Privacy Policy

Overview

Novatex Consulting ("Novatex", "we", "us", or "our") is a full-service digital marketing and technology agency registered in India, with offices in Kolkata and Bangalore (India) and Dubai (UAE). This Privacy Policy explains how we collect, use, store, and protect personal information when you visit our website (novatexconsulting.com), submit a contact form, apply for a job, or engage with our services.

By using our website or services, you agree to the practices described in this policy. If you do not agree, please do not use our website or submit personal information to us.

What Data We Collect

We collect personal information in the following ways:

Information you provide directly:

• Contact form submissions — name, email address, phone number, company name, service enquiry, and message content
• Job applications — name, email, phone, CV/resume, work history, and cover letter
• Newsletter sign-ups — email address
• Client onboarding — billing information, company details, and project-specific data

Information collected automatically:

• IP address and approximate geographic location (country/city level)
• Browser type, operating system, and device type
• Pages visited, time on page, and navigation path
• Referral source (how you arrived at our website)
• UTM parameters from marketing campaigns

Information from third parties:

• Google Analytics 4 — aggregated website usage data
• Google Ads — conversion tracking data when you click our advertisements
• LinkedIn, Facebook, Instagram — if you interact with our social media content

How We Use Your Data

We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

Storage & Retention

Your personal data is stored on secure servers located in India (AWS ap-south-1, Mumbai region). Data relating to UAE clients may additionally be stored on servers in the UAE or EU, depending on the applicable data residency requirements.

Retention periods:

• Contact form enquiries: 3 years from date of submission
• Client project data: 7 years from project completion (for tax and legal compliance)
• Job applications (unsuccessful): 6 months, then permanently deleted
• Job applications (hired): Duration of employment + 5 years
• Newsletter subscribers: Until you unsubscribe
• Website analytics: 14 months (Google Analytics retention setting)
• Website 404 logs: 30 days

After the applicable retention period, data is securely deleted or anonymised. You may request early deletion at any time (see Your Rights section).

Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

• Service providers: We use third-party tools (Google Analytics, SendGrid for email, AWS for hosting) that process data on our behalf under data processing agreements
• Legal requirements: If required by law, court order, or regulatory authority in India or the UAE
• Business transfer: If Novatex is acquired or merged, personal data may transfer to the new entity, with notice provided to you
• With your consent: For any other sharing, we will ask for your explicit consent first

All third-party service providers are contractually required to process your data only as instructed by us and to implement appropriate security measures.

Cookies & Tracking

Our website uses cookies and similar tracking technologies. Here is what we use and why:

You can manage cookie preferences at any time by clearing your browser cookies or using our cookie preference centre (accessible via the cookie icon in the footer). Most browsers also allow you to block or delete cookies in browser settings.

Your Rights

Depending on your location, you may have the following rights over your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to correction — request that inaccurate data is corrected
• Right to erasure — request deletion of your personal data (subject to legal retention obligations)
• Right to data portability — receive your data in a machine-readable format
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — request that we limit how we use your data

To exercise any of these rights, contact our Data Protection Officer at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

India — Digital Personal Data Protection Act (DPDP) 2023

For individuals located in India, we comply with the Digital Personal Data Protection Act, 2023 (DPDP Act). This means:

• We collect and process personal data only with your free, specific, informed, and unconditional consent (except where processing is necessary for legitimate uses permitted by the Act)
• We provide a clear notice of the purpose and nature of data collection before or at the time of collection
• You have the right to nominate another individual to exercise your rights in the event of your death or incapacity
• You have the right to withdraw consent at any time — withdrawal does not affect the lawfulness of prior processing
• We will notify you of any personal data breach that is likely to affect you, as required by the Act
• Our Data Fiduciary registration details will be made available upon request once the Data Protection Board of India is constituted

For DPDP-related complaints or requests, contact: [email protected]

UAE — Data Protection

For individuals located in the UAE, we comply with applicable UAE data protection legislation, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) where applicable. This means:

• Personal data of UAE residents is collected and processed only for the stated purposes and with appropriate legal basis
• Cross-border transfers of UAE resident data to India are made under appropriate safeguards
• UAE residents have the right to access, correct, and request deletion of their personal data
• We do not transfer UAE resident data to countries without adequate data protection standards without your explicit consent or appropriate contractual protections

For UAE data protection queries: [email protected]

Security

We implement industry-standard technical and organisational security measures to protect your personal data, including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest on our servers
• Role-based access controls — only authorised staff can access personal data
• Regular security audits and penetration testing
• Staff training on data protection and information security
• Incident response procedures for data breaches

Despite these measures, no internet transmission is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant regulatory authorities within the legally required timeframes.

Children's Privacy

Our website and services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected personal data from a minor, we will delete it promptly. If you believe we may have collected data from a minor, please contact us at [email protected].

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will:

• Update the "Last updated" date at the top of this policy
• Display a prominent notice on our website homepage
• For material changes affecting existing clients, send a notification by email

Your continued use of our website or services after the effective date of the updated policy constitutes acceptance of the changes.

Contact Our Data Protection Officer

For all privacy-related enquiries, rights requests, or complaints: