Third-Party Policy
Last updated 6 September 2026 · Varnan Digital (OPC) Private Limited · CIN U62090KL2025OPC096808
A complete register of the third parties Varnan relies on: what each one does, what personal data reaches it, and where it processes that data. We publish this so you never have to take “industry-standard providers” on trust.
How to read this. “Website” providers can receive data about anyone who visits varnandigital.com. “Operations” providers receive data about enquirers and clients. “Client delivery” providers receive data only where an engagement requires it, on the client’s instructions. Anything in the Website table marked consent required does not run at all unless you allow it in the cookie banner.
1. Website and infrastructure
| Provider | Role | Data it receives | Processing location | Consent |
|---|---|---|---|---|
| WHG Hosting Services Ltd | Web hosting for varnandigital.com | Everything stored on the site, plus server logs including IP address and requested URL | India | Strictly necessary |
| Cloudflare, Inc. | DNS, content delivery, bot filtering, TLS | IP address, request headers, security challenge results | Global edge network | Strictly necessary |
| Defiant, Inc. (Wordfence) | Firewall and malware scanning | IP address, request data and blocked-attack records | United States | Strictly necessary |
| Automattic / WordPress | Content management software | The software runs on our own server. The only outbound request is for emoji fallback images from WordPress.org’s asset domain, which discloses your IP address to WordPress.org and sets no cookie. | Self-hosted; assets from WordPress.org | Strictly necessary |
| Yoast BV | Search engine optimisation plugin | Software only. No visitor data leaves the site. | Self-hosted | Strictly necessary |
| Google LLC — Analytics 4 | Traffic and behaviour measurement | Pseudonymous identifier, pages viewed, referrer, device, approximate location from IP | United States and Google’s global network | Consent required |
| Google LLC — Site Kit and Search Console | Connects the site to Google’s measurement tools; aggregate search performance | Aggregated search queries and site performance. Search Console data is aggregated, not personal. | United States | Strictly necessary for Search Console; consent for the tags it deploys |
| Google LLC — AdSense | Advertising | Ad interaction and conversion signals, advertising identifiers | United States | Consent required |
| Google LLC — Identity Services | Sign in with Google, used for site administration | Google account identifier at sign-in | United States | Consent required |
| Microsoft Corporation — Clarity | Session replay and heatmaps | Pseudonymous identifier, clicks, scrolls, mouse movement, page structure. Text you type is masked by default. | United States | Consent required |
| Microsoft Corporation — Bing Webmaster Tools | Search performance reporting | Aggregated search data. No personal data. | United States | Strictly necessary |
| Unsplash Inc. | Photography served from Unsplash’s image servers | IP address and browser headers when an image loads. No cookie is set on your browser. | United States | Strictly necessary |
Web fonts are served from our own domain, so no request reaches a font provider.
2. Business operations
These handle enquiries, scheduling, project work and internal documents.
| Provider | Role | Data it receives | Location |
|---|---|---|---|
| Google LLC — Workspace | Email, Sheets, Drive, Calendar. Holds contact form submissions and the enquiry sheet. | Contact details, correspondence, documents, calendar entries | United States and global |
| Calendly LLC | Booking strategy calls | Name, email, time zone, booking answers | United States |
| Fireflies.ai | Recording, transcribing and summarising calls | Audio, transcript and AI summary of meetings, and participant names | United States |
| ClickUp (Mango Technologies, Inc.) | Project and task management | Client contact names, task content, deliverables | United States |
| Notion Labs, Inc. | Internal documentation and knowledge base | Project notes and documents, which may name client staff | United States |
| Meta Platforms — WhatsApp Business | Day-to-day client communication | Phone number and message content. Messages are end-to-end encrypted. | Global |
| Cloudflare, Inc. — Workers | Runs our own AI proxy service for product licensing | Licence keys and request metadata | Global edge network |
| Lemon Squeezy LLC | Payment and licensing for our software products | Billing name, email, country and transaction records. Card details go to the payment processor, never to us. | United States |
3. AI providers
| Provider | Models used | What is sent | Training |
|---|---|---|---|
| Anthropic PBC | Claude, including Claude Sonnet 4.6 | Content briefs, drafts, campaign copy and structured data we choose to send | Used under commercial API terms. Inputs and outputs are not used to train Anthropic’s models. |
| OpenAI, L.L.C. | GPT models, available as an alternative where a client supplies their own key | The same categories, only where a client selects OpenAI | Used under API terms, which exclude API data from model training by default. |
Full detail on how we use these models, what we refuse to send them, and what stays under human control is in the AI Usage Policy.
4. Advertising and marketing platforms
These are used to run campaigns for clients. Data reaches them on the client’s instructions and under the client’s own privacy notice. We do not run advertising tags on varnandigital.com other than Google AdSense.
| Platform | Used for | Data involved |
|---|---|---|
| Google Ads | Search, Performance Max, YouTube and Display campaigns | Conversion signals, and where the client instructs it, hashed customer lists |
| Meta (Facebook and Instagram) | Paid social campaigns | Pixel and Conversions API events, hashed audience lists |
| Business-to-business campaigns | Insight Tag events, matched audience lists | |
| Microsoft Advertising | Bing search campaigns | UET tag conversion events |
Customer lists are uploaded only where the client confirms in writing that they hold valid consent for that use, and only in hashed form where the platform supports it.
5. The standard we hold them to
Before a provider is added to this register:
- There must be a written contract or the provider’s standard data processing terms in place.
- The provider must offer a transfer mechanism such as Standard Contractual Clauses where personal data leaves the UK or EU, and must not sit in a jurisdiction restricted for transfers out of India.
- The provider must be given the minimum data needed for its job, and no permission to use it for its own purposes.
- We must be satisfied it does not sell personal data.
We review this register at least annually and whenever a tool is added or dropped. Removing a provider includes deleting or exporting the data it held.
6. Changes and objections
Clients under a signed agreement are notified before a new sub-processor that touches their data is introduced, and may object under the Data Processing Addendum. For website visitors, any new tracker is added to the consent gate and the Cookie Policy before it goes live.
Ask about a provider
Want the contract terms, transfer mechanism or retention period for anything on this page? Email [email protected] and we will send it.
More legal documents
Legal centre · Privacy Policy · Cookie Policy · Consent Policy · Website Forms Policy · Third-Party Policy · Data Processing Addendum · Terms of Service · Acceptable Use Policy · Disclaimer · Accessibility Statement · Client Service Terms · Refund and Cancellation · AI Usage Policy · Communications Policy