Last updated: 19 October 2026. Effective date: 19 October 2026. This Privacy Policy explains how Dzone Ads collects, uses, shares and protects personal data when you visit https://dzoneads.com, send us an enquiry, place an order or work with us on a design, website, video, printing or social media project. Please read it together with our Terms & Conditions and Cookie Policy.
Key takeaways
- We collect only what we need to answer enquiries, deliver projects, process orders and keep the website secure.
- We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
- No analytics or advertising pixels run on the website by default. If we add them later, they will only run after you give consent.
- Card payments are handled by third-party payment gateways. Our website does not store full card numbers.
- You can ask to access, correct or delete your data, withdraw consent or raise a grievance by writing to [email protected].
1. Who we are and what this policy covers
Dzone Ads (also known as “Dzone Ads Advertising”) is a creative design and advertising agency based in Pulikkal, Malappuram, Kerala, India. In this policy, “Dzone Ads”, “we”, “us” and “our” mean that business. “You” means any visitor to our website, any person who contacts us, and any client or client representative we work with.
For personal data we collect for our own purposes (for example, your quote request or order), under the Digital Personal Data Protection Act, 2023 (DPDP Act) we act as a Data Fiduciary, and under the EU and UK General Data Protection Regulation (GDPR) we act as a controller.
When a client sends us material that contains other people’s personal data for a project (for example, staff photos for a brochure or guest names for a wedding invitation), we handle that material on the client’s behalf and on the client’s instructions. In that situation we act as a processor and the client remains responsible for having the right to share it. Section 6 explains this in more detail.
This policy covers dzoneads.com, our online shop, our forms and our communications with you by email, phone and WhatsApp. It does not cover third-party websites or platforms.
2. The laws we follow
We are an Indian business, so Indian law applies first. We aim to handle personal data in line with:
- the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
- the Digital Personal Data Protection Act, 2023 and the rules made under it, as and when their provisions come into force;
- the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020, for online orders.
We also serve clients outside India, including in the Gulf. Where the GDPR (EU, EEA and UK) or the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) applies, we will respect the rights those laws give you (see Section 11).
3. Personal data we collect
We collect personal data in three ways: information you give us, information created when you use the website, and limited information we receive from service providers.
3.1 Contact and quote forms
Our contact and quote request forms are built with the Contact Form 7 plugin. When you submit a form we collect:
- your name;
- email address;
- phone or WhatsApp number;
- the service you are interested in;
- your approximate budget; and
- your message and any project details you choose to include.
Please do not include sensitive information such as passwords, bank details, health information or identity document numbers in a form message. We do not ask for sensitive personal data, and payment details are handled by payment gateways, not by us.
3.2 Orders and payments
When you buy a design package or service through our WooCommerce shop, we collect your billing name, email address, phone number, billing address, delivery address (for printed items), GSTIN if you provide one for a business invoice, order details, order notes and payment status.
Payments are processed by third-party payment gateways shown at checkout. The gateway collects and processes your card, UPI, net banking or wallet details directly. Our website does not store full card numbers. We receive only confirmation of the payment and limited reference details, such as a transaction ID, payment method type, amount and, in some cases, the last few digits of a card.
3.3 Customer accounts
If you create an account on our website, we store your username, email address, an encrypted (hashed) password, saved addresses and your order history. You can update most of these details from your account page.
3.4 Communications
When you email, call or message us on WhatsApp or social media, we keep a record of the conversation, including your name, number or handle, your messages and any files you send, so we can follow your project accurately. WhatsApp and social media platforms are operated by third parties, and their own privacy policies apply to your use of those services.
3.5 Project materials
To deliver creative work, clients send us briefs, logos, photographs, text, product details, brand guidelines, social media access and similar materials. This can include personal data of the client and of other people (for example, team photos, event guest names or customer reviews). We use these materials only for the client’s project.
3.6 Technical and log data
Our server and security tools automatically record technical information when you visit, such as:
- your IP address;
- browser type and version, device type and operating system;
- pages requested, date and time of the request and the referring page;
- failed login attempts and requests that look suspicious.
Our Wordfence security plugin acts as a firewall and logs IP addresses and request details to detect and block attacks and brute-force logins. WP Hide & Security Enhancer reduces the information the site reveals to attackers. These tools are used for security, not marketing.
