1. Who is responsible for your information?

Data controller / data fiduciary: BrandStory, PVT LTD

Registered address: No. 4 & 5, 3rd Floor, 1st Cross Road, Krishna Reddy Colony, Domlur Layout, Bengaluru, Karnataka, 560071

US registered office: 39109 Guardino Dr, Fremont, CA 94538

Privacy contact: contact@brandstoryglobal.com

If a different BrandStory entity contracts with you or determines the purpose of a particular processing activity, that entity may be identified in the relevant proposal, contract, form notice or regional supplement.

2. Information we collect

Information you provide

• Contact and identity details, such as your name, business email address, telephone number, job title, company and location.
• Enquiry details, such as the services you are interested in, budget or project information, preferred contact method, message and attachments you choose to provide.
• Communication records, including emails, calls, meeting notes, proposals, feedback and consent preferences.
• Recruitment information, if you apply for a role, such as your CV, portfolio, employment history, qualifications, location and interview information.

Information collected through the website

Device and connection data, such as IP address, browser type, operating system, device type, approximate location and language.

Usage and interaction data, such as pages viewed, referring page, clicks, scrolls, navigation paths, session duration, form interactions and technical errors.

Cookie and consent information, including consent status, consent timestamp and privacy preferences.

Attribution information, such as campaign, source, medium and landing-page parameters where available.

Information from other sources

We may receive business contact information from your employer, a colleague, an event, a referral partner, a public professional source, or an advertising or lead-generation platform. We use such information only where permitted and provide any additional notice required by applicable law.

3. How the website tools work

Google Analytics 4 and Google Tag Manager

Google Tag Manager helps us deploy and control website tags. Google Analytics 4 helps us understand traffic, engagement and conversions. Depending on your region and choices, analytics storage and related signals remain denied until you consent. Tag Manager itself is a deployment system; the tags it activates determine what information is processed.

Microsoft Clarity

With consent where required, Microsoft Clarity helps us understand how visitors use pages through interaction analytics, heatmaps and session playback. Clarity may process clicks, scrolling, mouse movement, page structure, device information, performance information and masked page content. We configure form fields and other sensitive elements to be masked and instruct visitors not to submit sensitive personal information in free-text fields.

Forms and monday CRM

When you submit an enquiry form, the information you enter is transmitted to monday CRM so authorised team members can respond, qualify the enquiry, assign follow-up tasks, maintain communication history and manage the potential client relationship. Form metadata may include the page URL, submission time, campaign attribution, consent record and technical identifiers needed for security and troubleshooting.

4. Why we use personal information and our legal grounds

We use personal information for the purposes below. Typical legal bases include steps requested before a contract, legitimate interests, consent where required, and legal obligations.

• Respond to enquiries and provide requested information — contact, company, enquiry and communication details.
• Prepare proposals and manage prospective-client relationships — contact, project, meeting and CRM records.
• Operate, secure and troubleshoot the website — device, log, security and limited usage data.
• Measure website performance and improve user experience — analytics and interaction data (consent where required).
• Send marketing communications — contact details and preferences (consent where required).
• Comply with law and protect rights — relevant records and communications.
• Recruit candidates — application and interview information.

Where consent is the basis, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal. Where we rely on legitimate interests, we balance those interests against your rights and expectations.

5. When we disclose information

We may disclose personal information to:

• Authorised BrandStory personnel who need it for sales, marketing, recruitment, website administration, security, finance or legal support.
• Service providers that host, secure or operate the website; provide analytics, session recording, forms, CRM, communications, cloud storage or professional advice.
• A client or business partner where you asked us to coordinate with them or disclosure is necessary for the requested service.
• Regulators, courts, law enforcement or other parties where required by law or reasonably necessary to protect rights, safety and security.
• A buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality and legal safeguards.

We do not disclose personal information in exchange for money. Some US privacy laws may define certain analytics or advertising disclosures as “sharing”, “targeted advertising” or a “sale” even when no money is paid. See the US State Privacy Notice and Your Privacy Choices.

6. International processing

BrandStory and its service providers may process information in India, the United States and other countries. Privacy laws in those countries may differ from those where you live. Where required, we use recognised transfer measures, such as contractual safeguards, transfer addenda, adequacy decisions or other lawful mechanisms. The exact mechanism depends on the entities, service provider and transfer.

7. Retention

We retain personal information only for as long as reasonably necessary for the purpose described, including to respond to an enquiry, maintain appropriate business records, resolve disputes, enforce agreements and meet legal, accounting or security requirements.

Typical retention practices include:

• Unqualified website enquiries — delete or anonymise after 12 months unless follow-up remains active or law requires longer.
• Qualified sales opportunities and proposal records — retain through the sales cycle and for up to 3 years after the last meaningful interaction, unless converted to a client or required longer.
• Client contract and billing records — retain for the contract term and applicable legal/tax limitation period.
• Analytics and Clarity data — retained according to the shortest useful vendor setting we operate.
• Consent and suppression records — retain while consent is relied on and for a reasonable period needed to demonstrate compliance or honour opt-outs.
• Unsuccessful candidate records — generally up to 12 months unless the candidate agrees to longer talent-pool retention or law requires otherwise.

Backup copies may remain for a limited cycle before secure overwriting.

8. Security

We use reasonable administrative, technical and organisational safeguards appropriate to the information and risk. These may include role-based access, multi-factor authentication, access reviews, encrypted transmission, vendor assessment, confidentiality duties, backups, logging and incident response. No internet transmission or storage system is guaranteed to be completely secure.

9. Your rights and choices

Depending on your location, you may have rights to request access, correction, deletion, restriction, objection, portability, consent withdrawal, an explanation of certain processing, or an appeal of a decision. You may also opt out of marketing at any time and change cookie choices through Cookie Preferences.

Submit a request at /data-rights-request or email contact@brandstoryglobal.com. We may need to verify your identity and authority. We will not discriminate against you for exercising an applicable privacy right.

10. Marketing communications

You can unsubscribe from marketing emails using the link in the message or by contacting us. Operational replies to your enquiry and service-related messages are not marketing. Where required, telephone, SMS or WhatsApp marketing will be sent only with the appropriate consent and will include a practical opt-out.

11. Children

The website is intended for business users and is not directed to children. We do not knowingly collect personal information from children through this website. If you believe a child has submitted information, contact us so we can review and take appropriate action.

12. Third-party links

The website may link to third-party sites or platforms. Their privacy practices are governed by their own notices, not this Policy.

13. Changes to this Policy

We may update this Policy to reflect changes in law, technology or our practices. We will post the updated version and change the “Last updated” date. Where required, we will provide additional notice or obtain consent.

14. Contact and complaints

Privacy contact: contact@brandstoryglobal.com

Postal address: No. 4 & 5, 3rd Floor, 1st Cross Road, Krishna Reddy Colony, Domlur Layout, Bengaluru, Karnataka, 560071

US registered office: 39109 Guardino Dr, Fremont, CA 94538

You may also complain to the privacy or data-protection authority in your jurisdiction. India and US-specific information appears in the India Privacy Notice and US State Privacy Notice.