Effective date: October 27, 2026
COMPANY NAME (‘we’, ‘us’, ‘our’) operates https://itsmazic.com/ (the ‘Site’) and provides the services described on it. This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights and choices you have under the privacy laws that apply to you. It covers the Site, our forms, emails, and any other way you deal with us online or offline in connection with the Site.
1. Who is responsible for your data
COMPANY NAME, Business Address, is the ‘controller’ under the EU GDPR and UK GDPR, the ‘business’ under California and other US state laws, the ‘organisation’ under Canadian, Australian and Singaporean law, and the ‘data fiduciary’ under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). You can contact us at dipanshu@itsmazic.com.
2. Information we collect
Information you give us. Name, email address, phone number, company, job title, the content of messages, forms, and files you send, survey answers, and, if you buy from us, billing and delivery details. Card payments are handled by our payment provider; we never see or store full card numbers. If the Site offers accounts, we also collect your username and password (stored in hashed form) and profile details.
Information collected automatically. IP address, device and browser type, operating system, language, screen size, pages viewed, links clicked, time on page, referring and exit pages, approximate location derived from your IP address, date and time of visits, and identifiers stored in cookies and similar technologies (see our Cookie Policy). If we use session-replay or heat-map tools, they may capture clicks, scrolls, and mouse movement, and form fields are masked.
Information from third parties. Analytics, advertising, and payment providers; business directories and public sources; referral partners; and, if you use a social sign-in or interact with our social media pages, the profile details you allow them to share.
Sensitive information. We do not intend to collect sensitive personal data (for example health, biometric, genetic, precise location, government ID, racial or ethnic origin, religion, sexual orientation, or financial account credentials). Please do not send it to us through the Site. If you do, you consent to us processing it only as needed to deal with your message, and we will delete it when no longer needed.
3. How we use your information and why
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Reply to enquiries, prepare quotes, and provide requested services | Contract, or steps taken at your request before a contract |
| Take payments, deliver orders, send invoices, keep accounting and tax records | Contract; legal obligation |
| Run, secure, debug, and improve the Site and prevent fraud or abuse | Legitimate interests |
| Measure traffic and performance | Consent where required by law; otherwise legitimate interests |
| Send marketing emails, run campaigns, and show tailored advertising | Consent, or legitimate interests where the law allows direct marketing |
| Customer support and relationship management | Contract; legitimate interests |
| Comply with law, respond to lawful requests, and establish or defend legal claims | Legal obligation; legitimate interests |
| Corporate transactions such as a merger or sale | Legitimate interests |
Under the DPDP Act we process personal data on the basis of your consent or for the ‘legitimate uses’ the Act permits, such as responding to your request, meeting legal obligations, and preventing fraud. Where we rely on consent, you may withdraw it at any time by contacting us. Withdrawal does not affect processing carried out before it. Where Canadian, Australian or other laws require consent, we obtain it expressly or by clear implication from your actions.
4. Cookies, tracking, and signals
We use cookies and similar technologies to keep the Site working, remember preferences, measure usage, and, where you agree, support marketing. Details and controls are in our Cookie Policy. We honor Global Privacy Control signals where the law requires. Because there is no common standard for ‘Do Not Track’ browser signals, we do not respond to them unless the law requires it.
5. Who we share information with
We share personal information only as needed with:
- service providers and processors acting on our instructions, such as hosting, email delivery, CRM, analytics, customer support, scheduling, and payment processing
- professional advisers such as lawyers, accountants, auditors, and insurers
- advertising and analytics partners, only as described below and only where you have not opted out
- authorities, regulators, courts, or other parties when the law requires it, or to protect rights, safety, or property, or to detect and prevent fraud
- a buyer, investor, or successor if we merge with, are acquired by, or sell part of our business, in which case this policy continues to protect your information unless you are told otherwise
Some analytics and advertising tools we use may count as ‘selling’ or ‘sharing’ personal information under US state privacy laws. You can opt out through the ‘Cookie settings’ link in our footer, by sending a Global Privacy Control signal, or by emailing dipanshu@itsmazic.com. We do not knowingly sell or share the personal information of anyone under 16.
6. International transfers
We and our providers may process data in countries other than your own, including countries whose data protection laws differ from yours. Where we transfer personal data out of the EEA, UK, or other regions that restrict transfers, we rely on safeguards such as an adequacy decision, the EU Standard Contractual Clauses with the UK Addendum or International Data Transfer Agreement, the EU-US Data Privacy Framework for certified recipients, or another lawful mechanism. You can ask us for a copy of the relevant safeguards at dipanshu@itsmazic.com. For personal data covered by the DPDP Act, we transfer data outside India except to any country the Indian Government restricts.
7. How long we keep information
| Data | Typical retention |
|---|---|
| Enquiries and contact-form messages | Retention Period after the last contact |
| Customer and invoice records | As long as tax and accounting law requires, typically up to 7 years |
| Marketing contacts | Until you unsubscribe, then a suppression record so we do not email you again |
| Analytics data | Up to 14 months |
| Server and security logs | Up to 12 months |
| Account data (if any) | While the account is open, then up to 6 months |
We may keep data longer where needed for legal claims, to meet legal duties, or if the law requires it. When we no longer need information, we delete or anonymize it.
