This notice explains what personal data BrandWorks collects through https://brandworks.me and when you contact us, why we collect it, how long we keep it and the rights you have. It is written to meet India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules"). If anything here is unclear, email socials@brandworks.me.
You can ask for this notice in English or in any of the 22 languages listed in the Eighth Schedule to the Constitution of India, such as Hindi, by emailing the same address.
Who we are
TODO: registered legal name ("BrandWorks", "we", "us") is a creative and marketing studio based in India. We offer photography and videography, PR and founder reputation management, performance and SEO marketing, graphic design and animation, social media and content, advertising and website development.
Under the DPDP Act, we are the Data Fiduciary for the personal data in this notice. We decide why and how it is used, and we are responsible for protecting it. You are the Data Principal: the person the data is about.
- Registered address: TODO: registered business address
- Email: socials@brandworks.me
- Phone: TODO: +91 00000 00000
What this notice covers
This notice covers personal data we collect through this website and when you get in touch about our services.
It does not cover personal data we handle for clients during a project, such as a client's customers, followers, campaign entrants or people who appear in a shoot. For that work we act on the client's instructions as a Data Processor, under our contract with the client, and the client's own privacy notice applies.
What we collect and why
We collect only what we need for each purpose below, and we don't use it for anything else.
| What we collect | When we collect it | Why we use it | How long we keep it |
|---|---|---|---|
| Name, email, phone number, company, budget range and your message | When you fill in an enquiry or contact form | To reply, understand your brief and send you a proposal | 24 months after our last contact, unless you become a client |
| Anything you share by email, WhatsApp or phone | When you contact us directly | To reply and keep a record of our conversation | 24 months after our last contact, unless you become a client |
| Your CV, portfolio, work samples and contact details | When you apply for a job, internship or freelance role | To assess your application and contact you about it | 12 months after the role is filled, or longer if you agree to us keeping it on file |
| Pages you visit, how you found us, rough location (city level), device and browser type | When you browse the site, only if you allow analytics cookies | To see which pages are useful and improve the site | Up to 14 months |
| IP address, browser type and the time of each request (server and security logs) | Every time you load a page | To keep the site secure, detect misuse and fix errors | 1 year, the minimum the DPDP Rules require for logs |
If you become a client, we keep project, contract and billing records for as long as our agreement and Indian tax, GST and company law require, usually 8 years.
We don't ask for sensitive information such as bank or card details, passwords, Aadhaar or other government ID numbers, health information or biometric data through this website. Please don't send it to us.
Our basis for using your data
The DPDP Act lets us use personal data only with your consent or for certain "legitimate uses". We rely on:
- Information you choose to send us, such as an enquiry or a job application. This is a legitimate use under Section 7(a) of the DPDP Act: you gave it to us for a clear purpose and haven't told us not to use it. We use it only for that purpose. If you'd rather we didn't keep it, tell us and we'll delete it.
- Your consent for analytics and marketing cookies, given through the cookie banner. They stay off until you switch them on.
- Legal obligations, such as keeping security logs and tax records, and responding to lawful requests from courts and government authorities.
When we ask for your consent, it is free, specific, informed and unambiguous. We won't bundle it with anything else, use pre-ticked boxes or make our services depend on consent we don't need. We will never use your data for a new purpose without telling you first and, where the law requires it, asking again.
Withdrawing your consent
Where we rely on your consent, you can withdraw it at any time, and it's as easy as giving it:
- Cookies: open (there's also a link at the bottom of every page) and switch them off.
- Anything else: email socials@brandworks.me.
Withdrawing consent doesn't affect anything we lawfully did before you withdrew it. Once you withdraw, we stop using the data for that purpose, ask our service providers to stop too, and erase it unless the law requires us to keep it.
You can also give, manage or withdraw consent through a Consent Manager registered with the Data Protection Board of India, once these services are available.
Who we share it with
We don't sell your personal data or share it with anyone for their own marketing.
We share it only with service providers (Data Processors) who help us run the website and our business. Each works under a written contract, may use the data only on our instructions and must keep it secure.
| Provider | What they do for us | Where data is stored |
|---|---|---|
| TODO: hosting provider (e.g. Vercel, Netlify, Hostinger) | Hosts the website and keeps server logs | TODO: e.g. USA / global |
| TODO: email provider (e.g. Google Workspace, Zoho Mail) | Receives and stores our email, including enquiries | TODO: e.g. India / global |
| TODO: form service (e.g. Web3Forms, Formspree, EmailJS) | Delivers contact form submissions to our inbox | TODO: e.g. USA |
| WhatsApp (Meta Platforms, Inc.) | Messages you send us on WhatsApp | Global |
| Google Analytics (Google LLC) | Website analytics, only if you allow analytics cookies | USA / global |
We may also share personal data:
- when the law requires it, such as a valid order or request from a court, the Data Protection Board of India, CERT-In or another government authority
- to establish, defend or enforce our legal rights
- with a buyer or successor if our business is merged, sold or restructured, who must protect it as this notice describes
Data stored outside India
Some of our service providers store data on servers outside India, for example in the United States or the European Union. Section 16 of the DPDP Act allows this, except to countries the Central Government restricts by notification. We check our providers against any such notification and will stop sending data to a restricted country.
