Who We Are
Candid Digital is a full-service digital marketing agency based in India. We work with B2B technology companies, local businesses, and B2C lifestyle brands, providing SEO, paid advertising, marketing automation, software development, website development, and content strategy services.
What Information We Collect
2.1 Information You Provide Directly
- Your name, email address, phone number, and business name
- Billing and payment information (processed securely through authorised payment gateways)
- Project briefs, business goals, and requirements
- Login credentials and account access details for platforms you authorise us to manage
- Files, documents, and media you share with us for project purposes
2.2 Information We Collect Automatically
- IP address, browser type, and device details
- Pages visited and time spent on our website
- Referring website or traffic source
- Cookies and similar tracking technologies
2.3 Information from Third-Party Platforms
When you authorise us to access your accounts on platforms such as Google, Meta, or LinkedIn, we may receive data from those platforms as part of delivering our Services. We access only what is strictly necessary.
Why We Collect This Information
We use your information to:
- Deliver the Services you have engaged us for
- Manage and operate digital accounts and platforms on your behalf
- Communicate with you about projects, reports, and results
- Issue invoices and process payments
- Improve the quality and efficiency of our Services
- Comply with legal obligations under Indian law and applicable international regulations
We do not sell your personal data to third parties. Ever.
Account Access & Credentials
A core part of our work involves managing digital platforms on your behalf, which may include Google Ads, Google Analytics, Meta Ads Manager, Google Merchant Center, your CMS, email marketing platforms, and social media accounts.
How we handle your access:
- Credentials are stored securely and shared only with authorised team members assigned to your project
- We request the minimum level of access needed to complete the agreed scope of work
- Upon project closure, we remove our access and return full control to you
- Your accounts are never accessed for any purpose outside the agreed scope of work
Who We Share Your Information With
We do not sell or rent your data. We may share your information only in the following circumstances:
- Service providers: Third-party platforms such as Google Workspace, payment processors, and project management software may process data on our behalf under strict confidentiality obligations.
- Legal requirements: Where required by law, court order, or a government authority.
- Business transfers: In the event of a merger or acquisition, with advance notice.
- With your consent: Any sharing beyond the above will only occur with your explicit written permission.
Data Retention
| Data Type | Retention Period |
|---|---|
| Project files and communications | Duration of engagement + 2 years |
| Payment and billing records | 7 years (Indian tax law) |
| Account credentials | Deleted within 30 days of project closure |
| Website analytics data | Up to 24 months |
| Marketing communications | Until you unsubscribe |
Data Security
We implement reasonable technical and organisational measures to protect your information, including:
- Encrypted storage for sensitive credentials and access details
- Role-based access controls within our internal team
- Regular internal security reviews and process audits
- Secure communication channels for sharing account access
In the event of a data breach, we will notify affected parties and the relevant authority as required under the DPDP Act.
Your Rights
- Access: Request a copy of the personal data we hold about you.
- Correction: Ask us to correct inaccurate or incomplete information.
- Deletion: Request erasure of your data, subject to legal retention obligations.
- Objection: Object to the use of your data for direct marketing purposes.
- Portability: Request your data in a structured, machine-readable format.
- Withdrawal of Consent: Withdraw consent for data processing at any time.
To exercise any of these rights, email [email protected]. We will acknowledge within 48 hours and resolve within 30 days.
Children's Privacy
Our Services are intended for businesses and individuals aged 18 and above. We do not knowingly collect personal data from minors. If you believe a minor has submitted information to us, please contact us immediately.
Grievance Officer
For grievances under the Information Technology Act, 2000 and the DPDP Act, 2023, our designated Grievance Officer can be reached at:
We will acknowledge your complaint within 48 hours and resolve it within 30 days.