Privacy Policy – Rednirus Digital Media

This is the plain-language version of how Rednirus Digital Media looks after your personal information. It explains what we collect on rednirus.in and through our services, why we need it, who sees it, how long we keep it, and what you can do about it. It follows Indian law, and we have written it to be read, not just filed.

1. About this policy

Rednirus Digital Media ("Rednirus", "we", "us") is a digital marketing and web development agency based in Panchkula, Haryana, India. We offer SEO, social media optimisation and marketing, Google Ads (PPC), website design and development, e-commerce marketing, bulk SMS and WhatsApp marketing.

This policy covers rednirus.in, our enquiry forms, and every call, email, WhatsApp chat or project in which you share personal information with us. If you keep using our site or send us your details, you accept this policy. Where the law needs your specific consent for something, we ask for it separately instead of hiding it here.

Which laws apply, honestly. Two sets of rules matter at the moment:

Today: the Information Technology Act, 2000 and the SPDI Rules, 2011 (sections 43A and 72A and the rules under them) govern how businesses must handle personal data and publish a privacy policy.
Being phased in: the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The Data Protection Board of India is already set up. The main duties on businesses (notice, consent, breach reporting and your rights) apply in full from May 2027.

We do not plan to wait. This policy is already written to the DPDP standard, so nothing should change for you when the full law arrives.

2. What we collect

We collect only what we need to talk to you and do the work.

What	Examples	How we get it
Details you give us	Name, phone number, email, company name, website, city, your message, budget	Contact and enquiry forms, calls, WhatsApp, email
Project material	Brand assets, content, ad-account and social-page access, target audience lists	When you hire us or onboard as a client
Business and billing details	Company name, GSTIN, billing address, invoices and payment records	Onboarding and invoicing
Technical data	IP address, browser and device type, pages viewed, referring site, approximate location, visit time	Automatically, through cookies and server logs
Communication records	Emails, chat messages, call notes, your consent and opt-out choices	Our conversations with you

We do not ask for "sensitive personal data" as the SPDI Rules define it, such as passwords to your personal accounts, card or bank details, health records or biometrics. When a project needs access to your ad or social-media accounts, we ask you to add us as a user through the platform itself, so you never have to share a password. Payments are handled by [your payment method, e.g. bank transfer or a third-party payment gateway], not stored on this website.

3. Why we use it

Every use of your information has a reason, and the reason has a legal footing under the DPDP Act: either your consent, or one of the "legitimate uses" listed in Section 7 of the Act.

To reply to you and send quotes. You gave us your details for exactly this, so we use them for exactly this (your consent, or a voluntary request under Section 7).
To deliver your project. Running campaigns, building websites, reporting results and supporting you after launch.
To invoice you and meet legal duties. Tax, GST, accounting and company-law records, plus orders from courts or government bodies (a legal obligation).
To send you offers and updates. Only if you said yes, and you can say no again whenever you like.
To keep the site safe and working. Spotting spam, fraud and attacks, fixing bugs, and seeing which pages are actually useful.

We do not sell your personal information. We do not use it to make automated decisions that affect your legal rights.

4. Calls, SMS and WhatsApp

Messaging is part of what we do for clients, so we hold ourselves to the telecom rules as well as the privacy ones.

We contact you for marketing only with your consent. Giving us your number to get a quote is not permission for promotional messages.
SMS follows TRAI's rules. Under the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR), commercial SMS must go out through registered sender IDs and pre-approved message templates on the DLT platform, and must respect your preferences, including Do Not Disturb.
WhatsApp needs an opt-in. We message you on WhatsApp for marketing only if you have agreed to it, and we follow WhatsApp's Business terms.
Stopping is easy. Reply STOP, use the unsubscribe link, or just tell us. We act on it promptly and keep a record of your choice so it is respected next time.
Operator-level blocking. You can also register your number as Do Not Disturb with your telecom operator (call 1909) or through the TRAI DND app.

For campaigns we run for clients, we only send to lists that the client confirms were collected with valid consent.

5. Cookies and analytics

Cookies are small files your browser stores so a site can remember things. We use three kinds:

Essential cookies keep the site working, for example loading pages and keeping forms secure. These cannot be switched off.
Analytics cookies show us how visitors use the site, so we can improve it. [Keep only what you use: Google Analytics, Microsoft Clarity, etc.]
Marketing cookies measure and improve our own ads. [Keep only what you use: Google Ads, Meta (Facebook) Pixel, etc.]

We ask for your permission before setting analytics and marketing cookies. You can also block or delete cookies in your browser settings; the site will still work, though some features may not.

6. When we handle data for our clients

Often we work with data that belongs to someone else's customers, such as a mailing list, a lead database or ad audiences. In those cases our client decides why and how the data is used, and we act only on their written instructions under a contract (the DPDP Act calls this a Data Processor).

