Introduction

placeforads ("placeforads", "we", "us" or "our") operates WIN, including its public website, account dashboard and hosted campaign pages. We aim to handle personal data responsibly, transparently and securely.

This Privacy Policy describes the information processed through WIN, why it is processed, who may receive it, how long it may be kept, and the choices available to you. It is framed with regard to India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and other law that may apply; particular rights and obligations depend on the circumstances.

Scope and our roles

This policy applies across the integrated WIN service at win.placeforads.com. It covers visitors, account holders and people who participate in campaigns hosted through WIN.

For account administration, service security, billing-related records and our own communications, placeforads determines the purpose and means of processing and generally acts as the Data Fiduciary under the DPDP Act (also commonly called a controller). For participant data collected through a customer's campaign, the customer or campaign owner determines the campaign purpose and generally acts as the Data Fiduciary or controller, while placeforads generally processes that data on the owner's instructions as a Data Processor. Each party may have separate obligations where it independently determines a processing purpose.

Third-party sites linked from WIN have their own privacy practices. This policy does not apply to services that we do not operate.

Information we process

Account information may include your name, business or organisation details, email address, email-verification status, approval and role information, and security settings. Passwords are stored as one-way hashes rather than readable passwords. If you enable multi-factor authentication, we process the information needed to provide and manage that security feature.

Campaign and participant information may include campaign configuration, uploaded campaign images, a participant's name, email address and mobile number, consent records and the wording shown when consent was given, participation time, campaign outcome, and reward or redemption information. The campaign owner decides which participant fields and permissions are appropriate for its campaign.

Technical and security information may include session identifiers, authentication events, requested pages, timestamps, browser or device details, IP addresses in server or security logs, and rate-limit or abuse-prevention records. Public campaign entry records are designed not to retain a participant IP address or user-agent string, although infrastructure and security logs may temporarily contain technical request data.

The interactive examples on the marketing pages run in the browser for demonstration. They do not submit lead details or create a real reward claim unless a page clearly identifies itself as a hosted campaign and asks you to submit information.

Cookies, sessions and local storage

WIN uses essential cookies or similar storage to keep users signed in, protect accounts and preserve necessary service state. Marketing pages may store a functional value in local storage to avoid replaying an introductory animation. These technologies are not used by WIN for third-party behavioural advertising.

You can clear cookies and local storage through your browser, but doing so may sign you out or reset functional preferences.

How information is used

We use information to create and secure accounts, verify email addresses, deliver password-reset and security messages, operate the dashboard, host campaigns, record consent and outcomes, administer rewards, provide campaign reports and exports, prevent abuse, troubleshoot faults, and comply with applicable legal obligations.

Campaign owners use participant information for the purposes described on their campaign, which may include administering the promotion and, only where the participant has made the relevant choice, sending marketing communications. Withdrawing marketing consent does not necessarily invalidate processing needed to administer a reward already awarded or to meet legal obligations.

We do not sell personal data, and WIN does not use participant information for third-party behavioural advertising.

Purpose, notice and consent

We and campaign owners process personal data for the purposes disclosed at collection and on other grounds permitted by applicable law. Where consent is required, the request should describe the intended use and give a clear affirmative choice. Campaign participation consent and optional marketing consent are treated as distinct choices.

You may withdraw consent by contacting the relevant campaign owner or us. Withdrawal applies going forward and may be subject to processing that remains permitted or required by law. Campaign owners are responsible for ensuring that their campaign notices, eligibility rules and communications are accurate and lawful.

Sharing and service providers

Campaign owners and their authorised account users can access and export participant information submitted to their campaigns. If you participate in a campaign, you should review the owner identity and campaign notice before submitting your details.

We use service providers to operate WIN, including application and database hosting, email delivery, security and monitoring, and Microsoft Azure object storage for campaign uploads. They process information for the services they provide to us and are expected to apply appropriate safeguards.

We may also disclose information when reasonably necessary to comply with law or valid legal process, protect users or the public, investigate fraud or security incidents, enforce our terms, or establish, exercise or defend legal claims. We do not disclose personal data to unrelated third parties for their independent marketing.

Retention and deletion

We retain account, campaign, participant, consent, outcome and reward records for as long as reasonably needed to provide the service, administer the relevant campaign, resolve disputes, meet security and legal requirements, or follow the campaign owner's documented instructions. Security, server and rate-limit records are generally kept for shorter operational periods unless an incident requires longer preservation.

When information is no longer needed, we take reasonable steps to delete or anonymise it. Copies may remain temporarily in protected backups and may be retained where applicable law, fraud prevention, accounting, dispute handling or the establishment of legal claims requires it. Campaign owners must set and follow an appropriate retention period for their participant data and can request deletion through the service or by contacting us.

Security and account protection

We use technical and organisational measures designed to protect information, including access controls, password hashing, email verification, optional multi-factor authentication, request throttling and encrypted connections to configured service providers. No internet transmission or storage system is completely secure, so absolute security cannot be guaranteed.

Account holders must use a unique password, protect authentication and recovery codes, restrict access to authorised people, and notify us promptly if they suspect unauthorised activity.

Your choices and rights

Subject to the DPDP Act and other applicable law, you may be entitled to request access to a summary of personal data and processing activities, correction or completion of inaccurate data, erasure where retention is no longer required, withdrawal of consent, grievance redressal, and nomination of another person to exercise rights in the event of death or incapacity.

For participant data, contacting the campaign owner first may be the fastest route because that owner controls the campaign purpose. You may also contact us at contactus@placeforads.com and we will respond directly or assist the owner as appropriate. We may need to verify your identity and may retain limited information where permitted or required by law.

Children's privacy

WIN accounts are intended for adults and business users. Campaign owners must not knowingly target or collect personal data from children, or from a person with a lawful guardian where applicable, unless they have established a lawful process for verifiable parental or guardian consent and complied with applicable restrictions. If you believe such data has been collected improperly, contact the campaign owner and contactus@placeforads.com.

International processing

Our providers may process information in India or other countries. Where information is transferred or processed outside India, we take reasonable steps intended to protect it and comply with transfer restrictions that apply under Indian law. A campaign owner may have additional obligations based on its participants and operations.

Changes to this policy

We may update this policy as WIN, our providers or legal requirements change. The "Last updated" date identifies the current version. We will provide additional notice where a material change requires it.

Contact and grievances

For privacy questions, rights requests or grievances, email contactus@placeforads.com and identify the relevant account or campaign without including passwords or authentication codes. We will assess the request, involve the campaign owner where appropriate, and respond within any timeline that applies under law.