Privacy
Policy.

1. Identity of the controller

1.1 Anteomnio Marketing (OPC) Private Limited, a company incorporated in India under Corporate Identity Number U74999WB2019OPC230142, whose registered office is at 6 MM Feeder Road, Ariadaha, Kolkata, West Bengal 700057, India, is the controller of the personal data described in this policy. In this policy, we, us and our mean that company, and you means the individual to whom the personal data relates.

1.2 Our Grievance Officer for the purposes of the Digital Personal Data Protection Act 2023 is Suman Banerjee, who may be contacted at legal@anteomnio.com. The same address is the point of contact for any matter arising under any other data protection law.

1.3 We have not appointed a representative in the European Union or the United Kingdom. Nothing in this policy is to be construed as a representation that we have an establishment in either territory.

2. Scope of this policy

2.1 This policy applies to personal data processed in connection with this website, the contact and booking forms, correspondence with us, and the client portal at portal.anteomnio.com. Clause 12 additionally describes our processing of personal data held within systems we build or operate for clients.

2.2 This policy does not apply to a website or system built by us and handed over to a client, or otherwise operated under a client's control. Each of those is controlled by that client and is governed by that client's own privacy policy, and we have no responsibility for it.

2.3 This policy is incorporated into our Terms and Conditions by clause 2.3 of those Terms.

3. Controller and processor

3.1 This policy describes two distinct relationships. The role that applies depends on the processing involved; an individual may interact with us in more than one capacity.

3.2 Where we are the controller. We are the controller, data fiduciary or equivalent in respect of the personal data of persons who visit this website, submit an enquiry, correspond with us or hold a portal account. We determine the purposes and means of that processing. Clauses 4 to 11 and 13 to 15 govern it.

3.3 Where we are a processor. We are a processor in respect of personal data held within systems we build or operate for clients. The client determines the purposes and means of that processing and we act only on that client's documented instructions. Clause 12 governs it. If you are a customer or contact of one of our clients, that client is the controller of your personal data and is your point of contact, not us.

4. Categories of personal data

4.1 Data you provide to us

• The enquiry form. Your name, email address and project message. You may choose to include further information in that message. The public form does not have fields for company name, budget, service selection or booking slots, and its handler does not collect campaign identifiers or calculate an IP-address hash. A hidden field is used to identify automated submissions; it is not a request for your website address.
• Correspondence. The content of your communications with us and of our discussions, whether by email, through the portal or on a call.
• The client portal. Your authentication credentials, project files and messages, invoices, payment records and executed documents.

4.2 Data collected automatically

• Server logs. Hosting and web-server logs may record your IP address, requested URL, user agent, request time and response status. These records support operation, security, abuse prevention and fault diagnosis. The enquiry-form session described in clause 4.3 is separate from these logs.

4.3 The enquiry form requests a server-side security token when it loads. This starts a first-party session and may set a session cookie even if you do not submit an enquiry, including where the form is available in a page dialog. The session stores the security token and, after a successful submission, a timestamp used to limit repeated enquiries. The cookie contains a session identifier, not your name, email address or message.

The separate booking form collects your name, email, optional company, service, budget range, timing, project message, selected appointment and time zone. These are sent from our server to our booking system at portal.anteomnio.com, which stores the booking or enquiry and handles booking notifications. Loading available times sends the selected time zone and event type to that system; it does not send your unfinished brief.

The booking session also holds the available slot list, a request identifier, a submission fingerprint and the result/reference needed to prevent duplicate requests. Booking rate limits use a keyed hash of the connection IP address in a server-side counter, without storing the raw address or brief in that counter. The cookie itself remains a session identifier.

4.4 We do not knowingly collect special category data, sensitive personal data or sensitive personal information, as those terms are defined under the applicable laws, in the capacity described in clause 3.2, and you are asked not to submit any such data through the enquiry or booking forms or in correspondence.

5. Absence of tracking

The enquiry and booking forms use our self-hosted AOCaptcha challenge. While you drag the shape, the browser sends movement coordinates and timing to this website to check the interaction. We process that trace for verification and do not retain it in the application session or send it to an external CAPTCHA provider. The session holds a challenge for up to five minutes and, after a successful check, a one-use verification pass for up to ten minutes. Expired entries are rejected and cleared on subsequent verification requests; physical session cleanup follows the server settings. If you cannot use the drag challenge, you can contact us by email.

