Skip to main content

TOFFYJAR

Privacy policy

How Toffyjar Digital Private Limited collects, uses, shares and protects personal data, and the rights you have under GDPR, UK GDPR, the DPDP Act and CCPA/CPRA.

Last updated 17 Oct 2026 · Maintained for Toffyjar Digital Private Limited by Nikhil Narasipura Doddamane, Founder & Head of SEO/GEO

This privacy policy explains how Toffyjar Digital Private Limited ("Toffyjar", "we", "us" or "our") collects, uses, shares and protects personal data when you visit toffyjar.com, contact us or work with us. We serve clients in India, the United States, the United Kingdom and worldwide, and we have written this policy to meet the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

1. Who we are

Toffyjar Digital Private Limited is a company incorporated in India and is the data controller (and, under the DPDP Act, the data fiduciary) for the personal data described in this policy.

  • Registered office: No. 2179/1, 3rd Cross, Basaveshwara Road, KR Mohalla, Mysuru, Karnataka 570004, India
  • Corporate Identification Number (CIN): U72900KA2021PTC146591 (Registrar of Companies, Bangalore; incorporated 15 April 2021; status Active). Toffyjar has operated as a brand since 2017; the company was incorporated in 2021.
  • Office: Bangalore (Bengaluru), Karnataka, India
  • Contact: use our
    contact page
    and write "Privacy request" in your message, or write to [email protected]
  • Grievance Officer (DPDP Act): Nikhil Narasipura Doddamane, Founder, reachable at [email protected]

When we process personal data on behalf of a client while delivering services (for example, data held in a client's website or analytics account), we act as a processor for that client, and the client's own privacy notice and our agreement with the client govern that processing.

2. Personal data we collect

Information you give us

  • Forms: when you use our requirement form, contact form, audit request or newsletter signup, we collect your name, work email, website URL, the service you are interested in, your budget range and any project details you choose to share.
  • Calls and email: details you share when you book a discovery call or correspond with us, such as your company, role, phone number and meeting notes.
  • Clients: billing contact details, invoicing and payment records, and the account access you grant us to deliver the work.

Information collected automatically

  • Analytics: pages viewed, referring site, approximate location (derived from IP address), device and browser type, and on-site events, collected through analytics tools such as Google Analytics.
  • Server and security logs: IP address, request time, user agent and similar technical data recorded by our host and our content delivery and security network to keep the site available and protected.
  • Cookies and similar technologies: see section 9.

We do not knowingly collect sensitive or special category data (such as health, religion or biometric data) through this website. Please do not send it to us.

3. How we use personal data

  • To reply to your enquiry, prepare proposals and quotes, and schedule calls.
  • To deliver, manage and invoice the services you buy from us.
  • To send newsletters or updates you have asked for. You can unsubscribe at any time.
  • To understand how the site is used and improve its content, speed and usability.
  • To keep the site, our systems and our clients secure and to prevent fraud and abuse.
  • To comply with legal, tax and accounting obligations and to establish or defend legal claims.

We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Legal bases for processing

GDPR and UK GDPR

  • Contract: to take steps at your request before entering a contract (quotes, proposals) and to perform our contract with you.
  • Legitimate interests: to respond to business enquiries, run and secure our website, understand aggregate usage and market our services to business contacts, balanced against your rights.
  • Consent: for non-essential cookies and analytics where consent is required, and for newsletters. You can withdraw consent at any time without affecting earlier processing.
  • Legal obligation: to keep records required by tax, company and accounting law.

India: DPDP Act, 2023

We process digital personal data on the basis of your consent, given when you submit a form or otherwise share data with us for a stated purpose, or for legitimate uses permitted by the Act, such as where you voluntarily provide data for a specified purpose, or to comply with law. Where we rely on consent, you may withdraw it at any time through the contact routes in section 1, and we will stop processing for that purpose within a reasonable time, unless the law requires us to retain the data.