3.7 Cookies and similar technologies
We use a small number of cookies and browser storage items that are needed for the website to work — for example, to remember your cookie choice, keep items in your shopping cart and keep you logged in. Our consent banner is provided by CookieYes and stores your choice in a cookie such as “cookieyes-consent”. Our SEO plugin, Yoast SEO, does not set tracking cookies.
No analytics or advertising pixels are installed by default. If we later add analytics (for example, Google Analytics) or advertising pixels (for example, Meta Pixel), they will only run after you give consent through the cookie banner, and we will update this policy and our Cookie Policy first. Full details are in our Cookie Policy.
3.8 Information from other sources
We may receive limited information from service providers, such as payment confirmation from a gateway or delivery status from a courier. Advertising platforms may show us aggregated campaign reports for client campaigns; these normally do not identify individuals.
4. How and why we use your data
The table below explains what we do with personal data and the legal reason we rely on. Under the DPDP Act, we rely on your consent or on “legitimate uses” permitted by the Act (such as where you voluntarily provide data for a specified purpose, or where processing is needed to comply with law). Under the GDPR, we rely on the lawful bases listed.
| Purpose | Data used | Lawful basis (GDPR) / basis under Indian law |
|---|---|---|
| Replying to enquiries and preparing quotes | Form data, communications | Steps at your request before a contract (Art. 6(1)(b)); data voluntarily provided for this purpose / consent |
| Delivering design, web, video, printing and social media services | Contact details, project materials, communications | Performance of a contract (Art. 6(1)(b)); data voluntarily provided for this purpose |
| Processing online orders and payments | Order and billing data, payment references | Performance of a contract (Art. 6(1)(b)) |
| Delivering printed items within India | Name, delivery address, phone | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, GST, accounting and tax records | Billing details, GSTIN, order history | Legal obligation (Art. 6(1)(c)); compliance with Indian law |
| Managing customer accounts | Account data | Performance of a contract (Art. 6(1)(b)); consent |
| Website security, fraud prevention and troubleshooting | Technical and log data, security cookies | Legitimate interests in keeping the site and users safe (Art. 6(1)(f)); reasonable security practices required by Indian law |
| Remembering your cookie choices and cart | Strictly necessary cookies | Legitimate interests / necessary to provide the service you request |
| Analytics or marketing cookies (only if added in future) | Cookie and device data | Consent (Art. 6(1)(a)); consent under the DPDP Act |
| Sending service updates and replies | Email, phone, WhatsApp | Performance of a contract (Art. 6(1)(b)) |
| Sending marketing messages or offers | Email, phone, WhatsApp | Consent (Art. 6(1)(a)), or legitimate interests for existing clients where permitted by law; you can opt out at any time |
| Handling complaints, disputes and legal claims | Relevant records and communications | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)) |
We do not make decisions about you based solely on automated processing, and we do not profile visitors.
5. Consent and how to withdraw it
Where we rely on consent, we will ask for it clearly for a specific purpose. You can withdraw it at any time — for example, by changing your choice in the cookie banner using the “Cookie Settings” link in the website footer, by clicking “unsubscribe” in a marketing email, or by writing to [email protected]. Withdrawing consent is as easy as giving it.
Withdrawal does not affect anything we did lawfully before you withdrew. If you withdraw consent for data we need to deliver an ongoing project, we may not be able to continue that project, and we will tell you if that is the case.
6. Client project materials
When a client shares content for a project, the client decides what is shared and why. We:
- use the materials only to carry out the client’s project and related support;
- limit access to the people working on the project;
- do not use personal data in client materials for our own marketing;
- return or delete materials at the end of the project or on request, subject to Section 9 (retention).
Clients are responsible for making sure they have the right — including any consent required by law — to share photos, names, contact details and other personal data of third parties with us, and to have that content published. If someone asks us to remove their information from a client project, we will pass the request to the client and help where we reasonably can.
Where a project needs access to a client’s own accounts (for example, a hosting panel or Meta Business account), we use it only for the agreed work and prefer role-based access over shared passwords.
7. Who we share data with
We do not sell your personal data. We do not rent it, trade it or share it with anyone for their own marketing. We share personal data only where needed, with:
- Website hosting provider — our website and its database are stored on servers run by our hosting company, which processes data on our behalf.
- Payment gateways — to process payments you make at checkout. Each gateway handles payment data under its own security standards and privacy policy.
- Email and communication providers — services we use to send and receive email and messages, and to store files we exchange with you (such as cloud storage or file transfer links).
- Courier and logistics partners — for printed items, we share your name, delivery address and phone number so the parcel can be delivered.