In practice that means we use the data only for the agreed campaign, limit access to the people who need it, apply the same security as for our own data, and return or delete it when the work ends. If a message or ad reached you because of a client campaign and you have a concern, please contact that brand first. You are also welcome to write to us and we will help you reach them.

7. Who we share it with

We share personal information only when there is a good reason, and only as much as needed:

Service providers who help us operate, such as web hosting, email, CRM and project tools, analytics, SMS gateways and telecom operators, WhatsApp Business (Meta), accountants and payment providers. They are bound to protect your data and use it only for our purposes.
Advertising and social platforms such as Google and Meta, when you have asked us to run campaigns that need them.
Authorities, when a law, court order or government direction requires it.
A buyer or successor, if Rednirus is ever merged or sold. The new owner must honour this policy.

Storage outside India. Some of the tools we use, such as Google and Meta, keep data on servers in other countries. The DPDP Act allows this unless the Government restricts a particular country, and we will follow any such restriction as well as any sector-specific rules that apply to a client's data.

8. How long we keep it

We keep personal information only as long as there is a reason to, then delete or anonymise it.

Type of data	How long
Enquiries that never became a project	[12 months] from your last contact, unless you ask us to delete sooner
Client and project records	For the length of our work together, plus any period that tax, accounting or other laws require
Marketing consent and opt-out records	Until you withdraw consent, plus the time we need to prove it was handled correctly
System and server logs	A rolling 180 days, as the CERT-In cyber security directions require

If the law requires us to keep something longer, we keep it only for that purpose.

9. How we protect it

The SPDI Rules ask businesses to follow "reasonable security practices", and the DPDP Rules ask for similar safeguards. Ours include:

Encrypted connections (HTTPS) across our website
Access to personal data limited to team members who need it for their work
Strong passwords, two-step verification on key accounts and regular backups
Checking that the vendors we use take security seriously

[Edit this list so it matches what you actually do.]

If something goes wrong. We report qualifying cyber security incidents to CERT-In within 6 hours of noticing them, as its 2022 directions require. Once the DPDP Act is fully in force, we will also tell the Data Protection Board and anyone whose personal data is affected.

No system on the internet is completely secure. If you suspect your information has been misused, please write to us straight away.

10. Your rights

The DPDP Act calls you a "Data Principal" and gives you these rights. Using them is free.

Know what we hold. Ask for a summary of your personal data, what we do with it and who we shared it with (Section 11).
Correct it. Ask us to fix, complete or update anything that is wrong or out of date (Section 12).
Erase it. Ask us to delete data we no longer need, unless a law requires us to keep it (Section 12).
Withdraw consent. You can take back any consent at any time, as easily as you gave it. This does not affect what we did lawfully before, though we may not be able to continue a service that depends on that data (Section 6).
Raise a grievance. Tell us if you think we have got something wrong (Section 13).
Nominate someone. Name a person who can use these rights for you if you die or cannot act yourself (Section 14).

How to use them. Email our Grievance Officer (details in Section 12 below). We may ask for a little information to confirm it is really you. We acknowledge within 48 hours and aim to resolve within 30 days; the DPDP Rules set a hard limit of 90 days.

If we cannot settle it. Once the Act's complaint provisions are fully in force, you can complain to the Data Protection Board of India after you have first used our grievance process.

11. Children, other websites and changes

Children. Our services are for businesses and are not aimed at anyone under 18. Under the DPDP Act, a child's data needs verifiable consent from a parent or guardian, and children's data cannot be tracked or used for targeted advertising. If you think a child has sent us their details, tell us and we will delete them.

Other websites. Our site may link to websites run by others, such as social platforms and client sites. We do not control them, so please read their privacy policies.

Changes. We update this policy when our services or the law change. The "last updated" date at the top always shows the current version, and for significant changes we will say so clearly on the site or by email.

12. Grievance Officer and contact

Questions, requests and complaints about your personal information go to our Grievance Officer. The SPDI Rules and the DPDP Rules both require us to publish this.


Grievance Officer	[Name and designation]
Business	Rednirus Digital Media [registered entity name, CIN/GSTIN if applicable]
Email	[privacy@rednirus.in or your preferred address]
Phone	[Phone number]
Address	[Full office address], Panchkula, Haryana, India – [PIN code]
Working hours	[Mon–Sat, 10:00 AM–7:00 PM IST]

We acknowledge every request within 48 hours and aim to resolve it within one month, which is also the time the SPDI Rules allow.

13. Legal references

The official texts this policy is based on:

Digital Personal Data Protection Act, 2023 (MeitY)
Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), notified 13 November 2025)
MeitY data protection framework page
Information Technology Act, 2000 (India Code)
IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (G.S.R. 313(E))
CERT-In Cyber Security Directions, 28 April 2022
TRAI Telecom Commercial Communications Customer Preference Regulations, 2018

Privacy Policy

What is privacy Policy and what does it include?