Privacy Policy

This Privacy Policy explains what personal data PencilGrowTech collects when you visit www.pencilgrowtech.com, contact us or sign up for our newsletter, why we collect it, how long we keep it, who we share it with and the choices and rights you have. We have written it in plain language. If anything is unclear, email us at pencilgrowtech@gmail.com.

1. Who We Are

PencilGrowTech ("PencilGrowTech", "we", "us") is a digital marketing, web design and technology agency based in India. We work with businesses in India, the UAE, the UK, the USA and other countries. For the personal data described in this policy, we decide why and how it is used, so we are the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 and the "controller" under the UK and EU GDPR and the UAE Personal Data Protection Law.

When we process personal data on behalf of a client as part of a project (for example, customer data in a client's website, email list or ad account), we act on that client's instructions, and the client's own privacy policy applies to that data.

2. Information We Collect

Information you give us.

• Contact and enquiry forms: your name, email address, phone number (optional), company name (optional), the service you are interested in, your message and the page you sent it from.
• Newsletter sign-up: your email address.
• Email, phone and WhatsApp: anything you choose to send us when you contact us directly, including attachments.
• Clients: if you become a client, business contact details, billing information and the project information you share with us.

Information collected automatically.

• Usage data: pages visited, time on page, how you arrived at our site (for example from a search engine or social media), approximate location (city or country), device type, browser and operating system. We collect this through Google Analytics, loaded with Google Tag Manager.
• Technical data: your IP address and browser details, which our hosting provider and website software process to deliver pages, keep the site secure and block spam. Our contact forms use your IP address only in a scrambled (hashed) form to limit repeated submissions, and that record is deleted automatically within an hour. We do not store your IP address with your enquiry.

We do not ask for sensitive information such as financial account numbers, government ID numbers, health information or passwords through our website. Please do not send it to us.

3. How We Use Your Information

• To reply to your enquiry, prepare a proposal or quotation and arrange a consultation.
• To deliver and support the services you buy from us, and to send invoices and service messages.
• To send our newsletter if you have subscribed. You can unsubscribe at any time by emailing us.
• To understand how visitors use our website so we can improve its content, speed and design.
• To protect our website, detect spam and abuse, and keep our systems secure.
• To meet legal, tax and accounting obligations and to establish or defend legal claims.

We do not sell your personal data, and we do not use it to make automated decisions that have legal or similarly significant effects on you.

4. Legal Basis for Processing

• Consent: when you submit a form or subscribe to our newsletter. You can withdraw consent at any time; this does not affect processing that took place before you withdrew it.
• Contract: when we need the information to provide services you have requested or agreed to buy.
• Legitimate uses and legitimate interests: keeping our website secure, preventing spam and understanding how our website is used, where this does not override your rights.
• Legal obligation: keeping business and tax records required by law.

5. Cookies & Tracking Technologies

Cookies are small files stored in your browser. We use:

• Essential cookies and storage: needed for the website to work, for example to keep our administrators signed in or to remember choices you make on the site. These do not track you across other websites.
• Analytics cookies: Google Analytics sets cookies such as _ga and _ga_* to count visits and understand how the site is used. These cookies can last up to two years.
• Spam protection: our contact form may use Cloudflare Turnstile to tell people from automated spam. When the form loads, Cloudflare receives technical information about your browser and connection to run this check. See Cloudflare's privacy policy for details.
• Third-party features: our WhatsApp chat button and social sharing buttons open WhatsApp, Facebook, LinkedIn or X only when you click them. Once you do, that provider's own privacy policy and cookies apply.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics on all websites with the Google Analytics opt-out browser add-on. Blocking essential cookies may stop parts of the website from working.

6. Information Sharing

We share personal data only with service providers who help us run our business, and only as much as they need:

• Website hosting and content delivery: Hostinger, which stores our website, its database and backups and delivers pages through its content delivery network.
• Email: our email provider (Google), which delivers enquiry notifications and our replies.
• Analytics: Google, which provides Google Analytics and Google Tag Manager.
• Messaging: WhatsApp (Meta), if you choose to contact us there.
• Professional advisers: accountants, auditors and lawyers, where needed.

We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a business sale or reorganisation, in which case the new owner must protect it in line with this policy.

7. Data Storage, Retention & Security

Website enquiries and newsletter sign-ups are stored in our website's database on Hostinger's servers and in our email inbox. We keep information only as long as we need it:

• Enquiries that do not lead to work: up to 24 months after our last contact, so we can follow up on the same conversation.
• Client records: for the length of our working relationship and afterwards as long as tax and accounting laws require.
• Newsletter: until you unsubscribe or ask us to delete your email address.
• Analytics data: for the period set in our Google Analytics account, no longer than 14 months for data linked to a device or cookie.
• Backups: deleted information may stay in website backups until those backups are replaced, usually within a few weeks.

We protect your information with encrypted HTTPS connections, access limited to our administrators, spam and abuse protection on our forms, software updates and regular backups. No website or email system can be guaranteed 100% secure. If a personal data breach affects you, we will tell you and the relevant authorities as the law requires.

8. International Data Transfers

We are based in India, and our service providers (including Hostinger and Google) may store or process data in other countries, such as countries in the European Union and the United States. When personal data leaves the country where it was collected, we rely on the safeguards our providers offer, such as standard contractual clauses, and on the transfer rules of the applicable law.

9. Your Rights

Depending on where you live and the law that applies, you can:

• Access the personal data we hold about you and get a summary of how we use it.
• Correct or complete information that is inaccurate or out of date.
• Delete your personal data when it is no longer needed or you withdraw consent.
• Withdraw consent at any time, for example by unsubscribing from our newsletter.
• Object to or restrict certain processing, including direct marketing.
• Data portability: receive your data in a commonly used format.
• Nominate another person to exercise your rights in the event of death or incapacity (India).
• Complain: raise a grievance with us first. If you are not satisfied, you can complain to your data protection authority, such as the Data Protection Board of India, the UK Information Commissioner's Office (ICO), your local EU supervisory authority or the UAE Data Office.

To use any of these rights, email pencilgrowtech@gmail.com with the subject line "Privacy request". We may need to confirm your identity before acting on a request. We reply within 30 days and do not charge a fee for reasonable requests.

10. Children's Privacy

Our website and services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

11. Third-Party Links

Our website links to other websites, including client websites in our portfolio and social media platforms. We are not responsible for their content or privacy practices, so please read their privacy policies.

12. Changes to This Policy

We may update this policy when our website, services or the law change. We will post the new version on this page with a new "Last updated" date, and where the changes are significant we will highlight them on our website or tell you by email.

13. Contact Us

For privacy questions, requests or complaints, contact our privacy and grievance contact:

• Business: PencilGrowTech
• Email: pencilgrowtech@gmail.com
• Address: India

We aim to reply within one business day, and to resolve privacy requests within 30 days.