8. Security and breaches
We use reasonable technical and organizational measures such as encryption in transit, access controls, backups, and regular updates. No online service is completely secure, so we cannot guarantee absolute security. If a breach is likely to put your rights at risk, we will notify the relevant authority within the time the law requires (for example within 72 hours under the GDPR and UK GDPR where feasible) and notify you where required.
9. Automated decisions and profiling
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
10. Your rights
Everyone may ask us to access, correct, or delete the personal information we hold about them, and may unsubscribe from marketing at any time.
- EEA and UK: you also have the right to restrict or object to processing, to data portability, to withdraw consent, and not to be subject to solely automated decisions. You may complain to your local supervisory authority, such as the UK Information Commissioner’s Office (ico.org.uk) or the authority listed by the European Data Protection Board (edpb.europa.eu).
- United States: residents of California and of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon) may, depending on the state, ask to know, access, correct, delete, and receive a portable copy of their information, opt out of sale, sharing, targeted advertising and profiling, and limit the use of sensitive information. We will not discriminate against you for using these rights. If we refuse a request, you may appeal by replying to our decision, and we will answer within the time your state’s law sets. If we deny your appeal, you may contact your state attorney general or, in California, the California Privacy Protection Agency (cppa.ca.gov). California residents may also ask which categories of personal information we shared with third parties for their direct marketing in the prior year (California ‘Shine the Light’ law). Nevada residents may submit an opt-out request about the sale of covered information to dipanshu@itsmazic.com.
- Canada: under PIPEDA and provincial laws such as Quebec’s Law 25, you may access and correct your information, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial regulator. Quebec residents may also ask for portability and for us to cease disseminating information about them where the law allows.
- Australia and New Zealand: under the Privacy Act 1988 and Australian Privacy Principles, or the NZ Privacy Act 2020, you may access and correct your information, and complain to us first and then to the Office of the Australian Information Commissioner (oaic.gov.au) or the NZ Privacy Commissioner.
- Brazil: under the LGPD you may confirm that we process your data, and request access, correction, anonymization, portability, deletion, information on sharing, and review of automated decisions.
- India: under the DPDP Act you may request a summary of your personal data and the parties we share it with, correction, completion, updating, and erasure, may use our grievance process below, may approach the Data Protection Board of India after exhausting our grievance process, and may nominate another person to exercise your rights on death or incapacity. Our handling of sensitive personal data also follows the Information Technology Act, 2000 and rules made under it.
- Singapore, South Africa, and elsewhere: you have the rights your local law gives you, including access, correction, withdrawal of consent, and complaint to the regulator (for example the PDPC in Singapore or the Information Regulator in South Africa).
11. How to use your rights
Email dipanshu@itsmazic.com. We may need to verify your identity, and we may ask for extra details if we cannot match your request. An authorized agent may submit a request for you with your signed permission. We respond within the time the law requires, generally one month (extendable by two under GDPR) or 45 days (extendable by 45 under US state laws). We do not charge a fee unless requests are manifestly unfounded, excessive, or repetitive, where the law allows. We may decline requests where the law permits, and will explain why.
12. Notice at collection (California and similar laws)
In the past 12 months we collected the categories below. We keep each as described in section 7, and use it for the purposes in section 3.
| Category | Examples | Collected | Disclosed to |
|---|---|---|---|
| Identifiers | Name, email, phone, IP address, online identifiers | Yes | Service providers, advisers |
| Customer records | Address, billing details | Yes | Service providers, payment provider |
| Commercial information | Orders, quotes, services purchased | Yes | Service providers, advisers |
| Internet or network activity | Pages viewed, clicks, referrer | Yes | Analytics and advertising partners |
| Geolocation | Approximate location from IP | Yes | Analytics partners |
| Professional information | Company, job title | Yes | Service providers |
| Inferences | Interests from browsing | Limited | Advertising partners |
| Sensitive personal information | Account login, payment details handled by our provider | Limited | Payment provider |
We use sensitive personal information only to provide the services you ask for and do not use it to infer characteristics about you.
13. Children
The Site is not directed to anyone under 18, and we do not knowingly collect personal information from children. We do not knowingly collect information from children under 13 (US COPPA), under 16 (where EU member states set that age for consent), or under 18 (India DPDP Act, which requires verifiable parental consent). If you believe a child has given us information, contact us and we will delete it.
14. Marketing communications
We send marketing emails only where you have agreed or where the law allows, and comply with CAN-SPAM (US), CASL (Canada), PECR (UK), and similar laws. Every message identifies us, includes our postal address, and includes a working unsubscribe link, which we honor within 10 business days. You can also write to dipanshu@itsmazic.com. Service messages, such as order confirmations and security notices, may still be sent. We send text messages only with your prior express consent; message and data rates may apply, and you can reply STOP to opt out.
15. Links, embeds, and social features
The Site may link to, or embed content from, third-party sites such as video players, maps, social media, and scheduling tools. These parties may collect data when you interact with them. We do not control them and are not responsible for their privacy practices, so please read their policies.
16. Changes to this policy
We may update this policy from time to time. The effective date above shows the latest version. If we make a material change, we will post a notice on the Site or contact you where the law requires, and will ask for fresh consent where needed. If a translation differs from the English version, the English version prevails to the extent the law allows.
17. Contact and grievances
COMPANY NAME
Business Address
Email: dipanshu@itsmazic.com
Grievance Officer (India): Dipanshu Kumar, contact@website.com. We acknowledge complaints within 7 days and aim to resolve them within 30 days.