- Printing partners — where a print job is produced by a partner press, we share the print-ready files and any delivery details required for that job.
- Security service providers — Wordfence may process limited technical data, such as IP addresses linked to suspicious requests, with its provider to deliver threat protection.
- Professional advisers — such as accountants, auditors, tax consultants and lawyers, under a duty of confidentiality.
- Authorities and legal requirements — where we are required to do so by law, court order or a lawful request from a government agency, or where needed to protect our rights, our clients or the public.
- Business changes — if our business is sold or merged, personal data may pass to the new owner, who must protect it in line with this policy.
Our service providers must keep personal data secure and use it only to serve us.
8. International transfers
We are based in India. Some of our service providers (such as hosting, email, cloud storage and security services) may store or process data in other countries. If you are outside India, your data will be transferred to India when you contact us.
Under the DPDP Act, the Government of India may restrict transfers to certain countries; we will follow any such restriction. Where the GDPR applies and personal data leaves the EU, EEA or UK for a country without an adequacy decision, we rely on appropriate safeguards made available by our service providers, such as standard contractual clauses, or on other grounds permitted by law (for example, where the transfer is necessary to perform a contract with you). You can contact us for more information about the safeguards for a particular transfer.
9. How long we keep data
We keep personal data only for as long as we need it for the purposes in this policy, or as long as the law requires. When we no longer need it, we delete it or make it anonymous. Typical retention periods are:
| Type of data | Typical retention period |
|---|---|
| Enquiries and quote requests that do not lead to a project | Up to 24 months from the last contact |
| Client communications and project records | For the duration of the project and up to 3 years after completion, to handle support, re-orders and disputes |
| Project materials supplied by clients | For the duration of the project and up to 2 years after completion, unless the client asks us to delete them sooner or agrees a different period |
| Final delivered files (for re-supply on request) | Up to 3 years after delivery, unless otherwise agreed |
| Orders, invoices and payment records | As required by Indian tax, GST and accounting laws — generally up to 8 years |
| Customer accounts | While the account is active; deleted on request, except order records we must keep by law |
| Security and server logs | Typically up to 180 days, or longer if needed to investigate an incident or as required by law |
| Marketing preferences | Until you unsubscribe; we keep a minimal record of the opt-out so we do not contact you again |
| Cookies | As listed in our Cookie Policy |
We may keep data longer if it is needed for a legal claim or complaint, but only as long as necessary.
10. How we protect your data
We use reasonable security practices and procedures, appropriate to the size of our business and the type of data we hold. These include:
- HTTPS encryption for data sent between your browser and our website;
- a web application firewall, login protection and malware scanning through Wordfence;
- hardening measures through WP Hide & Security Enhancer;
- keeping WordPress, themes and plugins updated;
- strong passwords and, where available, two-factor authentication for administrator accounts;
- limiting access to personal data to people who need it for their work;
- using payment gateways so that card data does not pass through or stay on our server;
- regular backups of the website.
No website, email system or internet transmission is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that affects you, we will act quickly to contain it and will notify you and the relevant authorities where the law requires us to do so.
11. Your rights
Depending on where you live and which laws apply, you have some or all of the rights below. We extend the core rights — access, correction, deletion and withdrawal of consent — to everyone, wherever they live.
11.1 Rights under Indian law (DPDP Act, 2023)
As a Data Principal, you have the right to:
- access information — a summary of the personal data we process about you, the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared, along with a description of the data shared;
- correction, completion and updating of inaccurate or incomplete data;
- erasure of personal data that is no longer needed for the purpose it was collected, unless we must keep it to comply with law;
- withdraw consent at any time, where processing is based on consent;
- grievance redressal — to raise a complaint with our Grievance Officer (Section 16) and receive a response;
- nominate another person to exercise your rights in the event of your death or incapacity.
If you are not satisfied with our response to a grievance, you may approach the Data Protection Board of India once it is in operation, after first using our grievance process. The DPDP Act also places duties on Data Principals — for example, not to file false or frivolous complaints and not to impersonate another person when making a request.
11.2 Rights under the GDPR (EU, EEA and UK)
If the GDPR applies, you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate data;
- erase your data in certain circumstances (“right to be forgotten”);
- restrict processing in certain circumstances;
- data portability — receive data you gave us in a structured, commonly used format, where processing is based on consent or contract and carried out by automated means;
- object to processing based on legitimate interests, and to object at any time to direct marketing;
- withdraw consent at any time where we rely on consent;
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we do not make such decisions);
- lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner’s Office). We would appreciate the chance to resolve your concern first.
