Read this before publishing. It is a starting template, not legal advice.
No lawyer has reviewed this document. Every [ADD: …] placeholder below is a fact nobody has supplied yet, and each one has to be filled in by hand. More importantly, the practices described here are the practices this website appears to have. They must be checked line by line against what the business actually does with enquiries, inboxes, spreadsheets and vendor tools before the site goes live.
Published as it stands, this page tells visitors things that may not be true. Fill it in, have it reviewed, then delete this box.
Who this policy is from
Apex Marcom operates this website. In this policy, “we” and “us” mean [ADD: full registered business name], with its registered office at [ADD: registered office address]. “You” means anyone who visits this site or gets in touch through it.
This policy covers the website only. Work we do for a client runs under a separate signed agreement, and the handling of data inside that work is governed by that agreement. The Terms of Use explain how the two fit together.
What we collect
Two things, and at the moment only two.
What you send us. If you write to us, call us, or fill in the enquiry form, we receive whatever you choose to put in it - usually a name, an email address, a phone number, a company name, and the brief itself. You decide what goes in the message. If you send a tender document or a deck, we receive that too.
What your browser sends when it loads a page. Any web server records this as a matter of course: the IP address the request came from, the browser and device type, the page asked for, and the time. That logging is done by our hosting provider, Cloudflare, and is held under their terms - [ADD: link to the hosting provider’s privacy policy].
What the enquiry form records with your message. Sending the form stores your IP address and browser details alongside the brief, as an anti-spam measure. The section below sets out exactly what and why.
Nothing else. This site has no accounts, no newsletter sign-up, no analytics and no chat widget. It sets one thing in your browser - the light or dark theme, if you choose one - and nothing that tracks you. The Cookie Policy sets that out in detail.
How the enquiry form works
When you press send, the form posts to this website’s own address and the enquiry is saved to a database run by our hosting provider, Cloudflare. It is not emailed anywhere, and it is not sent to a third-party form service, a marketing platform or a spreadsheet in anyone else’s account. We read it in a password-protected page on this same site.
Alongside what you typed, the record keeps the address of the page you sent it from, the IP address the submission came from, the country your browser reported, and your browser’s user-agent string. Those four are kept to tell a real enquiry from automated spam and to deal with abuse of the form; they are not used to build a profile of you and they are not looked at at all for an ordinary enquiry.
Nothing is stored if you start the form and do not send it. Everything you type stays in your browser until you press send.
If your browser cannot reach the form, it falls back to opening your own email program with the message already filled in - in that case nothing leaves your device until you press send there, and the message travels as ordinary email.
Why we use it
To reply to you, and to do the work you are asking about. That means answering an enquiry, asking follow-up questions, putting together a scope and a costing, booking media or vendors for an approved job, and keeping a record of what was agreed.
We do not build profiles of visitors, we do not sell or rent contact details, and we do not add people who sent us a brief to a marketing list. If we ever want to send you something you did not ask for, we will ask you first.
Fonts and other third-party requests
This site makes no third-party requests. Opening a page contacts our host and nothing else.
One thing is built and deliberately left switched off: a Cloudflare Turnstile check on the enquiry form, which would ask your browser to fetch a challenge from challenges.cloudflare.com before the form can be sent. While it is off, that request never happens. If it is turned on to deal with spam, this section and the Cookie Policy are part of that change rather than something to tidy up afterwards.
That is worth spelling out, because it is not how most sites work. The typefaces (Archivo and DM Mono) are served from this site’s own domain rather than from Google Fonts, so no request carrying your IP address goes to Google when a page loads. There are no embedded maps, videos, social widgets, chat boxes, advertising tags or content delivery networks.
The external addresses that do appear in these pages are ordinary links. Following one takes you to that site, under its privacy policy rather than ours.
Analytics and tracking
There is none today. No Google Analytics, no advertising pixel, no heatmaps, no session recording, no A/B testing tool. We cannot tell you which pages you looked at, because we do not measure it.
If measurement is added later, this policy and the Cookie Policy both have to be updated before the tag goes live, and a consent mechanism will probably be needed. The Cookie Policy lists what that involves.
How long we keep it
Only as long as there is a reason to. No periods are stated here yet, because they have to match how the business actually works:
- Enquiries that did not become work - 24 months, then deleted from the enquiry database. Whatever period is written here has to be the one actually applied: it is a scheduled deletion on the database, not a promise somebody remembers to keep.
- Correspondence and records tied to a paid engagement - kept for the length of the engagement, and afterwards for as long as tax, accounting and contract records must be held: [ADD: retention period for contract, invoice and tender records].
- Server logs - kept by the hosting provider for [ADD: log retention period, from the hosting provider].
You can ask us to delete correspondence sooner. See Your rights.
Who we share it with
We do not sell or rent personal information to anyone. It is shared only where a job needs it, and then only the part that is needed:
- Our email and hosting providers, who hold the data as an unavoidable part of running those services - [ADD: names of the email and hosting providers].
- Vendors we execute through - printers, fabricators, media owners, event partners - where the job requires it. A delivery address for merchandise, for example, or a site contact for an installation.
- Professional advisers such as accountants and lawyers, and any authority we are legally required to disclose to.
Anyone we pass information to is expected to keep it confidential and use it only for the job in hand. Some of these services may store data outside India - [ADD: confirm where each provider stores data, and whether any of it leaves India].
Keeping it safe
Access to the enquiry inbox is limited to [ADD: who has access to the enquiry inbox]. The account protections in place are [ADD: describe the access controls actually used, for example two-factor authentication on email]. The live site should be served over HTTPS so pages cannot be read or altered in transit - [ADD: confirm TLS is enabled on the live domain].
No system is completely secure, and we will not pretend otherwise. If something goes wrong that affects your information, we will tell you.
Your rights, and how to use them
In India, the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 are the main laws covering personal information and how it must be handled. This page does not summarise them. A summary written by us is not a reliable guide to your rights, and how much of either applies to a business of this size is a question for a legal review.
What we can tell you is what we will do. Ask us, and we will:
- tell you what we hold about you, and give you a copy;
- correct anything wrong or out of date;
- delete correspondence, unless we have to keep it for a contract or a tax record;
- stop using your details for anything you previously agreed to;
- tell you who else has seen it.
Write to [ADD: grievance officer name and email address], or use the addresses under How to reach us. We will reply within [ADD: the response time the business commits to]. If you are not satisfied with the answer, you can take it further - [ADD: escalation route, confirmed with your legal adviser].
Children
This site is aimed at businesses and the people who run them. It is not intended for children, and we do not knowingly collect information about anyone under 18. If you believe a child has sent us something, write to [ADD: grievance officer name and email address] and we will delete it.
Changes to this policy
When this policy changes, the date at the top changes with it. If we change something that matters - a new tool that collects data, a new party we share with - we will say so on this page rather than quietly editing a sentence.
How to reach us
Email hello@apexmarcom.co.in or call +91 00000 00000. By post: [ADD: registered office address]. For anything about your data specifically, write to the grievance officer: [ADD: grievance officer name and email address].
The contact page has our hours and a note on what to send with a brief. See also the Cookie Policy and the Terms of Use.