Privacy Policy

1. Scope and Applicability

This Privacy Policy applies to all personal data processed by Spiralreach through our website, contact and inquiry forms, newsletter and email subscription workflows, client onboarding and campaign management systems, analytics and tracking technologies, and other service delivery mechanisms.

This policy applies to individuals who (i) visit or interact with our website, (ii) inquire about or engage our services, (iii) correspond with us by any means, or (iv) are contacts or representatives of our existing or prospective business clients. It does not apply to the employment or recruitment context, which is governed by our separate employment privacy notice.

If you access third-party platforms, services, or websites through links or integrations on our website, please be aware that those platforms are governed by their own privacy terms, and we are not responsible for their data practices.

2. Information We Collect

We collect various categories of personal data depending on how you interact with us. The categories of information we may collect include, but are not limited to:

a. Identity and Contact Information

This includes your full name, email address, phone number, job title, company or organization name, and billing or mailing address. This information is typically collected when you submit an inquiry, sign up for our newsletter, or engage our services.

b. Business and Campaign Information

When you engage or inquire about our services, we may collect details such as your business objectives, marketing goals, target audiences, budget ranges, preferred services, existing platform accounts, and brand assets, to the extent you provide them.

c. Technical and Usage Data

We automatically collect certain technical information when you visit our website. This includes your IP address, browser type and version, device type and operating system, screen resolution, referring URLs, pages visited, time spent on pages, click paths, and other interaction data.

d. Communications Data

We retain records of your communications with us, including emails, messages submitted through contact forms, support requests, and other correspondence. This information is used to respond to your inquiries, maintain service quality, and comply with legal obligations.

e. Inferred and Derived Data

We may derive or infer information about your preferences, interests, or potential service needs based on your interactions with our website and communications. This inference is used solely to personalize our outreach and improve service relevance.

3. How We Collect Information

a. Directly from You

We collect information you voluntarily provide when you complete inquiry or contact forms on our website, subscribe to our newsletter or updates, communicate with us via email or other channels, register for events or webinars, or enter into a service agreement with us.

b. Automatically through Our Website

We use cookies, web beacons, pixel tags, server logs, and similar tracking technologies to automatically collect technical and usage data when you visit our website. This data is collected to monitor website performance, identify and fix errors, understand user behavior, and deliver a consistent experience across sessions.

c. From Third Parties

In limited circumstances, we may receive data about you from trusted third-party sources, including advertising platforms, analytics providers, CRM partners, and business data enrichment services. We process such data only as permitted by applicable law and in accordance with the privacy notices of those third parties.

d. From Publicly Available Sources

We may supplement the information we hold with publicly available data, including professional profiles, company directories, and industry databases, for the purposes of business development and service personalization.

4. Legal Bases and Purposes of Processing

We process personal data only where we have a lawful basis to do so. Depending on your jurisdiction and the nature of the processing, the applicable legal bases may include:

• Contractual Necessity: Processing required to deliver the services you have requested or contracted for.
• Legitimate Interests: Processing necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms.
• Legal Obligation: Processing necessary to comply with a legal or regulatory obligation applicable to us.
• Consent: Processing based on your specific, informed, and freely given consent, which you may withdraw at any time.
• Vital Interests: In exceptional circumstances, processing necessary to protect the vital interests of an individual.

The specific purposes for which we process your personal data include: delivering and administering our services; responding to business inquiries and correspondence; communicating campaign performance insights and service updates; sending marketing communications where permitted (with opt-out controls); analyzing and improving our website and service offerings; preventing fraud, abuse, and unauthorized access; and complying with applicable legal and regulatory requirements.

5. Cookies and Tracking Technologies

Our website uses cookies and similar technologies including web beacons, pixel tags, local storage, and session identifiers. These technologies serve several purposes:

• Strictly Necessary Cookies: Required for the website to function and cannot be switched off. They enable core features such as page navigation, session management, and form submission.
• Performance and Analytics Cookies: Allow us to measure and analyze how visitors use our site, helping us identify areas of improvement and optimize content.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferences.
• Targeting and Advertising Cookies: Used to deliver relevant advertisements and track campaign performance across platforms.