5.1 The public website uses a first-party session cookie for enquiry-form security. Its application does not include analytics scripts, advertising pixels or third-party embedded widgets; its images, fonts, stylesheets and scripts are served from the website. External links take you to separate services whose own policies apply. Our Cookie Policy sets the position out in full.

5.2 For completeness and so that clause 5.1 is not overstated: the server logs described in clause 4.2 record IP addresses, and an IP address may constitute personal data. Those logs exist for the purposes stated in clause 4.2, are retained for the period stated in clause 11, and are not used to construct a profile of any individual or to correlate activity across pages or visits.

6. Purposes and legal bases

6.1 Where the GDPR or the UK GDPR applies, the legal basis for each purpose is stated in the third column below. Under the Digital Personal Data Protection Act 2023 the corresponding basis is your consent or a legitimate use permitted by that Act. Under the other laws referred to in clause 13, the purpose column is the operative statement.

6.2 There is no entry for analytics or advertising because we carry out neither. Every marketing communication contains a functioning unsubscribe facility, and withdrawal of consent takes effect without affecting the lawfulness of processing carried out before it.

6.3 Where we rely on legitimate interests, we have carried out a balancing assessment and are satisfied that the processing is necessary for the interest identified and is not overridden by your rights. You may object to that processing under clause 13.

7. Disclosures and recipients

7.1 Delivering a page involves processing requests through the hosting and network infrastructure serving the website. Hosting providers may process request and log data. The public application does not send visitor data to analytics or advertising services.

7.2 The following services or recipients may be involved when you contact us or become a client. Their role depends on the service: a provider may process data on our behalf or act under its own obligations, for example when processing a payment.

7.3 We may additionally disclose personal data where disclosure is required by law, by a court or by a regulator, where it is necessary to establish, exercise or defend a legal claim, or to a purchaser in connection with a sale of our business, in which case the purchaser is bound by this policy in respect of the data transferred.

7.4 We do not sell personal data, we do not share it for cross context behavioural advertising, and we do not disclose it to data brokers.

8. International transfers

8.1 We are established in India. Request data, correspondence and service records may be processed in India and in countries where the relevant hosting, email or payment providers operate. Serving assets from this website does not by itself establish that all processing stays within one country.

8.2 Where personal data is transferred across a border we rely on appropriate safeguards, including the Standard Contractual Clauses approved by the European Commission where the GDPR applies and the International Data Transfer Addendum issued by the Information Commissioner where the UK GDPR applies, and we satisfy ourselves that an essentially equivalent level of protection accompanies the data. A copy of the relevant safeguard is available on request.

9. Security measures

9.1 The contact handler validates the submitted fields and sends the name, email address and message to our configured enquiry mailbox. The separate booking handler validates the selected time and project details, then sends a signed server-to-server request to our portal booking system. The booking page does not store a separate local copy of the full brief. Its session retains the request fingerprint and outcome to prevent duplicate submissions. Email, portal records and subsequent correspondence are handled through the systems described in clause 7.

9.2 The enquiry handler validates submissions on the server, checks a session-bound security token and limits repeated successful submissions. Its session cookie is HttpOnly and SameSite=Lax, with the Secure flag set on HTTPS connections. Hosting, mailbox access and retention controls are managed separately from the form handler; server logs may contain full IP addresses.

9.3 No system of transmission or storage can be guaranteed to be absolutely secure. We give no warranty that our security measures will prevent every unauthorised access, and clause 17 of our Terms and Conditions applies to any claim arising from a security incident.

10. Notification of a breach

10.1 Where a personal data breach affects your personal data we will notify you and the competent supervisory authority without undue delay and, where the GDPR or the UK GDPR applies, within seventy two (72) hours of becoming aware of it.

10.2 Under the Digital Personal Data Protection Act 2023 we notify the Data Protection Board of India and each affected individual in the manner and within the periods that Act requires.

10.3 Where we are acting as a processor for a client under clause 12, we notify that client without undue delay on becoming aware of a breach so that the client may discharge its own notification obligations, and we do not notify the individual or the authority directly unless the client instructs us to do so or the law requires it of us.

11. Retention periods

11.1 We retain personal data for no longer than is necessary for the purposes for which it was collected, in accordance with the following periods.

11.2 Our undertaking to delete or return client data on termination of an engagement is subject to the records we are required by law to retain, being those identified in the second row above, and to any data we are required to preserve in connection with an actual or anticipated legal claim. Data retained on either of those grounds is held in restricted storage and is not processed for any other purpose.

