Privacy Policy

Rise & Root (“we”, “us”) is a digital marketing studio based in Pune, Maharashtra, India. This policy explains what personal data this website collects, why, how long we keep it, and what you can ask us to do with it.

We have tried to write this in plain language and to describe only what this website actually does. If anything is unclear, please ask — contact details are at the end.

1. What we collect

This website has one form: the enquiry form in the footer. It is the only place we ask you for personal data. We collect nothing else about you as you browse — no analytics, no advertising pixels, no profiling.

When you submit the form, our CRM provider also records two things automatically:

• The page you submitted from — its address and title.
• Your IP address, from which an approximate city, region and country are derived. This happens at the network level and cannot be switched off. We are telling you rather than implying it does not happen.

We do not collect payment details, government identifiers, or any of the sensitive categories defined under Indian law through this website.

2. Why we collect it

One purpose only: to respond to the enquiry you sent us, and to continue that conversation if it leads somewhere.

We do not add you to a marketing list on the strength of an enquiry. If we ever want to send you marketing email, we will ask separately, with a clear opt-in you have to tick yourself.

3. Your consent

The form has a checkbox you must tick before it will send:

“I agree to Rise & Root storing my details and contacting me about my enquiry.”

That is the basis on which we hold your data. The wording is recorded alongside your submission, so there is a record of exactly what you agreed to.

You can withdraw consent at any time by emailing us. Withdrawing is as easy as giving it: one email, no form to fill in, no reason required. When you withdraw, we delete your enquiry data unless we are legally required to keep it.

4. Who else sees it

We do not sell personal data. We do not share it for advertising. Two companies process it on our behalf:

HubSpot

Our customer relationship manager. Your enquiry is stored there so we can track and respond to it. HubSpot acts as our processor, meaning it handles the data on our instructions and not for its own purposes.

Netlify

Hosts this website. Like any web host, its servers handle the requests your browser makes, which includes your IP address.

Beyond those two, the only other outbound connections from this site are the links to our Instagram and Facebook pages — and those only when you click one. Nothing is sent to them just because you visited.

5. Where your data is stored

HubSpot stores data on servers outside India, most likely in the United States. Transfers are covered by Standard Contractual Clauses, supplemented by HubSpot's certification under the EU–US Data Privacy Framework.

Under India's Digital Personal Data Protection Act 2023, transferring personal data outside India is permitted except to countries the Government has specifically restricted. No country is currently restricted.

6. Cookies and tracking

This website sets no cookies when you visit it. There is no analytics, no advertising tag, no tracking script, and no consent banner — because there is nothing to consent to.

Fonts and icons are served from our own domain rather than a third-party network, so simply loading a page does not disclose your IP address to anyone but our host.

One cookie appears only if you submit the form: our CRM's security layer sets a short-lived bot-detection cookie (about thirty minutes) to distinguish real submissions from automated ones. It is used for security, not tracking, and it is never set by merely reading the page.

Separately, the form records the time of your last few submissions in your own browser's local storage, so it can stop the same browser sending the same enquiry over and over. That data never leaves your device, is not readable by us, and you can clear it at any time through your browser settings.

7. How long we keep it

We keep enquiry data for 24 months from our last contact with you, then delete it. If a conversation turns into work, the relevant records are kept for as long as the business relationship lasts, plus any period tax or contract law requires.

You can ask us to delete your data sooner. We will, unless we are legally obliged to keep it.

8. How we protect it

• The whole site is served over HTTPS, so what you type is encrypted in transit.
• Enquiries go to HubSpot over an encrypted connection and sit behind account access controls.
• Only the people who need to answer your enquiry can see it.
• The form carries spam protections so automated submissions do not fill our records with junk.

No system is perfectly secure, and we would rather say so than promise otherwise. If a breach ever affects your data, we will notify you and the Data Protection Board as the law requires.

9. Your rights

Under the Digital Personal Data Protection Act 2023 you may:

• Ask what we hold about you, and what we have done with it.
• Correct anything inaccurate, incomplete or out of date.
• Erase your data, where we have no legal reason to keep it.
• Withdraw consent at any time.
• Nominate someone to exercise these rights for you if you die or become incapacitated.
• Complain to us, and escalate to the Data Protection Board of India if our answer does not satisfy you.

Email the address below and we will respond as quickly as we can, and in any event within 90 days. There is no charge.

10. Children

This site is meant for businesses and the enquiry form is intended for adults. By submitting it you confirm you are 18 or older.

We do not knowingly hold data about children. If you believe a child has sent us their details, tell us and we will delete them promptly.

11. Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. Material changes affecting data we already hold will be notified directly where we can reach you.

12. Contact us

If our answer does not satisfy you, please tell us and we will look at it again. Indian data protection law also provides for escalation to the Data Protection Board of India; that body is being constituted, so in the meantime the fastest route to a resolution is directly with us.

← Back to home