11.3 Rights for California residents (CCPA/CPRA)
Dzone Ads is a small business based in India, and the CCPA may not apply to us. Even so, if you are a California resident, we will honour the following requests:
- Right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we disclose it to. The categories we collect are described in Section 3: identifiers (name, email, phone, IP address), commercial information (orders), internet activity (log data), and information you include in messages and project materials.
- Right to delete personal information, subject to legal exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing — we do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the past 12 months.
- Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes that would require offering this right.
- Right to non-discrimination — we will not deny services, charge different prices or provide a different quality of service because you exercised your rights.
You may use an authorised agent to make a request on your behalf; we may ask for proof of the agent’s authority and to verify your identity directly.
11.4 How to exercise your rights
Send your request to [email protected] with the subject line “Privacy request”, or contact us using the details in Section 17. Please tell us:
- your name and the email address or phone number you used with us;
- which right you want to exercise; and
- any details that help us find your data (for example, an order number).
To protect your data, we may need to verify your identity before acting on a request. We will only ask for information needed for verification and will use it only for that purpose.
We aim to acknowledge requests within 48 hours and to respond in full within 30 days. If a request is complex, we may need more time where the law allows, and we will tell you why. Requests are free of charge, although we may refuse or charge a reasonable fee for requests that are clearly unfounded or excessive, where the law permits. If we cannot fully meet your request — for example, because we must keep invoices under tax law — we will explain why.
12. Children’s privacy
Our website and services are intended for businesses, organisations and adults, not children. Under Indian law a “child” is anyone under 18. We do not knowingly collect personal data from children, and we do not track or target advertising at them.
If we learn that we have collected personal data from a child without verifiable consent from a parent or lawful guardian, we will delete it. Where a client project involves photos or names of children (for example, a school brochure or a family wedding invitation), the client is responsible for obtaining the consent of the parent or guardian before sharing that material with us.
13. Third-party links and embedded content
Our website may link to other websites and platforms, such as our social media pages, client websites shown in our portfolio, or payment gateway pages. We are not responsible for the privacy practices of those sites. Please read their privacy policies before sharing information with them.
Some pages may include embedded content such as videos (for example, from YouTube), maps or social media posts. Embedded content behaves as if you visited the other website directly. Those providers may collect data about you, use cookies and track your interaction with the embedded content, particularly if you are logged in to their service. Where possible, we will configure embedded content so that it loads only after you consent, or use privacy-enhanced modes offered by the provider.
If comments are enabled on our blog and you leave a comment, WordPress stores your name, email address, website (if given), comment text, IP address and browser user-agent to help with spam detection. If you use a Gravatar profile picture, an anonymised string created from your email address (a hash) may be sent to the Gravatar service to check whether you use it.
14. Marketing communications
We send marketing messages — such as news about our services, seasonal offers or design tips — only where you have agreed, or where you are an existing client and the law allows us to contact you about similar services. Every marketing email will include a way to unsubscribe. For WhatsApp or SMS messages, you can reply “STOP” or simply tell us you do not want further messages.
You can also opt out at any time by writing to [email protected]. Opting out of marketing does not stop service messages that are necessary for a project or order you have with us, such as proofs, invoices and delivery updates.
15. Changes to this policy
We may update this Privacy Policy when we add a new tool to the website, change service providers or when the law changes, and we will change the “Last updated” date above. For significant changes we will take reasonable steps to let you know, such as a notice on the website. Where a change requires your consent, we will ask for it first.
16. Grievance Officer
In line with the Information Technology Act, 2000 and the rules made under it, the Digital Personal Data Protection Act, 2023 and the Consumer Protection (E-Commerce) Rules, 2020, you may contact our Grievance Officer with any complaint or concern about how your personal data is handled:
- Grievance Officer: Dzone Ads, Pulikkal, Malappuram, Kerala, India
- Email: [email protected]
- Phone / WhatsApp: +91 97478 37026
We will acknowledge your grievance within 48 hours and aim to resolve it within one month of receiving it, or sooner where the law requires.
17. Contact us
If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch:
- Business: Dzone Ads
- Address: Pulikkal, Malappuram, Kerala, India
- Email: [email protected]
- Phone / WhatsApp: +91 97478 37026
- Website: https://dzoneads.com — or use our contact page