Privacy policy

1. Who we are

ArPr Group ("ARPR", "we", "us") is a performance marketing and revenue growth firm based in India. For the purposes of this policy we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023, and the data controller for visitors in jurisdictions that use that term.

2. What we collect

Three kinds of data, and nothing else.

a. What you give us

We ask for work contact details, not personal ones. Please do not send us government ID numbers, card or bank account numbers, health information, or anyone's sensitive personal data — we do not need them and we do not want to hold them.

b. What we collect automatically

• Technical data — IP address, browser and version, operating system, device type, screen size, language and time zone.
• Usage data — pages viewed, time on page, scroll depth, which links and buttons you click, the page that referred you, and search or campaign parameters in the URL.
• Server logs — request time, URL requested, response status, and user agent, kept for security and debugging.

c. What we get from others

• Advertising and analytics platforms — aggregated campaign and audience reporting. This tells us a campaign worked; it does not identify you to us by name.
• Business data providers and public sources — company size, sector, technology stack and publicly listed business contact details, used to qualify and research prospective clients.
• Referrals — your name and work contact details if a client or partner introduces you.

3. The revenue assessment

The assessment on our site asks you to set a handful of sliders and then shows an estimated range of revenue being lost between traffic and transaction. Because it sits behind an email step, it deserves its own explanation.

• What we store. Your email address, the values you set, the estimate generated, and the date. Nothing more.
• What we do with it. We send you the result if you ask for it, and we may contact you once or twice about what the numbers suggest. Every message has a one-click unsubscribe, and unsubscribing does not remove your access to anything.
• What it is not. The output is an illustrative estimate built from your own inputs and published benchmarks. It is not a forecast, an audit, a valuation or a promise, and we do not verify what you enter. The Terms and conditions set this out in full.
• You can skip it. Email enquiry@arprconsulting.com and we will run the same assessment for you by email without creating a record on the site.

4. Why we use it, and on what basis

Under the DPDP Act our processing rests on your consent or on certain legitimate uses the Act specifies. Under the GDPR and UK GDPR, where it applies to you, the equivalent legal bases are set out below.

We do not use your data for anything incompatible with the purpose you gave it for, and we do not make you consent to marketing in order to get something else. Where consent is the basis, you can withdraw it at any time and it is as easy to withdraw as it was to give.

5. Cookies and tracking

This site uses the cookie categories set out below. Essential cookies cannot be switched off because the site does not work without them. You can block or delete any cookie through your browser settings at any time, and you can opt out of our advertising measurement by writing to enquiry@arprconsulting.com.

The third-party tools we may run in the analytics and advertising categories include Google Analytics, Google Ads, Meta, LinkedIn and Microsoft advertising tags. Each has its own privacy notice.

6. Who we share it with

We share personal data with service providers who process it on our instructions, under contract, and only for the purpose we give them. We do not sell personal data, we do not rent mailing lists, and we do not disclose your data to anyone for their own marketing.

A current, named list of our processors is available on request from enquiry@arprconsulting.com.

7. Where data goes

We work with clients in several regions and some of our service providers operate outside India. Your data may therefore be processed outside the country where you are.

• From India. The DPDP Act permits transfer outside India except to territories the Central Government restricts. We check that list and do not transfer to a restricted territory.
• From the EEA or the UK. We rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses or the UK Addendum, with a transfer risk assessment on file.
• From Australia. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, as APP 8 requires.

8. How long we keep it

We keep personal data only as long as the purpose needs, then delete or irreversibly anonymise it.

If you withdraw consent, we delete the data held on that basis unless a law requires us to keep it — in which case we tell you which law and for how long.

9. Your rights

Which rights you have depends on where you are. We apply the strongest set we reasonably can to everyone, so in practice most of these are available to you regardless.

If you are in India — Digital Personal Data Protection Act, 2023

• Access a summary of the personal data we process and what we do with it, and the identities of anyone we have shared it with.
• Correction, completion and updating of data that is wrong or incomplete, and erasure where the purpose is served or you withdraw consent.
• Grievance redressal — a response from us before you go to the Data Protection Board of India.
• Nomination — name another person to exercise these rights for you if you die or become incapacitated.
• Withdraw consent at any time, as easily as you gave it.

The Act and the Digital Personal Data Protection Rules, 2025 are being brought into force in phases, with the substantive obligations on Data Fiduciaries commencing 13 May 2027. We are not waiting for that date to honour these rights.

