Privacy Rights

1. Who This Page Applies To

This Privacy Rights page applies to all individuals whose personal data is processed by Spiralreach, including website visitors, business prospects, newsletter subscribers, and contacts of our current or former clients. The specific rights available to you depend on your country or region of residence and the nature of your relationship with Spiralreach.

Where Spiralreach acts as a data processor on behalf of a business client (i.e., when we process customer data provided by a client for campaign purposes), you should direct your rights request to that client directly, as they are the data controller responsible for your information. Spiralreach will assist clients in responding to such requests as required by our service agreements.

Where Spiralreach acts as a data controller — for example, in relation to data collected through our own website, marketing communications, or business development activities — you may exercise your rights directly with us as described on this page.

2. Your Universal Privacy Rights

Regardless of your jurisdiction, Spiralreach recognizes and respects the following foundational privacy principles and corresponding rights for all individuals:

3. GDPR-Specific Rights (EEA, UK & Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you are afforded additional rights under the General Data Protection Regulation (GDPR) and applicable national data protection laws. These rights include:

a. Right of Access (Article 15 GDPR)

You have the right to obtain confirmation of whether we process your personal data and, where we do, to receive a structured copy of that data along with information regarding the purposes, categories, recipients, and retention periods.

b. Right to Rectification (Article 16 GDPR)

You have the right to request correction of inaccurate personal data and the completion of incomplete data, without undue delay.

c. Right to Erasure / Right to Be Forgotten (Article 17 GDPR)

You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, where you have successfully objected to processing, or where processing is unlawful. We will comply unless retention is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.

d. Right to Restriction of Processing (Article 18 GDPR)

You may request that we restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where processing is unlawful but you prefer restriction over erasure.

e. Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible.

f. Right to Object (Article 21 GDPR)

You have the right to object at any time to the processing of your personal data where we rely on legitimate interests as our legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defense of legal claims.

g. Rights Related to Automated Decision-Making (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects. Spiralreach does not currently engage in such automated decision-making. If this changes, we will update this page and provide appropriate safeguards.

h. Right to Lodge a Complaint

You have the right to lodge a complaint with the data protection supervisory authority in your EU/EEA member state, or with the Information Commissioner's Office (ICO) in the UK, if you believe we have processed your personal data in a manner that does not comply with applicable law. We encourage you to contact us first, and we will make every effort to resolve your concern directly.

4. CCPA/CPRA-Specific Rights (California)

California residents have specific rights under the California Consumer Privacy Act (CCPA), as expanded by the California Privacy Rights Act (CPRA). These rights apply to personal information as defined under California law and include the following:

a. Right to Know

You have the right to request disclosure of: (i) the categories and specific pieces of personal information we have collected about you; (ii) the categories of sources from which it was collected; (iii) the business or commercial purpose for collecting it; and (iv) the categories of third parties with whom we have shared it.

b. Right to Delete

You may request deletion of personal information we have collected from you, subject to certain exceptions recognized under California law, such as where the information is necessary to complete a transaction, detect security incidents, comply with a legal obligation, or engage in research in the public interest.

c. Right to Correct

Under the CPRA, you have the right to request correction of inaccurate personal information we maintain about you, taking into account the nature of the data and our purposes for processing it.

d. Right to Opt Out of Sale or Sharing

Spiralreach does not sell personal information, nor does it share personal information for cross-context behavioral advertising purposes. Should our practices change in the future, we will update this page, provide required notices, and offer a clear opt-out mechanism before any such sharing occurs.

e. Right to Limit Use of Sensitive Personal Information

Where we collect sensitive personal information as defined under the CPRA, you have the right to limit its use and disclosure to purposes necessary to perform the services you have requested or as otherwise permitted by law. Spiralreach does not collect sensitive personal information beyond what is ordinarily required for professional communications and service delivery.

5. India DPDPA Rights

For individuals located in India, we process personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) to the extent applicable to our operations. Under the DPDPA, you have the following rights as a Data Principal:

• The right to obtain information about the personal data we process about you;
• The right to correction and erasure of personal data, where applicable;
• The right to grievance redressal through our designated contact channel; and
• The right to nominate an individual to exercise your rights in the event of your death or incapacity.

To raise a grievance or exercise your rights under the DPDPA, please contact us at info@spiralreach.com. We are committed to acknowledging and responding to grievances within timelines prescribed under applicable Indian law.