Where required by applicable law, we request your consent before placing non-essential cookies. You can manage or withdraw cookie consent at any time through your browser settings or our cookie preference center. Please note that disabling certain cookies may affect the functionality of our website.

6. Behavioral Advertising and Ad Networks

As a digital marketing agency, our website may use advertising pixels and tags from third-party ad platforms (such as Google Ads and Meta Ads) to measure campaign performance and, where applicable, to deliver targeted advertising based on your interests and online behavior. This activity is carried out in accordance with our cookie policy and applicable privacy laws.

We do not engage in the sale of personal data to third-party advertisers. Where behavioral advertising technologies are employed on our own website, they are used strictly for measurement, analytics, and service improvement purposes. You may opt out of interest-based advertising by visiting the Digital Advertising Alliance or the Network Advertising Initiative, or through the opt-out mechanisms provided directly by relevant ad platforms.

7. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to any third party. We may share your information in the following circumstances:

a. Service Providers and Subprocessors

We engage reputable third-party vendors and service providers to support our operations, including website hosting, cloud infrastructure, email communications, analytics, CRM platforms, payment processing, and campaign reporting tools. These parties are authorized to process personal data only as required to perform their contracted services and are bound by appropriate data processing agreements.

b. Professional Advisors

We may disclose your data to lawyers, accountants, auditors, insurers, and other professional advisors in connection with the exercise of our legal rights or in the course of professional services they provide to us, subject to binding confidentiality obligations.

c. Legal Authorities and Regulatory Bodies

We may disclose personal data to government authorities, law enforcement agencies, or regulatory bodies when required by law, court order, or to protect the safety, rights, or property of Spiralreach, our clients, or the public.

d. Business Transfers

In the event of a merger, acquisition, restructuring, sale of assets, or similar corporate transaction, personal data held by us may be transferred to the relevant successor entity. We will notify affected individuals of any such transfer where required by law.

e. With Your Consent

We may share your information with third parties in any other context where we have obtained your explicit prior consent.

8. International Data Transfers

Spiralreach operates primarily from India, and our service providers may be located in other jurisdictions. When personal data is transferred across international borders — including transfers to countries that may not offer the same level of data protection as your home jurisdiction — we take appropriate steps to ensure an adequate level of protection is maintained.

Such safeguards may include, depending on the applicable regulatory framework, standard contractual clauses approved by relevant authorities, data processing agreements with subprocessors, transfer impact assessments, or other recognized mechanisms. If you have questions about the specific safeguards applicable to your data transfer, please contact us using the details in Section 18.

9. Data Retention

We retain personal data only for as long as is necessary to fulfill the purposes for which it was collected, including to satisfy any applicable legal, accounting, or reporting obligations. The specific retention period depends on the nature of the data, the purpose of processing, and any applicable statutory requirements.

As a general guide: (i) client service data is retained for the duration of the client relationship and for a reasonable period thereafter consistent with legal obligations; (ii) marketing and communications data is retained until you unsubscribe or request deletion; and (iii) website usage data is retained for a period consistent with our analytics configurations, typically not exceeding 26 months.

Where personal data is no longer required, we take reasonable steps to delete or anonymize it securely. Anonymized, aggregated data may be retained indefinitely for analytical purposes as it no longer constitutes personal data.

10. Data Security Measures

We implement commercially reasonable administrative, technical, and organizational security measures designed to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, alteration, or disclosure. These measures include, without limitation:

• Encryption of data in transit using industry-standard protocols (e.g., TLS/HTTPS);
• Role-based access controls and least-privilege access principles;
• Regular security assessments and monitoring of our systems;
• Vendor due diligence and contractual security obligations; and
• Internal data handling policies and staff awareness practices.

While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security and encourage you to exercise caution when transmitting sensitive information online.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals, within the timeframes prescribed by applicable law.

