Privacy Policy
This policy explains what personal data Frame Theory collects, why we collect it, who we share it with, and the rights you have over it under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
1. Who we are
Frame Theory (“Frame Theory”, “we”, “us”) is a digital marketing agency based in Mumbai, Maharashtra, India. We operate https://frame-theory.in, our client portal, and Frame Theory OS. For the personal data described in this policy we decide why and how it is processed, which makes us the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
This policy applies to visitors to our website, people who contact us or subscribe to updates, job applicants, and users of our client portal. How we handle data on behalf of clients is covered in section 5.
2. What we collect
| When | What we collect |
|---|---|
| You fill in the contact form | Name, email, phone number (if given), service of interest, and your message. |
| You subscribe to updates (cookie banner, contact form, footer) | Email address, the page you subscribed from, and your IP address (recorded to prevent abuse and to evidence your consent). |
| You apply for a job | The details and documents you submit, such as your CV, contact details and work history. |
| You use the client portal | Login email, account details, activity such as logins (with IP address and time), and the content you or we place in the portal. |
| You pay us online | Billing name, email and invoice details. Card, UPI and bank details are entered on Razorpay’s secure pages and are not stored by us. |
| You browse the site | Your IP address, browser and device type, referring site, pages viewed, and campaign tags. Analytics cookies are set only if you accept them. See Cookies & Data for a live view. |
We do not knowingly collect sensitive categories such as health or financial account information through this website. Please do not send them to us.
3. Why we use it
We process personal data only for the purposes you were told about when you gave it, or for legitimate uses recognised by the DPDP Act, such as responding to something you asked us to do. In practice:
- to reply to enquiries, prepare proposals and deliver the services you hire us for;
- to send invoices, take payments and keep records required by tax and company law;
- to send occasional updates, only where you opted in. Every email has an unsubscribe link;
- to understand how the site is used and improve it (analytics, with your consent);
- to keep the website, portal and CRM secure, and to detect misuse;
- to assess job applications;
- to comply with the law or respond to lawful requests from authorities.
We do not sell personal data.
5. Client and campaign data
When we run advertising, SEO, social or analytics work, we may get access to our clients’ ad accounts, analytics properties and customer or lead data. For that data the client decides the purpose and we act as a Data Processor. We use it only to deliver the agreed work, apply reasonable safeguards, restrict access to staff who need it, and return or delete it when the engagement ends. Clients are responsible for having a lawful basis and any required consent for the data they ask us to handle. If you are a customer of one of our clients and want to exercise your rights, please contact that client first.
6. How long we keep it
- Enquiries that do not become projects: up to 24 months, then deleted.
- Newsletter emails: until you unsubscribe or ask us to remove you.
- Client and invoicing records: for as long as the tax, GST and company laws require, typically 8 years.
- Job applications: up to 12 months unless you ask us to remove them sooner.
- Security and login logs: up to 12 months.
Once the purpose is complete and no legal duty requires us to retain it, we delete or anonymise the data.
7. Security
We use HTTPS, access controls, hashed passwords, email-based one-time-password login for staff accounts, and activity logging. No system is completely secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.
8. Your rights
Under the DPDP Act you may:
- ask for a summary of the personal data we hold about you and how it is processed;
- ask us to correct inaccurate data, complete it, or update it;
- ask us to erase data we no longer need for the purpose you gave it, unless the law requires us to keep it;
- withdraw your consent at any time, as easily as you gave it (for example by unsubscribing or resetting the cookie choice on our Cookies & Data page). Withdrawal does not affect processing done before it;
- nominate another person to exercise these rights if you die or become incapacitated;
- get your grievance addressed. See section 12. If you are not satisfied, you may complain to the Data Protection Board of India.
To use any of these, email contact@frame-theory.in. We may need to verify your identity first and will respond within a reasonable time, and in any case within the period the law prescribes.
9. Children
Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data of children. If you believe a child has given us their data, please tell us and we will delete it.
10. Data outside India
Some providers we use, such as Google, may process data on servers outside India. We transfer data only to countries and providers permitted under the DPDP Act and rules made under it.
11. Changes to this policy
We may update this policy as our services or the law change. The date at the top shows when it was last revised. For material changes that affect how we use data you have already given us, we will tell you or ask for fresh consent where the law requires.
12. Contact & grievance redressal
For questions about this policy, to exercise your rights, or to raise a grievance, contact:
Frame Theory — Grievance Officer
Mumbai, Maharashtra, India
Email: contact@frame-theory.in
Phone: +91 90905 03838
We aim to acknowledge grievances within 48 hours and resolve them within 15 days.