6. How We Handle Your Personal Data

As a digital marketing agency in an early and growth-oriented stage, Spiralreach intentionally limits the personal data it collects to what is genuinely necessary for providing services, responding to inquiries, and improving our website. We do not build behavioral profiles for advertising, we do not sell data to brokers or third parties, and we do not operate large-scale consumer data pipelines.

The personal data most commonly associated with individuals who interact with Spiralreach includes professional contact details (name, email, company), website usage data, and inquiry or campaign-related communications.

We are transparent about our data practices and encourage you to review our Privacy Policy for a comprehensive understanding of how your data is collected, used, and protected.

7. How to Submit a Privacy Request

To submit a privacy rights request, please email us at info@spiralreach.com with the subject line "Privacy Request". To help us process your request efficiently, please include the following in your message:

• Your full name and email address (as used in your interactions with us);
• Your country or region of residence;
• The specific right(s) you wish to exercise (e.g., access, deletion, correction); and
• Any additional context that would help us identify your records.

Upon receipt, we will acknowledge your request and initiate the verification process. We process all requests in good faith, in compliance with applicable law, and without unnecessary delay.

8. Authorized Agents

Where permitted by applicable law (including under the CCPA/CPRA), you may designate an authorized agent — such as an attorney or trusted representative — to submit a privacy rights request on your behalf.

To exercise rights through an authorized agent, the agent must provide written authorization signed by you or a valid power of attorney, along with sufficient information to verify your identity and confirm the agent's authority.

9. Identity Verification

To protect your personal data and prevent unauthorized disclosure, we are required to verify your identity before fulfilling any privacy rights request. The verification process is proportionate to the sensitivity of the request and the data involved.

Typically, we verify identity by cross-referencing information you provide in your request against information we already hold about you. If we are unable to verify your identity after reasonable efforts, we may be unable to fulfill your request and will inform you accordingly.

10. Response Timing and Process

We will acknowledge receipt of your privacy request promptly and respond within the timeframes required by applicable law, as outlined below:

Responses are provided free of charge for one request per twelve-month period. If requests are manifestly unfounded, excessive, or repetitive, we reserve the right, where permitted by law, to charge a reasonable administrative fee or decline to act on the request, with explanation.

11. Exceptions and Limitations

While we are committed to honoring your privacy rights, certain requests may be subject to lawful exceptions or limitations. We may decline to fulfill a request, in whole or in part, where doing so is necessary to:

• Comply with a legal obligation, court order, or government directive;
• Establish, exercise, or defend legal claims;
• Protect the rights and freedoms of other individuals;
• Prevent, detect, or investigate fraud, security incidents, or illegal activity;
• Complete a transaction or service that you have requested; or
• Fulfill another legitimate purpose as permitted by applicable law.

Where we are unable to fulfill a request due to an applicable exception, we will inform you of the reason and, where required, the avenues available to you to challenge our decision.

12. Non-Discrimination Policy

Spiralreach is firmly committed to the principle of non-discrimination in the exercise of privacy rights. We will not penalize, deny services to, charge different prices to, or provide a diminished level of service to any individual for exercising their rights under applicable privacy law.

This commitment applies to all interactions — whether you are a website visitor, a business prospect, or a client. Exercising your privacy rights will have no negative bearing on the quality, pricing, or availability of our services.

13. Supervisory Authorities and Dispute Resolution

If you are not satisfied with our response to a privacy rights request or believe we are not handling your personal data in accordance with applicable law, you have the right to escalate your concern to the relevant supervisory authority in your jurisdiction:

• EEA: The data protection authority (DPA) of your EU member state (e.g., CNIL in France, BfDI in Germany, AEPD in Spain).
• United Kingdom: The Information Commissioner's Office (ICO) — ico.org.uk
• California, USA: The California Privacy Protection Agency (CPPA).
• India: The Data Protection Board of India, once operational under the DPDPA framework.

We encourage you to contact us first before escalating to a supervisory authority. We take all privacy concerns seriously and will make every reasonable effort to resolve any issue directly, promptly, and to your satisfaction.

14. Updates to This Page

We may update this Privacy Rights page periodically to reflect developments in applicable law, regulatory guidance, or our internal practices. Any material changes will be reflected in a revised "Last updated" date at the top of this page.