11. Your Privacy Rights

Depending on your country or region of residence, you may have the following rights in relation to your personal data:

• Right of Access: To obtain confirmation as to whether we process your personal data and to receive a copy of such data.
• Right to Rectification: To request correction of inaccurate or incomplete personal data we hold about you.
• Right to Erasure: To request deletion of your personal data in certain circumstances (also known as the "right to be forgotten").
• Right to Restriction: To request that we restrict or suspend processing of your personal data in certain situations.
• Right to Data Portability: To receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: To object to processing of your personal data where we rely on legitimate interests as the legal basis.
• Right to Withdraw Consent: Where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right Not to be Subject to Automated Decision-Making: To not be subject to a decision based solely on automated processing that significantly affects you, except where such processing is permitted by law.

To exercise any of the above rights, please contact us at info@spiralreach.com. We will respond to your request within the timeframe required by applicable law (typically within 30 days, subject to extension in complex cases). We may request reasonable verification of your identity before processing your request in order to protect your data and prevent unauthorized disclosure.

If you are dissatisfied with our response, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

12. Region-Specific Disclosures

a. European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, the data controller responsible for your personal data is Spiralreach (contact details in Section 18). We process your data in accordance with the General Data Protection Regulation (GDPR) and applicable national implementation laws. You have the rights described in Section 11, and you may lodge complaints with your local supervisory authority.

b. India

For individuals located in India, we process personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (DPDPA) to the extent it is in force and applicable to our operations. You may exercise your rights under applicable Indian law by contacting us as described in Section 18.

c. United States – California (CCPA / CPRA)

California residents may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know about personal data collected and disclosed, the right to delete personal data, the right to opt out of the "sale" or "sharing" of personal data, and the right to non-discrimination for exercising privacy rights. Spiralreach does not sell personal data. For requests specific to California rights, please contact us at info@spiralreach.com.

13. Client Data Responsibilities

When providing digital marketing and agency services, Spiralreach may access, process, or handle personal data belonging to our clients' customers, users, or audiences — solely in accordance with client instructions and the terms of our service agreements. In such contexts, Spiralreach acts as a data processor, and the client remains the data controller.

Clients are solely responsible for obtaining all necessary consents, providing appropriate privacy notices, and establishing a valid legal basis for any personal data they submit to our systems, platforms, or campaign workflows. Clients represent and warrant that their data submissions comply with applicable privacy laws and platform policies.

Our data processing obligations as a service provider are governed by the applicable data processing addendum or contractual terms agreed upon with each client.

14. Children's Privacy

Our website and services are not directed to, designed for, or intended for use by children below the age of 16 (or a higher minimum age where required by applicable law). We do not knowingly collect, use, or disclose personal data from children. If we become aware that personal data of a child has been collected without appropriate parental consent, we will take reasonable steps to delete such information promptly.

If you believe we may have inadvertently collected personal data from a child, please contact us immediately at info@spiralreach.com.

15. Third-Party Websites and Services

Our website may contain links to external websites, social media platforms, partner portals, and third-party tools. These links are provided for your convenience and information only. When you click on these links, you are subject to the privacy policies of those third-party properties, over which we have no control and for which we assume no responsibility.

We strongly encourage you to review the privacy policies and terms of service of any third-party website before providing personal data or conducting any transactions.

16. Do Not Track Signals

Some web browsers offer a "Do Not Track" (DNT) feature that transmits a signal to websites requesting that your browsing activity not be tracked. Because there is currently no universally accepted standard for how websites should respond to DNT signals, our website does not currently alter its data collection practices in response to DNT browser settings.

You may, however, manage cookies and tracking preferences through your browser settings and our cookie controls, as described in Section 5.

17. Policy Updates

We may update or revise this Privacy Policy from time to time to reflect changes in our practices, applicable laws, regulatory requirements, or business operations. When we make material changes, we will update the "Last updated" date at the top of this page, and where required by law or in our discretion, we may notify you via email or a prominent notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our website or services following the posting of any changes constitutes your acknowledgment of such changes.