United States: CCPA/CPRA notice at collection

In the past 12 months we have collected the following categories of personal information: identifiers (name, email, IP address), commercial information (services requested, billing records), internet or network activity (browsing and interaction data) and professional information (company and role). We use them for the business purposes described in section 3. We retain each category for the periods described in section 7. We do not sell personal information and do not share it for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit.

5. Sharing and processors

We share personal data only as needed for the purposes above, with:

  • Service providers (processors) acting on our instructions under written terms, including website hosting (Hostinger), content delivery and security (Cloudflare), transactional email delivery (Mailgun), website analytics (Google), site tools and statistics (Automattic Jetpack), and our email, file storage, accounting and video call providers.
  • Team members and contractors who need the data to deliver your project and are bound by confidentiality.
  • Professional advisers, such as lawyers, auditors and accountants, under duties of confidentiality.
  • Authorities where required by law, court order or to protect our rights, users or the public.
  • A buyer or successor in the event of a merger, acquisition or sale of assets, subject to this policy.

6. International transfers

We are based in India and our providers may process data in India, the United States, the European Economic Area, the United Kingdom and other countries. Where personal data from the EEA or UK is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful transfer mechanism. Transfers of personal data out of India follow the DPDP Act and any restrictions notified by the Government of India. You can ask us for more information about these safeguards.

7. How long we keep data

  • Enquiries that do not become projects: up to 24 months after our last contact, then deleted or anonymized.
  • Client and contract records, invoices and payment records: for the duration of the engagement and up to 8 years afterwards to meet Indian tax and company law requirements.
  • Newsletter data: until you unsubscribe, then kept only on a suppression list so we do not email you again.
  • Analytics data: according to the retention period set in the analytics tool, which we keep no longer than needed for reporting.
  • Server and security logs: typically up to 90 days, unless needed to investigate an incident.

8. Your rights and how to exercise them

Depending on where you live, you may have the right to:

  • access the personal data we hold about you and receive a copy;
  • correct inaccurate or incomplete data, and update it;
  • delete (erase) your data;
  • restrict or object to processing, including objecting at any time to direct marketing;
  • data portability;
  • withdraw consent at any time;
  • under the DPDP Act, obtain a summary of the data processed and the parties it was shared with, seek grievance redressal and nominate another person to exercise your rights in the event of death or incapacity;
  • under the CCPA/CPRA, know, delete and correct personal information, opt out of sale or sharing (we do neither), and not be discriminated against for exercising these rights.

To exercise any right, contact us through the contact page with the subject "Privacy request". We may need to verify your identity before acting. We respond within one month (GDPR and UK GDPR), 45 days (CCPA/CPRA) or the period prescribed under the DPDP Act, and we will tell you if we need more time. You may use an authorized agent where the law allows. If you are not satisfied, you can complain to your local supervisory authority, such as the UK Information Commissioner's Office or an EU data protection authority, or, in India, approach the Data Protection Board of India after first using our grievance process.

9. Cookies and similar technologies

We use strictly necessary cookies to run and secure the site (for example, security and load balancing cookies set by our content delivery network, and form protection). With your consent where required, we also use analytics cookies to understand how visitors use the site. You can control cookies through your browser settings and, where offered, our cookie banner. Blocking some cookies may affect how the site works.

10. Security

We use reasonable technical and organizational measures to protect personal data, such as encrypted connections (HTTPS), access controls that limit data to people who need it, strong authentication on key systems, reputable hosting and security providers, and confidentiality obligations for our team. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify affected individuals and authorities where the law requires.

11. Children

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18 (or the age of majority in their country). If you believe a child has given us personal data, contact us and we will delete it.

12. Links to other sites

Our site may link to third-party websites and tools. Their privacy practices are governed by their own policies, and we are not responsible for them.

13. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date above, and where changes are significant we will give additional notice.

14. Contact

Questions or requests about this policy or your personal data: use our contact page. Registered office: No. 2179/1, 3rd Cross, Basaveshwara Road, KR Mohalla, Mysuru, Karnataka 570004, India. See also our terms and conditions.