Privacy Policy

Effective: 1 January 2026  ·  Last updated: 1 March 2026  ·  DPDP Rules 2025 compliant

1. Who We Are

Aarnoaa (OPC) Private Limited is a digital marketing and strategy consultancy incorporated in India (CIN: U73100HR2025OPC137642), with its registered office at Aarnoaa (OPC) Private Limited, Gurgaon, Haryana – 122001, India. We are the Data Fiduciary for personal data collected through this website and our services. Contact: contact@aarnoaa.com.

2. Data We Collect & Purpose for Each

We collect only what is necessary. The table below lists each data type, why we collect it, and who we share it with — as required under DPDP Act 2023 and DPDP Rules 2025.

3. How We Use Your Data

To respond to enquiries and service requests; to provide contracted services; to send relevant communications where you have consented; to comply with legal obligations; and to improve our website and services.

4. Advertising, Analytics & Conversion Tracking

We use the following third-party tools for website analytics, advertising measurement, and conversion tracking. These tools only activate where you have consented to marketing cookies via our cookie banner. No advertising data is collected or transmitted prior to consent.

Conversion tracking: We use Google Tag Manager (GTM) and Google Analytics 4 (GA4) to measure form submissions and enquiry completions as conversion events. This enables our Google Ads campaigns to optimise for leads rather than clicks. The data collected includes event type, page URL, and anonymised user identifiers.

• Google Ads & Google Analytics 4 (Measurement ID: G-XXXXXXXXXX) — campaign measurement, website analytics, conversion tracking via GTM, and remarketing. Opt out via Google Ad Settings.
• Meta Pixel (Facebook / Instagram) — advertising measurement and remarketing on Meta platforms. Opt out via Meta Ad Preferences.
• LinkedIn Insight Tag — campaign analytics and remarketing on LinkedIn. Opt out via LinkedIn Ad Settings.

No advertising data is collected or transmitted prior to cookie consent being granted.

5. Legal Basis for Processing

Under DPDPA 2023: Consent (for marketing communications) and Legitimate Use (for service delivery and legal compliance). Under GDPR: Consent, Contract, Legitimate Interests, and Legal Obligation as applicable.

6. Data Retention

We retain your data for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Enquiry data is retained for 3 years. Client engagement data is retained for 7 years for legal compliance.

7. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act 2023 and DPDP Rules 2025, you have the following rights. We will respond to all requests within 30 days (or sooner where required by law).

• Access & Summary — You may request a summary of the personal data we hold about you, and a list of any third parties with whom your data has been shared.
• Correction — You may request that we correct any inaccurate or incomplete personal data we hold about you.
• Erasure — You may request deletion of your personal data. We will erase it unless we are legally required to retain it (e.g., for tax or contractual compliance).
• Withdrawal of Consent — You may withdraw consent for marketing communications or advertising at any time. Withdrawing consent is as easy as giving it: email contact@aarnoaa.com with the subject line "Withdraw Consent" and we will process it within 7 days. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• Nomination — You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. Contact us to register a nomination.
• Data Portability — You may request your data in a structured, machine-readable format where technically feasible.
• Grievance Redressal — If you have a complaint about how we handle your data, you may contact our Grievance Officer (see Section 9). We will acknowledge all complaints within 7 days and resolve them within 90 days as required by DPDP Rules 2025.

To exercise any of these rights, email contact@aarnoaa.com with the subject line "Data Rights Request — [Right You Are Exercising]". We will respond within 30 days and will never charge a fee for reasonable requests.

8. International Transfers

Where personal data is transferred outside India (for example, when ad platform data is processed by Google or Meta on servers outside India), we rely on standard contractual clauses and the recipient's own adequacy mechanisms. We do not transfer raw personal data (name, email, phone) outside India without your consent.

9. Grievance Officer & Contact

As required under the DPDP Act 2023, we have designated a Grievance Officer responsible for data protection matters:

We will acknowledge all complaints within 7 days and resolve them within 90 days as mandated by DPDP Rules 2025. If you are not satisfied with our resolution, you may escalate to the Data Protection Board of India once constituted.

10. Plain Language Statement

This policy is written in plain English as required by DPDP Rules 2025 (SARAL disclosure standard — Simple, Accessible, Rational, and Actionable). If any section is unclear, email us and we will explain it in plain language within 7 days.

11. Policy Updates

We will notify you of material changes to this policy by email (if you have provided one) or by placing a notice on this page. Continued use of our website after changes constitutes acceptance of the revised policy. This policy was last updated: 1 March 2026.