The short version: we collect only what we need to quote, do and invoice the work. Client files are used solely for the project they were sent for, seen only by the people on that project, and deleted when you ask. We never sell data.
1. Who is responsible
Grandfield Media Private Limited (CIN U85499TS2026PTC221225), trading as GrandFieldAgency, registered office Plot No. 93, Koundinya Nagar, Nacharam, Hyderabad, Telangana 500076, India, is the data controller for the personal data described in sections 2 to 4. For client files described in section 5 we act on the client's instructions as a processor.
2. Data we collect about you
| Category | What | Why |
|---|---|---|
| Enquiry and contact details | Name, company, email address, and any details you include in an enquiry | To reply, prepare a quote and manage the project |
| Contract and billing records | Approved quotes, invoices, payment records, tax identifiers you provide | To perform the contract and meet tax and accounting law |
| Correspondence | Emails and messages exchanged about a project | To do the work and keep a record of instructions and approvals |
| Website use | Server logs (IP address, pages requested, browser type) | Security and keeping the site running; see our cookie policy |
3. Legal basis
- Contract — preparing a quote you asked for and performing a project you approved.
- Legal obligation — tax, accounting and company-law records we must keep.
- Legitimate interests — securing our website and systems, and keeping a record of our work.
- Consent — only where we ask for it, for example to name you as a client.
4. How long we keep it
- Enquiries that do not become projects — twelve months, then deleted.
- Project correspondence and deliverables — ninety days after project completion, unless you ask us to delete them sooner or keep them longer.
- Contracts, invoices and payment records — for as long as Indian tax and company law requires, currently eight years.
- Server logs — ninety days.
5. Client files we process for you
Data work means handling files that often contain other people's personal data: customer lists, invoices, CRM records, forms. For that data you are the controller and we are your processor. We:
- use it only to carry out the project you commissioned, on your written instructions;
- restrict access to the team members assigned to the project, each of whom is bound by confidentiality;
- keep it in the shared folder agreed for the project, and do not copy it to personal devices or unapproved tools;
- hold any credentials you share in a password manager and revoke them when the project ends;
- do not use it to train any machine learning model;
- delete working copies within ninety days of completion, or immediately on request, and confirm deletion in writing;
- tell you without undue delay if we become aware of a security incident affecting your data;
- sign a data processing agreement or non-disclosure agreement on request.
6. Who we share data with
We share personal data only with providers we need to run the business: email and cloud storage (Google Workspace), a password manager, our invoicing and payment providers, and our bank. Each acts under its own contractual and legal obligations. We do not sell or rent personal data, and we do not share client files with anyone outside the project team unless you instruct us to (for example, uploading products to your e-commerce platform).
7. International transfers
We are in India and serve clients worldwide. Data may therefore be transferred between your country and India, and our providers may store data in other countries under their own safeguards. Where a client's law requires specific transfer terms, we will agree them.
8. Security
Access to systems is by individual accounts with two-factor authentication where available, credentials are shared only through a password manager, and client files live in access-controlled cloud folders. No method is perfectly secure, and we will tell you promptly about any incident affecting your data.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent. Under India's Digital Personal Data Protection Act, 2023, you may also nominate someone to exercise these rights for you. To exercise any of these, email contact@grandfieldmedia.com from the address associated with the enquiry or project. We reply within one business day and act within thirty days. Our data deletion policy describes the deletion process. You may also complain to your local data protection authority.
10. Children
Our services are for businesses. We do not knowingly collect personal data from anyone under 18 as a client or enquirer.
11. Changes
We may update this policy. The date at the top shows when it last changed. Material changes affecting an active project are notified to the client by email.
12. Contact
Grandfield Media Private Limited
Plot No. 93, Koundinya Nagar, Nacharam, Hyderabad, Telangana 500076, India
contact@grandfieldmedia.com
Phone: +91 92479 12080