Tomatotree Digital Pvt Ltd (“Tomatotree Digital”, “we”, “our”, or “us”) is a full-stack digital marketing agency incorporated in Kerala, India, and incubated at Kerala Startup Mission (KSITIL), Kochi. We provide SEO, AEO, GEO, Local SEO, Social Media Marketing, Performance Marketing, Content Marketing, and related digital growth services to businesses of all sizes.

This Privacy Policy explains how we collect, use, disclose, store, and protect information about you when you:

• Visit our website at https://tomatotreedigital.com
• Contact us through our website forms, email, or phone
• Engage us for any of our services
• Subscribe to our newsletters, blogs, or marketing communications
• Interact with us on social media platforms

By using our website or services, you consent to the practices described in this Privacy Policy. If you do not agree, please discontinue use of our website and services.

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information you voluntarily submit, including:

• Full name and business name
• Email address and phone number
• Company website URL and industry type
• Business address and location details
• Project requirements, goals, and budget range
• Payment and billing information (processed securely via third-party payment gateways)
• Communications, messages, and attachments you send us

2.2 Information Collected Automatically

When you visit our website, we automatically collect technical data, including:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Pages visited, time spent, and navigation paths
• Referring URLs and exit pages
• Device identifiers and screen resolution
• Cookies, pixel tags, and similar tracking technologies

2.3 Information From Third-Party Sources

We may receive information about you from:

• Google Analytics, Google Search Console, and Google Ads platforms
• Meta Business Suite (Facebook & Instagram)
• LinkedIn Campaign Manager and other social platforms
• CRM and marketing automation tools we use internally
• Public business directories and LinkedIn profiles (for prospecting with legitimate interest)

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery

• To deliver, manage, and improve the digital marketing services you have engaged us for
• To create and manage your client account and project files
• To communicate project updates, reports, and performance insights
• To process payments and send invoices

3.2 Business Operations

• To respond to enquiries, proposals, and support requests
• To conduct onboarding, strategy sessions, and performance reviews
• To fulfil legal, contractual, and regulatory obligations

3.3 Marketing and Communications

• To send you newsletters, case studies, industry insights, and promotional content (with your consent)
• To run retargeting and remarketing campaigns on Google and Meta platforms
• To personalise content recommendations and service offers based on your interests

3.4 Analytics and Improvement

• To analyse website traffic, user behaviour, and campaign performance
• To conduct A/B testing, CRO experiments, and UX improvements
• To improve our service quality, internal workflows, and reporting systems

3.5 Legal and Compliance

• To comply with applicable Indian laws and regulations
• To detect, prevent, and investigate fraud, abuse, or security incidents
• To enforce our Terms of Service and contractual obligations

4. Legal Basis for Processing

We process your personal data under the following lawful bases:

• Contractual Necessity — to perform services under an engagement or proposal
• Legitimate Interests — to operate, grow, and improve our business, provided these interests are not overridden by your rights
• Consent — for marketing communications and non-essential cookies (you may withdraw consent at any time)
• Legal Obligation — to comply with Indian laws, tax regulations, and court orders

5. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your experience. We use:

5.1 Types of Cookies We Use

• Essential Cookies — required for website functionality and security
• Analytics Cookies — to understand how visitors use our site (e.g., Google Analytics GA4)
• Marketing Cookies — to serve relevant advertisements and track campaign performance (e.g., Google Ads, Meta Pixel)
• Preference Cookies — to remember your settings and personalise your experience

5.2 Managing Cookies

You can manage or disable cookies through your browser settings. Note that disabling certain cookies may affect website functionality. To opt out of Google Analytics tracking, visit: https://tools.google.com/dlpage/gaoptout

6. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We may share your information in the following limited circumstances:

6.1 Service Providers and Technology Partners

We work with trusted third-party vendors who process data on our behalf, including:

• Google LLC — for Google Analytics, Google Ads, Google Search Console, and Google Workspace
• Meta Platforms, Inc. — for Facebook/Instagram advertising and analytics
• Payment gateway providers — for secure billing and invoice processing
• Cloud hosting and website infrastructure providers
• CRM, project management, and reporting software providers

All third-party processors are contractually required to handle your data in accordance with applicable privacy laws.

