Privacy Policy

1. Who We Are

Tractive Digital ("we", "us", or "our") is a digital marketing agency based in Nagpur, Maharashtra, India. Our website is www.tractivedigital.com and our primary contact email is hello@tractivedigital.com.

We are the data controller for personal information collected through this website and our marketing services. This Privacy Policy explains how we collect, use, share, and protect your personal data when you visit our website or engage with our services.

2. Information We Collect

Information you provide directly

When you complete a contact form, request an audit, or get in touch via email, we may collect:

• Your name and job title
• Business name and website URL
• Email address and phone number
• Information about your marketing activity, budget, and goals
• Any additional information you choose to share in a message

Information collected automatically

When you visit our website, we may automatically collect:

• IP address and approximate location (country/city level)
• Browser type, device type, and operating system
• Pages visited, time spent on pages, and referring URL
• Interaction data via Google Analytics 4

Information from third parties

If you contact us via LinkedIn or other social platforms, we may receive your name, profile information, and message content through those platforms in accordance with their own privacy policies.

3. How We Use Your Information

We use the personal data we collect for the following purposes:

• To respond to your enquiries and provide the services you have requested
• To conduct marketing audits and strategy sessions
• To send you relevant communications about our services (where you have consented or we have a legitimate interest)
• To improve our website and understand how visitors use it
• To comply with legal and regulatory obligations
• To protect the security and integrity of our systems

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects without your consent.

4. Legal Basis for Processing

Where applicable under GDPR and Indian data protection law (DPDPA 2023), we process your personal data on the following legal bases:

• Contract: Processing necessary to fulfil a contract you have entered into with us, or to take steps before entering into one.
• Legitimate interests: Processing necessary for our legitimate business interests, such as responding to enquiries and improving our services, where these interests are not overridden by your rights.
• Consent: Where you have given us clear consent to process your data for a specific purpose, such as receiving marketing communications.
• Legal obligation: Processing required by law or regulatory requirement.

5. Sharing Your Information

We do not sell, rent, or trade your personal data. We may share your information with:

• Service providers: Third-party tools we use to operate our business, including Google Analytics, email service providers, and cloud infrastructure providers. These providers are contractually required to protect your data and use it only for specified purposes.
• Professional advisors: Lawyers, accountants, or other advisors where necessary and under appropriate confidentiality obligations.
• Legal authorities: Where required to comply with applicable law, a court order, or valid legal process.

Any third parties we work with are required to handle your data securely and in accordance with applicable data protection law.

6. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your experience and understand how our site is used. The categories of cookies we use include:

• Essential cookies: Required for the website to function correctly. These cannot be disabled.
• Analytics cookies: Used to collect information about how visitors use our site (via Google Analytics 4). This data is aggregated and anonymous where possible.
• Marketing cookies: Where applicable, used to track visitors across websites for advertising purposes (e.g. Google Ads remarketing tags).

You can control cookie preferences through your browser settings. Disabling certain cookies may affect your experience on our site. Where required by law, we will obtain your consent before placing non-essential cookies.

7. Google Ads API and Software Tool Data

Tractive Digital uses the Google Ads API to provide campaign management, optimisation, and reporting services to clients on behalf of their Google Ads accounts. This section explains how we handle data accessed through the Google Ads API.

7.1 Data Accessed via Google Ads API

When a client grants Tractive Digital access to their Google Ads account, we may access the following data via the Google Ads API on their behalf:

• Campaign performance data (impressions, clicks, conversions, spend)
• Keyword and search term reports
• Ad copy, creative assets, and audience configurations
• Bidding strategies and budget settings
• Account structure (campaigns, ad groups, ads)
• Conversion tracking configuration and data
• Audience lists and remarketing data

7.2 How We Use Google Ads API Data

Data accessed via the Google Ads API is used exclusively for the following purposes:

• Campaign management: Creating, modifying, pausing, and optimising campaigns on behalf of clients who have expressly authorised us to do so.
• Performance analysis: Analysing campaign data to identify optimisation opportunities, anomalies, and performance trends using our Tractive.AI platform.
• Reporting: Generating performance reports and dashboards for clients that summarise campaign results and insights.
• Account auditing: Reviewing account structure and historical performance to identify inefficiencies and improvement opportunities.

We do not use Google Ads API data for any purpose beyond the direct management and reporting services we provide to the client whose account data it belongs to. We do not sell, transfer, or use Google Ads data for our own advertising purposes or share it with any third party not involved in providing the contracted service.

7.3 OAuth 2.0 Authentication and Authorisation

Access to client Google Ads accounts is granted exclusively through Google's OAuth 2.0 authorisation protocol. Clients grant access by authenticating directly with Google. We do not collect, store, or have access to Google account passwords. Access tokens obtained via OAuth are stored securely and used only to perform the agreed campaign management activities. Clients may revoke access at any time by visiting their Google Account security settings at myaccount.google.com/permissions.

7.4 Data Storage and Security for API Data

Google Ads data accessed via the API is processed within our Tractive.AI platform and stored on secure, access-controlled infrastructure. We implement the following measures to protect this data:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls ensuring only authorised team members access client data
• Regular security reviews and access audits
• Contractual data processing agreements with all sub-processors

7.5 Retention of Google Ads API Data

Campaign data accessed via the Google Ads API is retained for the duration of the client engagement and for up to 24 months following contract termination, to support reporting, account continuity, and dispute resolution. Upon written request, client data can be deleted earlier. Raw API data is not retained beyond 36 months under any circumstances.

7.6 Compliance with Google API Services User Data Policy

Our use of data obtained via Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google APIs is used only to provide and improve our campaign management services, is not transferred to third parties except as necessary to provide those services, is not used for serving advertisements, and is not used to determine creditworthiness or for lending purposes.

12. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes set out in this policy, unless a longer retention period is required or permitted by law.

• Enquiry and contact form data is retained for up to 3 years from the date of last contact.
• Client data related to active engagements is retained for the duration of the engagement and for up to 5 years thereafter for accounting and legal purposes.
• Website analytics data is retained per Google Analytics 4 default settings (14 months for user-level data).

When data is no longer required, we will securely delete or anonymise it.

12. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Right of access: To request a copy of the personal data we hold about you.
• Right to rectification: To request correction of inaccurate or incomplete data.
• Right to erasure: To request deletion of your personal data in certain circumstances.
• Right to restrict processing: To ask us to limit how we use your data in certain circumstances.
• Right to data portability: To receive your data in a structured, machine-readable format.
• Right to object: To object to our processing of your data based on legitimate interests or for direct marketing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at hello@tractivedigital.com. We will respond within 30 days. We may need to verify your identity before processing your request.

12. International Data Transfers

Tractive Digital is based in India. If you are located outside India, please be aware that your information may be transferred to and processed in India or other countries where our service providers operate. We take appropriate steps to ensure that any such transfers comply with applicable data protection law and that your data is adequately protected.

For individuals in the European Economic Area (EEA) or UK, we rely on appropriate safeguards (such as Standard Contractual Clauses) where required for international data transfers.

12. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These measures include secure communication channels (HTTPS), access controls, and regular review of our data practices.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify relevant authorities and affected individuals as required by law.

12. Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will take steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Your continued use of our website after any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: