The short version
- This website sets no cookies and runs no analytics, advertising or tracking scripts.
- We collect only what you send us (emails, enquiries, contract and billing details) and what our server needs to run (basic request logs).
- We never sell personal data and never use it to advertise to you.
- You can ask to see, correct or delete your data at any time by writing to our Grievance Officer. We reply within 30 days.
- If we can't resolve a complaint, you can take it to the Data Protection Board of India.
1. Who we are
"Wolke Systems", "we", "us" and "our" mean Wolke Systems, an independent studio based in Patna, Bihar, India, that plans, produces and runs paid advertising campaigns and builds campaign-management software. We operate the website at wolkesystems.in.
For personal data we collect for our own purposes — from website visitors, people who write to us, and our clients' staff — we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For personal data we handle only on a client's instructions, such as leads generated by a client's campaign, the client is the Data Fiduciary and we act as its Data Processor (see section 13).
"Personal data" means any data about an individual who can be identified by or in relation to that data. "You" means the individual the data is about (the "Data Principal").
2. What we collect
When you visit the website
- Server request logs. Like every web server, ours records each request: your IP address, the date and time, the page requested, the response code, the referring page, and your browser's user-agent string. We do not combine these logs with any other data to identify you.
- Font requests. Our pages load typefaces from Google Fonts. Your browser therefore connects to Google's servers, which receive your IP address and user-agent. Google states that it does not use Google Fonts requests to build profiles or target ads. See Google Fonts privacy FAQ.
We do not use cookies, pixels, fingerprinting, session recording, or analytics tools on this website.
When you write to us
- Your name, email address, and anything you choose to include in your message or attachments (for example your business name, role, phone number, website, or ad-account history).
When you become a client
- Names, work email addresses, phone numbers and roles of your team members who work with us.
- Billing details: legal business name, billing address, GSTIN, PAN where required for tax, and records of invoices and payments. Payments are made by bank transfer or UPI; we do not collect or store card numbers, CVVs, UPI PINs or net-banking passwords.
- Records of our communications, approvals and meeting notes needed to run the engagement.
When you use our campaign platform
- Login details for the platform (email address and a securely hashed password, or a sign-in token from your identity provider).
- When you connect an advertising account (for example Meta or Google), the ad network's official login gives us an access token. We never see or store your password for that network.
- Campaign data read through that token: account and campaign names, budgets, ad creative, spend and performance figures.
- Product material you upload so we can generate creative (images, video, copy, product descriptions).
- Basic technical logs of platform activity (sign-ins, actions taken, errors) for security and troubleshooting.
What we do not collect
We do not ask for, and ask you not to send us, sensitive personal data such as biometric data, health or medical information, sexual orientation, financial account passwords, or government ID numbers beyond what tax law requires. If such data reaches us by mistake, we delete it.
3. Why we use it
| Purpose | Data used | Lawful basis (DPDP Act) |
|---|---|---|
| Serve the website securely, prevent abuse, diagnose faults | Server request logs | Legitimate use — security and compliance with law, including CERT-In directions (s. 7) |
| Reply to your enquiry and continue the conversation | Name, email, message | Voluntarily provided for that purpose (s. 7(a)), or your consent (s. 6) |
| Deliver contracted services: audits, campaigns, creative, reporting | Client contact details, ad-account data, uploaded material | Consent given when you engage us and connect accounts (s. 6); voluntarily provided (s. 7(a)) |
| Invoice, collect payment, file GST and income-tax returns | Billing and payment records | Compliance with law (s. 7(c)–(d)) and voluntarily provided (s. 7(a)) |
| Operate and secure the campaign platform | Platform account, tokens, activity logs | Consent (s. 6); security and compliance with law (s. 7) |
| Respond to legal requests, enforce our terms, defend claims | Only what is relevant | Compliance with law and court orders (s. 7(c)–(e)) |
We do not use your personal data for profiling, automated decisions that affect you, marketing to you, or training general-purpose AI models. We will not use it for any new purpose without telling you first and, where the law requires, asking for your consent.
4. Consent and withdrawal
Where we rely on consent, it is free, specific, informed, unconditional and limited to the purpose stated. You can withdraw consent at any time, as easily as you gave it — by emailing privacy@wolkesystems.in or, for the platform, by disconnecting your ad account in its settings or revoking our app's access in the ad network's own settings.
Withdrawal does not affect processing already done. Once you withdraw, we (and any processor acting for us) stop processing within a reasonable time, unless the law requires us to keep the data. If withdrawal means we can no longer provide a service, we will tell you.
7. Transfers outside India
Some of the services we use, such as Meta, Google and certain creative-generation tools, process data on servers outside India. Section 16 of the DPDP Act allows transfers to any country except those the Central Government restricts by notification. We will not transfer personal data to any restricted country, and we will follow any conditions the Government sets for transfers.