If you are in the EEA or the UK — GDPR

• Access, rectification and erasure
• Restriction of processing, and objection to processing based on legitimate interests
• Objection to direct marketing, which we always honour without question
• Portability of data you gave us, in a machine-readable form
• Withdrawal of consent, and the right not to be subject to a solely automated decision with legal or similarly significant effect
• Complaint to your supervisory authority, or to the Information Commissioner's Office in the UK

If you are in Australia — Privacy Act 1988 and the Australian Privacy Principles

• Access the personal information we hold about you, and ask us to correct it
• Deal with us anonymously or under a pseudonym where it is lawful and practicable
• Opt out of direct marketing, and ask us where we got your information
• Complain to us, and then to the Office of the Australian Information Commissioner

If you are in California or another US state with a privacy statute

• Know what we collect, use, disclose and share, and get a copy of it
• Delete it, and correct it
• Opt out of sale or of sharing for cross-context behavioural advertising — we do not sell personal information and have not in the preceding 12 months
• Limit the use of sensitive personal information — we do not collect it for the purposes that trigger this right
• Not be discriminated against for exercising any of these, which we do not do
• Use an authorised agent, who will need written proof of authority

10. How to exercise them

Email enquiry@arprconsulting.com with what you want. You do not need a form, a template or a reason.

• We may need to confirm who you are before we act, and we will ask for the minimum that achieves that.
• If we cannot do what you ask, we tell you why and what your options are, including how to escalate.
• Escalation. In India, to the Data Protection Board of India. In the EEA or UK, to your supervisory authority. In Australia, to the Office of the Australian Information Commissioner. We will not obstruct you, and nothing here is a precondition to going to a regulator.

11. Children

This is a business-to-business site. It is not directed at children, we do not knowingly collect data from anyone under 18, and we ask that they do not submit any.

Under the DPDP Act, processing a child's personal data requires verifiable parental consent, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited. We do not do any of these. We do not knowingly build advertising audiences that include children, and the audience targeting we run for ourselves and for clients excludes under-18 segments. If you believe a child has given us personal data, email enquiry@arprconsulting.com and we will delete it.

12. Security

We take reasonable technical and organisational measures proportionate to what we hold:

• Encryption in transit over TLS, and at rest where the platform supports it
• Access on a need-to-know basis, with multi-factor authentication on every account that touches personal data
• Least-privilege access to client advertising and analytics platforms, reviewed when anyone's role changes and revoked when an engagement ends
• Written confidentiality obligations on everyone working with us, employees and contractors alike
• Processor due diligence and contractual data protection terms before any tool goes live
• Logging, monitoring and a documented incident response procedure

No system is perfectly secure, and we will not pretend otherwise. What we can commit to is that we do not collect what we do not need, which is the only control that never fails.

13. If something goes wrong

If a personal data breach occurs, we will:

1. Notify the Data Protection Board of India without delay on becoming aware of it, and provide the follow-up report the DPDP Rules require within 72 hours.
2. Notify you directly, in plain language, telling you what happened, what data was involved, what we have done, and what you should do.
3. Notify any other regulator with jurisdiction, including the OAIC under the Notifiable Data Breaches scheme and the relevant EEA or UK supervisory authority within 72 hours where that applies.

14. Automated decisions

The revenue assessment produces an estimate by arithmetic on the figures you enter. It does not profile you, score you, or decide anything about you.

We do not make decisions about you by solely automated means that have a legal or similarly significant effect. We do use automated systems — bid management, audience modelling and creative optimisation — to run advertising campaigns. These decide which advertisement to show, not anything about your rights, access to a service, or the terms you are offered. Where the Australian Privacy Principles require disclosure of computer-assisted decision-making from 10 December 2026, this section is that disclosure, and we will expand it if our use ever changes.

15. Data we handle for clients

When we run marketing, analytics or conversion work for a client, we usually process personal data on that client's instructions. In that relationship the client is the Data Fiduciary or controller and we are the Data Processor. Our processing is governed by the data protection terms in that engagement, not by this policy.

If you are a customer of one of our clients and want to exercise rights over your data, contact that company — they decide, and we are required to act on their instruction. If you are not sure who to contact, write to us and we will route it rather than leave you stuck.

16. Changes to this policy

We update this policy when what we do changes, or when the law does. The effective date at the top always tells you which version you are reading, and we keep the previous version available on request.

If a change materially affects how we use data you have already given us, we will tell you directly before it takes effect — by email where we have your address — and where consent is the basis, we will ask again rather than assume.

This policy sits alongside our Terms and conditions and our Accessibility statement.