Privacy Policy

Last updated 6 September 2026  ·  Varnan Digital (OPC) Private Limited  ·  CIN U62090KL2025OPC096808

This policy explains what personal data Varnan Digital (OPC) Private Limited collects, why we collect it, who we share it with, and the control you have over it. It covers this website, our marketing and sales activity, and the services we deliver to clients.

1. Who we are

Varnan Digital (OPC) Private Limited is a digital marketing and AI services company incorporated in India on 1 September 2025.

• Legal entity: Varnan Digital (OPC) Private Limited
• Corporate Identity Number: U62090KL2025OPC096808
• Registered office: 446, Kaivalliam, Vakkom, Chirayinkeezhu, Thiruvananthapuram, Kerala 695308, India
• Contact for privacy matters: [email protected]

For the personal data described in this policy, Varnan is the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and the data controller under the UK and EU General Data Protection Regulation where that law applies. When we process personal data on behalf of a client as part of a paid engagement, we act as a data processor instead. Those arrangements are governed by our Data Processing Addendum.

2. Who this policy is about

We hold personal data about four groups of people:

• Website visitors — anyone who loads a page on varnandigital.com.
• Enquirers and prospects — people who submit a form, book a call, reply to outreach, or otherwise start a conversation with us.
• Clients and their staff — the people we work with day to day at companies that engage us.
• Our client’s own contacts — leads, customers and audiences whose data passes through campaigns and systems we run. We handle that data as a processor, on our client’s instructions.

3. What we collect and why

We do not knowingly collect sensitive categories of data such as health, biometric, financial account, caste, religion or political data, and you should not send them to us. We do not knowingly collect data from children under 18. If you believe a child has given us personal data, write to us and we will delete it.

4. What we do not do

• We do not sell personal data, and we do not share it with data brokers.
• We do not load analytics, advertising or third-party embeds before you consent.
• We do not use your personal data or your company’s confidential material to train third-party AI models. See our AI Usage Policy.
• We do not make decisions producing legal or similarly significant effects about you by automated means alone.

5. Cookies and tracking

varnandigital.com uses a consent gate. Until you make a choice, only strictly necessary cookies are set, and the code for Google Analytics, Google AdSense, Microsoft Clarity, Calendly and Sign in with Google is prevented from executing at all. Choosing Reject all keeps it that way and clears the non-essential cookies we can reach from your browser.

The full inventory of cookies, their purpose and their lifetime is in the Cookie Policy. You can change your choice at any time using the Cookie preferences link in the footer.

Our web fonts are served from our own domain, not from a third-party font service, so no data is sent to a font provider when you load a page.

6. Who we share data with

We share personal data with service providers who process it on our instructions, and only as far as they need it. Every provider we currently use, what it receives and where it processes data is listed in the Third-Party Policy. In summary, they fall into these groups:

• Infrastructure — website hosting, Cloudflare for DNS and content delivery, and Wordfence for security filtering.
• Communication and productivity — Google Workspace, Calendly, ClickUp, Notion, Fireflies.ai and WhatsApp Business.
• Measurement — Google Analytics 4, Google Search Console, Microsoft Clarity and Microsoft Bing Webmaster Tools, subject to your consent.
• Advertising platforms — Google Ads, Meta, LinkedIn and Microsoft Advertising, used to run campaigns for clients.
• AI providers — Anthropic, and where a client chooses it, OpenAI. Both are used under API terms that do not permit training on our inputs.

We also disclose data where we are legally required to, to our professional advisers under a duty of confidence, and to a buyer or successor if the business is ever sold. We will tell clients before any such transfer takes effect.

7. Where your data goes

Our website is hosted on infrastructure located in India. Several of the providers above are based outside India and will process data in the United States, the European Union and other countries. Where personal data protected by UK or EU law is transferred outside those regions, we rely on the provider’s Standard Contractual Clauses or an adequacy decision. Under the DPDP Act, we transfer personal data outside India only to countries not restricted by the Central Government.

8. How long we keep it

9. Your rights

Whatever law applies to you, we will honour these requests:

• Access — a copy of the personal data we hold about you and a summary of how it is processed.
• Correction — fix anything inaccurate, incomplete or out of date.
• Erasure — delete your data where we have no lasting legal reason to keep it.
• Withdraw consent — as easily as you gave it, including your cookie choice and consent to be contacted.
• Object or restrict — stop or pause processing based on legitimate interests, including direct marketing, which we will always stop on request.
• Portability — receive your data in a structured, machine-readable format.
• Nominate — under the DPDP Act, nominate someone to exercise these rights if you die or become incapacitated.

Write to [email protected] with the subject line “Data request”. We reply within 30 days and do not charge for a reasonable request. We may ask you to confirm your identity before releasing data.

10. Grievance officer and complaints

Our Grievance Officer under the DPDP Act is Amal Jandheer, Director, reachable at [email protected]. If you are not satisfied with our response, you may complain to the Data Protection Board of India. If you are in the UK or EU, you may complain to your national supervisory authority, such as the Information Commissioner’s Office in the UK.

11. How we protect data

The site runs over HTTPS with Cloudflare in front of the origin server. Administrative access uses strong, unique credentials and multi-factor authentication where the platform supports it. Form submissions are validated and checked with a nonce to block automated abuse, and the Wordfence firewall filters malicious traffic. Access to client data is limited to the people working on that engagement. No system is perfectly secure, and if a breach affects your personal data we will notify you and the relevant regulator as the law requires.

12. Changes to this policy

We review this policy at least once a year and whenever we add or remove a service provider. Material changes are announced on this page with a new “last updated” date, and where the change affects how we use your data we will ask for fresh consent rather than assume it.