Privacy Policy

1. Who We Are (Data Controller)

This Privacy Policy is issued by:

Savvyards is not a registered company in any country. It is operated by an individual (sole proprietor) in India. No local offices, subsidiaries, or registered addresses exist in any country this website serves.

EU/UK Representative: Savvyards does not currently have a designated Article 27 (EU GDPR) or UK GDPR representative. All data subject requests and regulatory enquiries should be directed to the email address above. [CONFIRM: Consider appointing an EU/UK representative — services such as GDPR-Rep.eu or similar cost approximately €100–300/year and reduce regulatory risk for EU/UK-targeting websites]

India (DPDP Act): As an India-based provider, Savvyards is subject to India's Digital Personal Data Protection Act 2023 (DPDP Act). The implementing rules are pending as of the date of this policy. [CONFIRM: Verify current compliance obligations under DPDP Act rules before finalising]

2. Personal Data We Collect

We collect the following categories of personal data:

• Contact and enquiry data — name, email address, company name, website URL, and message content submitted via our contact or audit forms
• Usage and analytics data — pages visited, session duration, referral source, browser type, device type, and IP address (collected via analytics tools only after you grant analytics consent)
• Advertising interaction data — ad clicks, form completions, and conversion events (collected via advertising pixels only after you grant marketing consent)
• Cookie and preference data — your cookie consent choices, stored locally in your browser's localStorage

We do not collect sensitive personal data such as health information, financial account details, government-issued ID numbers, or biometric data.

3. How We Use Your Information

• To respond to your contact or audit form enquiries
• To provide, manage, and improve the digital marketing services you engage us for
• To send service-related communications (invoices, updates, strategy call confirmations)
• To send marketing communications where you have given consent or where we have a legitimate interest to do so
• To analyse website performance and improve our content (analytics consent required)
• To measure advertising effectiveness and enable retargeting (marketing consent required)
• To comply with applicable legal obligations

4. Legal Basis for Processing

Under the GDPR / UK GDPR, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — processing necessary to respond to your enquiry and deliver services you have requested
• Legitimate interests (Art. 6(1)(f)) — sending follow-up communications to enquirers, and improving our website. We have assessed that these interests are not overridden by your rights.
• Consent (Art. 6(1)(a)) — analytics cookies, marketing cookies, and direct marketing communications where consent is required by applicable law. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — processing required to comply with applicable laws (e.g. tax, financial record-keeping)

5. Cookies and Tracking Technologies

Applicable rule: UK Privacy and Electronic Communications Regulations 2003 (PECR) — non-essential cookies require your prior opt-in consent.

When you first visit our site, a cookie consent banner will appear. We use three categories of cookies:

You can change your cookie preferences at any time by clearing your browser's localStorage or cookies. You may also use the "Manage" option on the cookie banner. Most browsers allow you to block or delete cookies via their settings.

6. Third-Party Services

Where you have given the relevant consent, our website loads scripts from the following third-party services. Each operates under its own privacy policy:

• Google Tag Manager / GA4 — website analytics and tag management. Google processes data on servers in the US and EU. Google Privacy Policy: policies.google.com/privacy
• Meta Pixel (Facebook / Instagram) — advertising conversion tracking and audience building. Meta Privacy Policy: facebook.com/privacy/policy/
• TikTok Pixel — advertising conversion tracking. TikTok Privacy Policy: tiktok.com/legal/page/row/privacy-policy/
• Calendly — strategy call booking and scheduling, embedded on our booking page. Always active when you use the booking page. Calendly Privacy Policy: calendly.com/privacy

We are not responsible for the data practices of these third-party services. We recommend reviewing their privacy policies before providing them with your data.

7. Data Sharing and Disclosure

Savvyards does not sell, rent, or trade your personal information. We may disclose data only in the following circumstances:

• To the third-party technology services listed in Section 6 (analytics and advertising platforms), solely to the extent permitted by your consent choices
• When required by law, court order, or a competent regulatory authority
• In the event of a business transfer or assignment — you will be notified in advance

8. Your Rights

Under the GDPR / UK GDPR, you have the following rights:

• Right of access (Art. 15) — request a copy of the personal data we hold about you
• Right to rectification (Art. 16) — ask us to correct inaccurate or incomplete data
• Right to erasure / "right to be forgotten" (Art. 17) — request deletion of your personal data in certain circumstances
• Right to restriction of processing (Art. 18) — ask us to pause processing while a dispute is resolved
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests or for direct marketing at any time
• Right to withdraw consent (Art. 7(3)) — withdraw any consent at any time; this does not affect the lawfulness of processing carried out before withdrawal

To exercise any of these rights, contact us at info@savvyards.com. We aim to respond within 30 days.

9. Data Retention

We retain personal data only as long as necessary for the purpose it was collected, or as required by law:

• Contact and audit form enquiries — 2 years from the date of last contact, then securely deleted
• Active client records — for the duration of the engagement plus 7 years for financial and legal compliance
• Analytics data — as configured in Google Analytics (default: 14 months; [CONFIRM: adjust if you have customised GA4 retention settings])
• Cookie consent records — stored in the visitor's own browser localStorage; cleared when the visitor clears their browser data

When data is no longer required, it is permanently deleted or irreversibly anonymised.

10. International Data Transfers

Savvyards is based in India and processes all personal data in India. When you submit information through our website, your data is transferred to and processed in India.

India does not currently hold an EU adequacy decision (as of the date of this policy). For personal data transferred from the EU/UK to India, we rely on the following transfer mechanism:

Transfer basis: Article 49(1)(b) GDPR derogation — transfer necessary for the performance of a contract between the data subject and Savvyards (i.e. responding to your service enquiry or delivering agreed services). For ongoing client engagements, we intend to include Standard Contractual Clauses (SCCs) — EU Commission Decision C(2021)3972 — in client service agreements as the business scales. [CONFIRM: Verify this basis with a qualified adviser before publishing, and update when SCCs are in place]

Third-party services (Google, Meta, TikTok) transfer data internationally under their own approved safeguard mechanisms.

11. Security Measures

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include:

• HTTPS encryption on all website pages
• Limited access to personal data on a need-to-know basis
• Regular software updates and security monitoring on our website infrastructure

No method of transmission over the internet is completely secure. We cannot guarantee absolute security, but we commit to notifying you promptly if a breach occurs that is likely to affect your rights.

12. Children's Privacy

Our website and services are directed exclusively at business professionals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal information, please contact us immediately and we will delete it without undue delay.

13. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in law, technology, or our practices. The "Last updated" date at the top of this page always reflects the most recent version.

Continued use of our website after any update constitutes acceptance of the revised policy. For material changes, we will provide a more prominent notice where required by applicable law.

14. How to Make a Complaint

If you have a privacy concern, please contact us first at info@savvyards.com — we will aim to resolve it within 14 days.

If you are not satisfied with our response, you may escalate your complaint to:

We are also subject to oversight by Indian authorities under the Digital Personal Data Protection Act 2023 (DPDP Act). [CONFIRM: Verify current DPDP Act enforcement and complaint mechanism status before publishing]