12. Processing on behalf of clients

12.1 Where we build or operate a system for a client, including a portal, an AI agent or an automation, the personal data within it belongs to that client. The client determines the purposes and means of the processing and we act as its processor, under a data processing agreement where one has been executed. We process that data only to perform the engagement, keep it secure in accordance with clause 9, and delete or return it on termination.

12.2 Call recordings and transcripts. Recordings and transcripts produced by voice agents we build are created and stored within the client's own systems and under the client's sole control. The client owns them and determines the period for which they are retained and the point at which they are deleted. We retain no copy of them.

12.3 Sub-processors. Where an engagement uses artificial intelligence, voice or telephony providers, we presently build on Anthropic, OpenAI and Twilio. The providers engaged for a particular engagement are identified in that client's proposal, and we select and configure them so that client data is not used to train their models. For healthcare clients we execute HIPAA business associate agreements and build on HIPAA eligible providers.

12.4 If you are a customer or contact of one of our clients and wish to exercise a right in respect of your personal data, you should address your request to that client. Where such a request is made to us we will refer it to the client without undue delay and will not act on it ourselves except on that client's instructions.

13. Your rights

13.1 Rights afforded to every individual. Irrespective of your location, you may require us to give you access to the personal data we hold about you, to correct it, to erase it, to provide it in a portable format, to restrict or cease our processing of it, or to cease processing it for the purposes of marketing. You may withdraw a consent at any time, and withdrawal does not affect the lawfulness of processing carried out before it.

13.2 India, Digital Personal Data Protection Act 2023. You have the rights of access to information, correction and erasure, the right of grievance redressal, and the right to nominate another individual to exercise your rights in the event of your death or incapacity. Our Grievance Officer is identified in clause 1.2. If you are dissatisfied with our response you may complain to the Data Protection Board of India.

13.3 European Union and United Kingdom, GDPR and UK GDPR. You have the rights of access, rectification, erasure, restriction of processing, data portability and objection, including objection to processing carried out on the basis of legitimate interests. You may lodge a complaint with your national supervisory authority or, in the United Kingdom, with the Information Commissioner's Office. We carry out no automated decision making producing legal or similarly significant effects, and no profiling. As stated in clause 1.3, we have not appointed a representative in either territory and we honour these rights directly.

13.4 California, CCPA as amended by the CPRA. You have the rights to know, to delete, to correct, to opt out of the sale or sharing of personal information, and to limit the use and disclosure of sensitive personal information, and we will not discriminate against you for exercising any of them. We have not sold personal information, and have not shared it for cross context behavioural advertising, in the preceding twelve months, as those terms are defined by that Act. You may act through an authorised agent on production of evidence of authority. Where we decline a request you may appeal by replying to our decision, and we will determine the appeal within thirty (30) days.

13.5 Australia, Privacy Act 1988 and the Australian Privacy Principles. You may request access to and correction of your personal information and may complain to us as to our handling of it. If you are dissatisfied with our response you may complain to the Office of the Australian Information Commissioner.

13.6 The rights in this clause are exercisable against us only in the capacity described in clause 3.2. Where we act as a processor, clause 12.4 applies.

14. Exercising your rights

14.1 A request should be addressed in writing to legal@anteomnio.com. We acknowledge every request within one working day and complete it within thirty (30) days.

14.2 We may require you to verify your identity before we act on a request, and the period in clause 14.1 runs from the date verification is complete. Where we are not permitted to act on a request, in whole or in part, we will tell you and state the reason.

14.3 No charge is made for a request unless it is manifestly unfounded, excessive or repetitive, in which case we will notify you of the charge, or of our refusal and its grounds, before taking any further step.

15. Children

15.1 Our services are supplied to businesses and are not directed at children. We do not knowingly collect personal data from any person under the age of thirteen (13), and we will delete any such data on becoming aware that we hold it.

15.2 Where personal data relating to a child is processed by us within a client's system under clause 12, the client is responsible for the lawful basis of that processing, including any verifiable parental consent its law requires, and warrants that basis to us under clause 15.3 of our Terms and Conditions.

16. Variation and contact

16.1 We may vary this policy from time to time, and the date at the head of this page will change accordingly. Where a variation materially affects our processing of personal data already provided to us, we will notify you before it takes effect.

16.2 Enquiries, requests and complaints should be addressed to legal@anteomnio.com, or by post to the registered office identified in clause 1.1. We reply to every message within one working day.