6.2 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

6.3 Legal Requirements

We may disclose your information if required to do so by applicable law, court order, government authority, or to protect the rights, property, or safety of Tomatotree Digital, our clients, or the public.

7. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required by law.

• Client project data and communications — retained for a minimum of 5 years from project completion for legal and audit purposes
• Financial and billing records — retained for 7 years as required under Indian taxation and accounting laws
• Marketing and newsletter subscribers — retained until you unsubscribe or request deletion
• Website analytics data — retained for up to 26 months in Google Analytics (GA4 default)
• Job applicant data — retained for 12 months if not hired, then securely deleted

When data is no longer required, we securely delete or anonymise it.

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted through our website
• Secure access controls and role-based permissions for internal systems
• Regular security audits and vulnerability assessments
• Two-factor authentication on all administrative tools and platforms
• Confidentiality agreements with all employees and contractors

While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security and are not responsible for breaches outside our reasonable control.

9. Your Rights and Choices

Subject to applicable law, you have the following rights regarding your personal information:

• Right to Access — request a copy of the personal data we hold about you
• Right to Rectification — request correction of inaccurate or incomplete data
• Right to Erasure — request deletion of your personal data, subject to legal obligations
• Right to Restrict Processing — request that we limit how we use your data
• Right to Data Portability — request transfer of your data in a machine-readable format
• Right to Object — object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at: [email protected]. We will respond within 30 days of receiving your request. We may need to verify your identity before processing your request.

10. Children’s Privacy

Our website and services are intended for business professionals and are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a child, please contact us immediately at [email protected] and we will delete such information promptly.

11. Third-Party Links and Integrations

Our website may contain links to third-party websites, social media platforms, or integrated tools (e.g., Google Analytics, Meta Pixel, LinkedIn Insight Tag). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you use through our website or that we reference in our content.

12. International Data Transfers

Tomatotree Digital is based in Kochi, Kerala, India. When you interact with us, your data may be processed in India or transferred to countries where our third-party service providers operate, including the United States (Google, Meta) and the European Union.

Where data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses or reliance on the provider’s certifications under applicable data protection frameworks.

13. Digital Marketing Data Practices

As a digital marketing agency, we operate advertising and analytics tools on behalf of our clients. When we manage campaigns for clients, we process end-user data strictly as a data processor under our client’s instructions. Specific disclosures:

13.1 Google Ads and Analytics

We use Google Ads and Google Analytics on our website and within client accounts. Google may collect data in accordance with Google’s own Privacy Policy. We have enabled data minimisation features including IP anonymisation where applicable. You may opt out of personalised Google advertising at: https://adssettings.google.com

13.2 Meta (Facebook & Instagram) Advertising

We use the Meta Pixel on our website to measure ad performance and build custom audiences. Meta processes this data in accordance with Meta’s Data Policy. You can manage your Facebook advertising preferences at: https://www.facebook.com/ads/preferences

13.3 Remarketing

We may use remarketing lists to show targeted ads to visitors who have previously visited our website. These campaigns are managed through Google Ads and Meta Ads Manager. To opt out of remarketing, you can adjust your settings on the respective platforms or use browser extensions to disable interest-based advertising.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy
• Post the revised policy on our website at https://tomatotreedigital.com/privacy-policy
• Notify registered clients or newsletter subscribers by email where required

We encourage you to review this Privacy Policy periodically. Continued use of our website or services after any changes constitutes your acceptance of the updated policy.

15. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and any successor legislation including the Digital Personal Data Protection Act, 2023 (DPDPA) as and when it comes into full force.

Any disputes arising under or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts in Kochi, Kerala, India.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer:

Tomatotree Digital Pvt Ltd

Kerala Startup Mission

Kerala Technology Innovation Zone, Kinfra Hi-Tech Park Main Rd

HMT Colony, P.O, Kalamassery, Kochi, Kerala – 683503, India

Email: [email protected]

Phone: +91 92071 04345

Website: https://tomatotreedigital.com