Privacy Policy

IndexSmarts (“IndexSmarts”, “we”, “us” or “our”) provides search engine optimisation, AI search optimisation, digital marketing, and design and development services. We are based in Mohali, Punjab, India, and we serve clients in India and internationally.

This Privacy Policy explains what personal information we collect when you visit our website, contact us, subscribe to our newsletter, or engage us for services, and what we do with that information. It applies to indexsmarts.com and to any enquiry you send us by email, phone, or WhatsApp.

We handle personal information in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act), and — where it applies to visitors and clients in the European Economic Area and the United Kingdom — the General Data Protection Regulation (GDPR).

Information you give us directly. When you fill in a form, subscribe to our newsletter, request an audit or proposal, or contact us by email, phone, or WhatsApp, we collect:

• Your name and the name of your business
• Your email address and phone number
• Your website address and the details of your enquiry
• Any other information you choose to include in your message

Information collected automatically. When you browse the website, we and our analytics providers may collect:

• Your IP address, approximate location (city or region level), and time zone
• Browser type, device type, operating system, and screen size
• Pages viewed, time spent on each page, scroll depth, and the links you click
• The referring website or campaign that brought you to us

Information from client engagements. If you become a client, we receive access to systems you grant us — such as Google Analytics, Google Search Console, Google Ads, Meta Business Manager, your CMS, or your hosting panel — and to any content, credentials, or business data you share with us so that we can deliver the agreed services.

We use the information described above to:

• Respond to your enquiry and prepare audits, proposals, and quotations
• Deliver, manage, and report on the services you have engaged us for
• Send invoices and manage payments and accounts
• Send our newsletter and occasional marketing emails, where you have asked to receive them
• Understand how the website is used so we can improve its content, speed, and structure
• Detect, investigate, and prevent fraud, abuse, spam, and security incidents
• Meet our legal, tax, and accounting obligations

We do not sell your personal information, and we do not share it with third parties for their own independent marketing.

Where the GDPR or the DPDP Act applies, we rely on the following grounds to process personal information:

• Consent — for marketing emails, our newsletter, and non-essential cookies. You may withdraw consent at any time.
• Performance of a contract — to deliver the services set out in a signed proposal, statement of work, or engagement letter.
• Legitimate interests — to run and secure our website, respond to business enquiries, and improve our services, where those interests are not overridden by your rights.
• Legal obligation — to keep accounting records and to comply with tax and regulatory requirements.

Cookies are small files stored on your device. We use them, along with similar technologies such as pixels and local storage, for the following purposes:

• Essential — required for the website to load, remember your preferences, and stay secure. These cannot be switched off.
• Analytics — help us understand which pages are read, how visitors arrive, and where they drop off, so we can improve the site.
• Advertising and remarketing — where enabled, these let us measure the performance of our campaigns and show our ads to people who have already visited the site.

These technologies may be provided by third parties, including Google (Google Analytics, Google Search Console, and Google Ads) and Meta Platforms. Each provider processes data under its own privacy policy, which we encourage you to read.

You can block or delete cookies through your browser settings. Blocking essential cookies may prevent parts of the website from working correctly.

We share personal information only where it is necessary, and only with:

• Service providers who work on our behalf — hosting, email delivery, analytics, CRM, project management, and accounting providers — each bound to protect the information and use it only for the service they provide to us.
• Advertising and search platforms, where we manage campaigns or reporting on your behalf as our client.
• Professional advisers such as accountants, auditors, and lawyers, where required.
• Authorities or regulators, where we are legally required to disclose information, or where disclosure is needed to establish or defend a legal claim.
• A successor entity, in the event of a merger, acquisition, or sale of our business, subject to the protections in this policy.

When we deliver services, we often access systems that contain personal information belonging to our client's own customers — for example analytics data, ad account audiences, CRM exports, or form submissions on a website we build or maintain.

In that situation the client remains the data controller (the Data Fiduciary under the DPDP Act) and IndexSmarts acts as a processor. We process that information only on the client's documented instructions, only for as long as the engagement requires, and we return or delete it when the engagement ends. Where the GDPR applies, we will enter into a data processing agreement on request.

We are based in India, and the tools we use — including hosting, email, and analytics providers — may store or process information on servers outside your country. Where we transfer personal information from the EEA or the UK, we do so using an approved transfer mechanism, such as the European Commission's Standard Contractual Clauses, together with appropriate technical and organisational safeguards.

We keep personal information only for as long as we need it for the purpose it was collected for:

• Enquiries that do not become engagements — up to 24 months, so we can pick up the conversation if you return.
• Client records and deliverables — for the duration of the engagement and for up to 7 years afterwards, where required for tax and accounting purposes.
• Newsletter subscriptions — until you unsubscribe.
• Website analytics — for the retention period configured in the analytics platform, typically no longer than 26 months.

We use reasonable technical and organisational measures to protect personal information, including encrypted connections (HTTPS), access controls and least-privilege access to client systems, credential managers rather than shared passwords, and regular review of the accounts and tools we hold access to.

No method of transmission or storage is completely secure. If a breach occurs that is likely to affect you, we will notify you and the relevant authority as required by applicable law.

Subject to the law that applies to you, you have the right to:

• Access the personal information we hold about you and receive a copy of it
• Correct information that is inaccurate, incomplete, or out of date
• Request erasure of your information where we no longer need it
• Withdraw consent at any time, including unsubscribing from our emails
• Object to, or ask us to restrict, processing based on our legitimate interests
• Request portability of information you provided to us, in a machine-readable format
• Nominate another person to exercise these rights on your behalf in the event of death or incapacity, as provided under the DPDP Act
• Lodge a complaint with the Data Protection Board of India or your local supervisory authority

To exercise any of these rights, email us at indexsmarts@gmail.com. We will respond within 30 days. We may ask you to verify your identity before we act on a request.

In accordance with the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000, you may raise any complaint about how we handle your personal information with our Grievance Officer:

• Email: indexsmarts@gmail.com
• Phone: +91 79058 64185
• Address: Mohali Stadium Road, Sector 59, Sahibzada Ajit Singh Nagar, 1604, Mohali Phase 5, 160059, Punjab, India

We acknowledge complaints within 48 hours and aim to resolve them within 30 days.

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with information, contact us and we will delete it.

Our website and blog link to third-party websites and tools that we do not control. This policy does not cover those sites, and we are not responsible for their content or privacy practices. Please read their policies before sharing information with them.

We may update this Privacy Policy as our services, tools, or legal obligations change. The revised version takes effect when we publish it on this page, and the date at the top of the page will change. Where a change materially affects your rights, we will make reasonable efforts to notify you directly.

If you have any questions about this Privacy Policy or about how we handle your information, please get in touch. We are happy to explain anything on this page in plain language.