or anonymised.
We implement reasonable security practices as required by the SPDI Rules 2011 and industry standards, including:
• Encryption in transit (TLS/HTTPS) for all data transmission
• Access controls and role-based permissions for internal systems
• Secure credential management - passwords are never stored in plain text
• Regular backups of websites and systems under active management
• SSL/HTTPS enforcement on all managed websites
While we take all reasonable precautions, no transmission over the internet is 100% secure. In the event of a security breach affecting your data in systems under our active management, we will notify you within 24 hours of discovery.
When using platforms such as Google (USA), Meta (USA), Vercel (USA), or Zoho (India/USA), data may be transferred and stored outside India. We ensure such transfers are subject to adequate safeguards consistent with DPDPA 2023 and applicable Central Government notifications. Clients are advised to review the privacy policies of third-party platforms they use.
Under DPDPA 2023, you have the following rights:
• Right to Access: obtain a summary of personal data we hold about you
• Right to Correction: request correction of inaccurate or incomplete data
• Right to Erasure: request deletion of your personal data, subject to legal retention obligations
• Right to Grievance Redressal: raise complaints with our designated Grievance Officer
• Right to Withdraw Consent: at any time, without affecting lawfulness of prior processing
• Right to Nominate: nominate another individual to exercise your rights in case of death or incapacity
To exercise these rights, email info@addmads.com. We will respond within 30 days.
In accordance with the IT Act 2000 and SPDI Rules 2011:
Grievance Officer: Ankit
Email: info@addmads.com
Phone: +91 92208 72212
We will acknowledge your grievance within 24 hours and resolve it within 30 days.
We may update this Privacy Policy periodically. Material changes will be posted on this page with a revised effective date. Continued use of our services after changes constitutes acceptance of the updated policy.
This Privacy Policy is governed by the laws of India. Any disputes shall be subject to the jurisdiction of courts in Haryana, India, subject to any applicable arbitration clause in our Terms of Service.