Privacy Policy

1. About this policy

This Privacy Policy explains how Xternal Media (“Xternal Media”, “we”, “us” or “our”) collects, uses, shares and protects personal information. It applies when you visit our website, contact us, or engage us to provide digital marketing, advertising, e-commerce or website development services.

We are a business-to-business service provider. Most of the personal information we handle relates to the people who contact us or who work with us on behalf of their businesses.

This policy has been prepared with reference to applicable Indian law, including the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023 to the extent its provisions are in force. By using our website or sharing information with us, you acknowledge the practices described here.

2. Information we collect

Contact and enquiry information

When you fill in our enquiry form, email us, call us or message us, we collect the information you choose to share. This typically includes your name, email address, phone number, company or brand name, website address, the services you are interested in, an approximate advertising budget and the details of your requirements.

Client and billing information

If you become a client, we collect the information needed to set up and manage the engagement, such as the names and contact details of your team members, your registered business name, billing address, GSTIN and any other details required to issue valid tax invoices.

Information we access while delivering services

To deliver our services, clients may give us access to accounts and tools such as Meta Business Manager, Google Ads, Google Analytics, Google Merchant Center and Shopify. These may contain information about the client's own customers (for example, order data or customer lists used for advertising audiences). We access and use such information only on the client's behalf, as described in Data we process on behalf of clients.

Website usage information

When you visit our website, our hosting provider and any analytics tools we use may automatically record technical information such as your IP address, browser type, device type, operating system, referring page, pages viewed and the date and time of your visit.

Payment information

Payments made online are processed by third-party payment service providers. We receive confirmation details such as the transaction ID, amount, date, payment status and the name or email associated with the payment. We do not receive or store your full card number, CVV, UPI PIN or net banking credentials. See Payment processing.

3. Cookies and similar technologies

Cookies are small text files stored on your device by your browser. Our website may use cookies and similar technologies (such as pixels and local storage) for the following purposes:

• Essential: to make the website work correctly and securely.
• Analytics: where enabled, to understand how visitors use the website — such as which pages are viewed and how people arrive at the site — so we can improve it. We may use tools such as Google Analytics for this purpose.
• Advertising: where enabled, to measure the effectiveness of our own advertising and to show relevant ads to people who have visited our website, using tools such as the Meta Pixel and Google advertising tags.

You can block or delete cookies through your browser settings, and many browsers let you refuse third-party cookies. You can also manage ad preferences directly with providers such as Google and Meta. Blocking essential cookies may affect how parts of the website work.

4. How we use information

We use personal information to:

• respond to your enquiries and arrange consultations;
• prepare proposals, quotations and agreements;
• deliver, manage and report on the services you engage us for;
• issue invoices, process payments and maintain accounting records;
• communicate with you about your project, account or service;
• process cancellation and refund requests;
• maintain and improve our website and services;
• protect our website, systems and business against fraud, spam and misuse;
• send marketing communications where permitted; and
• comply with legal, tax and regulatory obligations and enforce our agreements.

We use personal information only for the purpose for which it was shared or for purposes reasonably connected to it.

5. Marketing communications

We may occasionally send you updates about our services, insights or offers by email, phone or messaging apps such as WhatsApp, where you have agreed to receive them or where we have an existing business relationship with you and are otherwise permitted to do so.

You can opt out at any time by using the unsubscribe link in our emails, replying “STOP” to a message, or writing to us at hello@xternalmedia.in. Opting out of marketing does not affect service-related communications about an active engagement, invoices or payments.

6. Data we process on behalf of clients

When delivering services, we may handle personal information that belongs to our clients' own customers — for example, customer lists uploaded to advertising platforms to build audiences, or order and customer records inside a Shopify store.

• We use such information only to provide the services the client has engaged us for, and in line with the client's instructions.
• The client is responsible for ensuring it has collected this information lawfully and has any notices or consents required to share it with us and to use it for advertising.
• Where information is uploaded to an advertising platform, it is also subject to that platform's own terms and data policies.
• At the end of an engagement, we stop using client data and remove our access in line with our agreement with the client.

7. How we share information

We do not sell personal information. We share it only where necessary for the purposes described in this policy, with:

• Service providers who help us run our business, such as website hosting, email, cloud storage, communication, project management, invoicing and accounting providers. They may use the information only to provide their services to us.
• Payment service providers, such as payment gateways and banks, to process payments and refunds.
• Advertising and technology platforms, such as Meta, Google and Shopify, to the extent required to deliver the services a client has engaged us for.
• Professional advisers, such as chartered accountants and lawyers, under a duty of confidentiality.
• Government, regulatory or law enforcement authorities, where we are required to do so by law or to protect our legal rights.
• A successor business, if our business is reorganised, merged or transferred, subject to this policy continuing to apply to your information.

8. Payment processing

Online payments to Xternal Media are processed by third-party payment gateways and payment aggregators. When you pay, you provide your payment details directly to the payment provider, and their handling of that information is governed by their own terms and privacy policy.

We do not collect or store full card numbers, CVV codes, UPI PINs, or net banking passwords. We keep records of transactions — such as invoice numbers, amounts, dates and transaction references — for accounting, tax, reconciliation, refund and dispute-resolution purposes.

9. Data security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse or alteration. These include encrypted (HTTPS) connections to our website, access controls on our accounts and systems, and limiting access to people who need it to do their work.

No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. If you believe your information has been compromised, please contact us immediately.

10. Data retention

We keep personal information only for as long as it is needed for the purposes described in this policy, including:

• Enquiries that do not lead to an engagement are kept for a reasonable period in case you contact us again, and are then deleted.
• Client and project records are kept for the duration of the engagement and for a reasonable period afterwards to handle follow-up questions and disputes.
• Invoices, payment and tax records are kept for the period required under applicable tax and accounting laws.

When information is no longer needed, we delete it or anonymise it so that it no longer identifies you.

11. Where information is stored

Some of our service providers — for example, cloud hosting, email and software providers — may store or process information on servers located outside India. Where this happens, we take reasonable steps to use reputable providers that protect information appropriately, and any transfer is made in accordance with applicable law.

12. Your rights and choices

Subject to applicable law, you may ask us to:

• confirm whether we hold personal information about you and provide a summary of it;
• correct, complete or update information that is inaccurate or incomplete;
• delete information that is no longer needed, unless we must keep it by law;
• withdraw consent you have previously given;
• stop sending you marketing communications; and
• address a grievance about how we have handled your information.

To make a request, email us at hello@xternalmedia.in with the subject line “Privacy request”. We may need to verify your identity before acting on your request. Some requests may affect our ability to continue providing services — for example, if information needed for invoicing is deleted.

13. Consent

By submitting your information through our website or otherwise sharing it with us, you consent to its use as described in this policy. Where you provide information about other people — for example, colleagues or your customers — you confirm that you are entitled to share it with us.

You may withdraw your consent at any time by contacting us. Withdrawal does not affect processing carried out before it, and we may continue to retain information where required by law.

14. Children's information

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 18 years of age. If you believe a child has shared information with us, please contact us and we will delete it.

15. Third-party websites

Our website may link to third-party websites and platforms. We are not responsible for their content or privacy practices, and we encourage you to read their privacy policies before sharing information with them.

16. Grievances

If you have a question, concern or complaint about how we handle personal information, please contact us with the subject line “Grievance”:

We will acknowledge your complaint and work to resolve it within the time required under applicable law.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, practices or legal requirements. The updated version will be published on this page with a revised effective date. Where changes are significant, we will take reasonable steps to inform active clients, for example by email.

18. Contact us

For any questions about this Privacy Policy, contact us at:

You can also reach us through our contact page.