Varnan

Consent Policy

Last updated 6 September 2026 · Varnan Digital (OPC) Private Limited · CIN U62090KL2025OPC096808

Consent is the permission that makes a lot of what we do lawful: dropping a cookie, sending an email, recording a call, running a client’s customer list through an ad platform. This policy sets out how Varnan asks for consent, how we record it, and how you take it back.

Our standing rule. Silence is not consent. A pre-ticked box is not consent. Carrying on scrolling is not consent. If we cannot point to a specific moment where you actively agreed, we treat the answer as no.

1. What counts as valid consent

We follow the stricter of the standards that apply to us, which means consent must be:

Free — refusing must be as easy as agreeing, and must not cost you access to something unrelated.
Specific — given for a named purpose, not bundled into a single blanket permission.
Informed — you know who is processing the data, what for, and who else sees it, before you decide.
Unambiguous — an affirmative act. A click, a tick you added yourself, a signature, a spoken yes.
Withdrawable — through a route as simple as the one you used to give it.

These follow section 6 of India’s Digital Personal Data Protection Act, 2023 and Article 7 of the UK and EU GDPR. Where a request is written in legalese you cannot reasonably be expected to read, we do not treat the resulting click as consent.

2. Where we ask for consent

Moment	How we ask	What happens if you say no
Cookies and site tracking	The consent banner on your first visit, with Accept all and Reject all given equal prominence, and a per-category preferences panel.	Analytics, advertising and third-party embeds never execute. The site works normally.
Contact and enquiry forms	An explicit statement above the submit button explaining what we do with the submission, linked to the Website Forms Policy.	Do not submit the form. Email or call us instead; we will still reply.
Marketing emails	A separate, unticked opt-in. Never bundled with an enquiry or a proposal.	You still get the replies and documents you asked for. You get no campaigns.
Call recording and transcription	Announced verbally at the start of the call before recording begins, and noted in the calendar invitation.	We turn the recorder off and take manual notes.
Case studies and logo use	Written approval from a named person at the client, covering the specific text, metrics and logo placement.	The work stays confidential and unpublished. This is the default until you approve otherwise.
Client data uploaded to ad platforms	Written confirmation from the client that they hold valid consent from the people in the list, recorded in the engagement documents.	We do not upload the list. We build audiences from platform-native signals instead.

3. How we record it

For every consent we rely on, we keep enough of a record to show what was agreed:

Cookie consent — stored in your browser in the varnan_consent cookie with your category choices and the timestamp of the decision. It expires after 180 days, at which point we ask again rather than assuming the old answer still holds.
Form consent — the submission record captures the timestamp, the page the form was submitted from, and the wording shown at the time.
Email opt-in — the date, source and the exact wording of the opt-in are held against the subscriber record.
Client consents — written approvals are kept with the engagement file for the duration of the contract plus three years.

4. Withdrawing consent

Withdrawal takes effect as soon as we process it, and never costs you anything.

Cookies — the Cookie preferences link in the footer of every page. Changes apply immediately.
Marketing email — the unsubscribe link in any message, or a reply saying stop. We action it within 72 hours.
Outreach on any channel — reply “stop”, “unsubscribe” or “remove me” on that channel and we suppress you across all of them.
Everything else — email [email protected].

Withdrawing consent does not make past processing unlawful, and it does not erase data we are separately required to keep, such as invoices and tax records. Where withdrawal means we can no longer deliver part of a service, we will say so plainly rather than quietly degrading it.

5. When we do not rely on consent

Consent is not the only lawful basis, and pretending otherwise would give you a false choice. We rely on other grounds where they genuinely apply:

Contract — processing needed to deliver work you have engaged us for.
Legal obligation — keeping accounting, tax and company records.
Legitimate interests — securing our systems, preventing fraud, and business-to-business outreach conducted within the limits of our Communications Policy. You can object to any of these at any time.

Where we rely on legitimate interests, we have weighed our interest against your rights and will share that assessment on request.

6. Consent in client engagements

When we run campaigns, automations or CRM work for a client, the client is responsible for having obtained valid consent from the people whose data enters those systems. We act on the client’s instructions as a processor under the Data Processing Addendum.

That said, we will not knowingly help a client process personal data without a lawful basis. If we are asked to email a purchased list, upload contacts who never opted in, or run tracking that the client’s own privacy notice does not disclose, we will raise it, propose a compliant alternative, and decline the instruction if it is not resolved.

7. Children

Our services are aimed at businesses. We do not knowingly seek or process the personal data of anyone under 18, and we do not run behavioural advertising directed at children. If a client’s campaign would target minors, it requires verifiable parental consent under the DPDP Act, and we will not run it without evidence that this has been obtained.

8. Changes

If we change what we ask consent for, we ask again rather than relying on the old permission. Material changes appear on this page with a new date.

Consent questions and withdrawals

Amal Jandheer, Director and Grievance Officer
[email protected]