How we protect your data
We follow the reasonable security safeguards set out in Rule 6 of the DPDP Rules, including:
- encryption: HTTPS across the whole site, and encrypted storage with our providers
- access control: two-factor authentication on our accounts, and access only for team members who need the data for their work
- logging and monitoring: we keep access and security logs for at least one year so we can detect and investigate misuse
- backups: so data can be restored if it is lost or corrupted
- contracts: every service provider must keep data secure on our behalf
If there's a data breach
No system is completely secure. If a breach affects your personal data, we will:
- tell you without delay, in plain language, what happened, what it may mean for you, what we're doing about it and what you can do to protect yourself
- report it to the Data Protection Board of India without delay, and send the Board a full report within 72 hours
- report cyber security incidents to CERT-In within 6 hours, as its directions require
Your rights
Under the DPDP Act and DPDP Rules, you can:
- Access: ask for a summary of the personal data we hold about you, what we do with it, and who we've shared it with
- Correction: ask us to correct, complete or update it
- Erasure: ask us to erase it, unless the law requires us to keep it
- Withdraw consent: at any time, as described above
- Nominate: name someone to use these rights for you if you die or become unable to use them yourself
- Grievance redressal: raise a complaint with us and get a response
To use any of these rights, email socials@brandworks.me with "Privacy request" in the subject line, and tell us which right you want to use. We may ask you to confirm your identity first, using only the details we already hold or the minimum needed. We aim to respond within 30 days, and always within the 90 days the DPDP Rules allow.
The DPDP Act also asks Data Principals not to give false information or file false or frivolous complaints.
Grievance Officer
If you have a question or complaint about how we handle your personal data, contact the person responsible for answering it:
- Name: TODO: full name
- Email: socials@brandworks.me
- Address: TODO: registered business address
We'll acknowledge your complaint within 48 hours and resolve it as quickly as we can, and within 90 days at most. If you're not satisfied with our response, you can then complain to the Data Protection Board of India through its online platform.
Children
Our website and services are meant for businesses and adults. Under the DPDP Act, anyone under 18 is a child, and we don't knowingly collect their personal data. If we ever need it, for example for a shoot, we will first get verifiable consent from a parent or lawful guardian, as Rule 10 of the DPDP Rules requires. We never track children or show them targeted advertising.
If you think a child has sent us personal data, email us and we'll delete it.
Cookies
We use necessary cookies to run the site and, only if you allow them, cookies for analytics and marketing. Our Cookie policy lists every cookie and explains how to change your choice.
Other websites and embedded content
Our portfolio links to client websites and social media profiles, and some pages show videos or posts embedded from platforms such as YouTube, Vimeo or Instagram. Those sites and platforms collect data under their own privacy policies, which we don't control.
If you're in the UK or EU
If you're in the United Kingdom or the European Economic Area, the UK GDPR or EU GDPR also applies when we handle your personal data.
- Our lawful bases are legitimate interests (replying to enquiries and keeping the site secure), steps you ask us to take before a contract (preparing a proposal), and consent (analytics and marketing cookies).
- Your extra rights include restricting or objecting to how we use your data, and receiving your data in a portable format.
- International transfers from the UK or EEA to India and other countries are protected by safeguards such as standard contractual clauses.
- You can complain to your local data protection authority. In the UK, that's the Information Commissioner's Office (ICO).
Laws we follow
This notice is written to meet:
- the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025
- the Information Technology Act, 2000 and the rules made under it
- the CERT-In Directions of 28 April 2022 on reporting cyber security incidents and keeping logs
The DPDP Rules come into force in stages. We already follow the obligations above, even those not yet in force.
Changes to this notice
We'll update this notice when our practices or the law change, and change the "Last updated" date at the top. If a change significantly affects how we use your personal data, we'll put a notice on the site and, where we have your email address, tell you directly. Where a change needs fresh consent, we'll ask for it.
Contact us
TODO: registered legal name
TODO: registered business address
Email socials@brandworks.me for anything about this notice or your personal data.