8. How long we keep it
We keep personal data only as long as the purpose needs it, or as long as a law requires, and then delete it.
| Data | How long |
|---|---|
| Website server logs | Up to 180 days, in line with CERT-In directions under section 70B of the IT Act; longer only if needed to investigate a specific security incident. |
| Enquiry emails that do not lead to an engagement | 12 months after the last message, then deleted. |
| Client communications and project records | For the engagement, then 3 years after it ends, to deal with questions or disputes. |
| Invoices, payment and tax records | 8 years from the end of the relevant financial year, as required by the Central Goods and Services Tax Act, 2017 and the Income-tax Act. |
| Ad-network access tokens | Deleted as soon as you disconnect the account, revoke access, or the engagement ends. |
| Uploaded product material and generated creative | For the engagement, then deleted within 90 days of it ending unless you ask us to keep it. |
| Platform security and activity logs | At least 1 year, as the DPDP Rules, 2025 require for logs of personal-data processing. |
If you have not engaged with us for the period set for a purpose, we will treat that purpose as no longer being served and erase the data. Where the DPDP Rules require it, we will tell you at least 48 hours before erasure so you can sign in or contact us if you want it kept.
9. Security and breaches
We follow reasonable security practices as required by section 8(5) of the DPDP Act and Rule 8 of the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. In practice:
- All traffic to our website and platform is encrypted with TLS (HTTPS).
- Access tokens and passwords are stored encrypted or hashed, never in plain text.
- Access to client data is limited to the people working on that account, with individual logins.
- Servers are kept patched, firewalled, and backed up; access is logged.
No system is perfectly secure. If a personal data breach happens, we will inform affected people without delay, in plain language, describing what happened, the likely consequences, what we are doing about it, and what you can do to protect yourself. We will report it to the Data Protection Board of India and, where applicable, to CERT-In (which requires reports within 6 hours of noticing certain incidents), within the time the law sets.
10. Your rights
Under sections 11 to 14 of the DPDP Act you have the right to:
- Access — a summary of the personal data we hold about you, how we process it, and the identities of the other fiduciaries and processors we have shared it with, with a description of what was shared.
- Correction, completion and updating of inaccurate or incomplete data.
- Erasure of data no longer needed, unless the law requires us to keep it.
- Grievance redressal — a timely response to any complaint about how we handle your data.
- Nomination — to name another person to exercise these rights for you if you die or become incapable.
To use any of these rights, write to the Grievance Officer (section 14). For step-by-step deletion instructions, including for connected Meta and WhatsApp accounts, see our data deletion guide. We may ask for reasonable proof of identity before acting, so that we don't hand your data to someone else. We do not charge for requests.
If you are not satisfied with our response, you may complain to the Data Protection Board of India. Under section 13(3) of the DPDP Act, you should first use our grievance process.
11. Your duties
Section 15 of the DPDP Act asks Data Principals not to impersonate anyone, not to suppress material information, not to file false or frivolous complaints, and to give only verifiably authentic information when asking for correction or erasure. Breaching these duties can attract a penalty of up to ₹10,000 under the Act.
12. Children
Our website and services are meant for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If a child has sent us personal data without the verifiable consent of a parent or lawful guardian, as required by section 9 of the DPDP Act, please tell us and we will delete it. We do not track, behaviourally monitor, or target advertising at children, and we will not run campaigns for clients that do.
13. Data we process for clients
When we run campaigns, build landing pages, or connect lead forms to a CRM for a client, the people who respond (leads, customers) share data with that client. The client decides why and how that data is used and is the Data Fiduciary. We process it only on the client's documented instructions, only for that client, and we do not use it for ourselves or for any other client.
Clients are responsible for giving those individuals a proper privacy notice and obtaining any consent required — including on landing pages and lead forms we build for them. If you are one of those individuals and want to exercise your rights, please contact the business you dealt with; if you contact us instead, we will pass your request on to them promptly.
14. Grievance Officer
In line with section 8(10) of the DPDP Act and Rule 5(9) of the SPDI Rules, 2011, we have appointed a Grievance Officer who also answers questions about this policy and requests to exercise your rights.
[Name of Grievance Officer], Grievance Officer
Wolke Systems
[Registered address], Patna, Bihar [PIN], India
Email: privacy@wolkesystems.in
Hours: Monday to Friday, 10:00–18:00 IST
We acknowledge every grievance within 48 hours and resolve it within 30 days of receipt — within the one-month limit of the SPDI Rules and well within the 90-day outer limit set by the DPDP Rules, 2025. If we need more time for a complex request, we will tell you why and when to expect an answer.
15. Changes to this policy
We will update this policy when our practices or the law change — including as the remaining provisions of the DPDP Rules, 2025 come into force. The date at the top shows when it last changed. If a change materially affects how we use your data, we will tell our clients and platform users by email before it takes effect.
This policy is published in English. If you need it explained in Hindi or any language in the Eighth Schedule to the Constitution, write to us and we will provide it.