Privacy Policy

Saltbuzz is a creative martech company based in Kolkata, India. We work with brands across India, the UAE and the United States on branding, creative design, social media strategy, influencer marketing, experiential marketing, podcast production, public relations, activations, video production, SEO, AEO, GEO, performance optimisation, and website design and development.

This Privacy Policy explains what personal data we collect, why we collect it, what we do with it, who we share it with, how long we keep it, and the rights you have over it. It applies to saltbuzz.co and its subdomains, to our enquiry, careers and newsletter forms, to our chatbot and AI voice calling agent, and to the direct business communications we have with you.

It does not apply to personal data we handle purely on behalf of our clients while delivering work for them. That situation is dealt with separately in the section titled 'When We Act as a Data Processor'.

We have written this policy to meet the requirements of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Several of those Rules become fully enforceable on 13 May 2027. We have chosen to align ahead of that date rather than wait for it.

Please read this policy alongside our Terms of Service and our Cookie Policy. If you do not agree with it, please do not use the Site or submit information to us.

For the purposes of the Digital Personal Data Protection Act, 2023, the Data Fiduciary responsible for the personal data described in this policy is RSC Projects Private Limited, CIN U27100WB2010PTC141677, which operates the Saltbuzz brand, with its registered office at Street Number 25, GP Block, Sector V, Bidhannagar, Kolkata, West Bengal 700091, India. References in this policy to 'Saltbuzz', 'we', 'us' and 'our' are references to that entity.

The person who can answer your questions about how we process personal data, and who handles complaints, is Sayantan Pakhira. You can reach him at grievance@saltbuzz.co. His contact details are published here and on every notice we issue, as required by the Rules.

We have not been notified by the Central Government as a Significant Data Fiduciary. If that changes, we will update this policy and appoint a Data Protection Officer based in India in accordance with the Act.

Saltbuzz and RSC Group are brands of the same company, RSC Projects Private Limited. When you hear from us under either name, you are dealing with the same Data Fiduciary, and no personal data has been shared outside it.

For general business enquiries that are not about privacy, write to business@saltbuzz.co.

'Personal data' means any data about an individual who is identifiable by or in relation to that data.

'Processing' means any operation performed on personal data, including collection, storage, use, sharing, disclosure and erasure, whether or not automated.

'Data Principal' means you, the individual the personal data relates to. Where the data relates to a child, it includes the parent or lawful guardian, and where it relates to a person with disability, it includes their lawful guardian.

'Data Fiduciary' means the person who determines the purpose and means of processing. For the data described in this policy, that is Saltbuzz.

'Data Processor' means a person who processes personal data on behalf of a Data Fiduciary. Our hosting, email and analytics providers are our Data Processors. When we deliver campaign work for a client, we are theirs.

'the Act' means the Digital Personal Data Protection Act, 2023. 'the Rules' means the Digital Personal Data Protection Rules, 2025. 'the Board' means the Data Protection Board of India.

We collect only what we need for the purpose we tell you about at the point of collection. Where a field is optional, leaving it blank will not stop us responding to you.

Information you give us directly. When you submit our enquiry form or write to business@saltbuzz.co, we collect your name, email address, phone number, company name, and the message, brief or project detail you choose to share. Recruitment data is dealt with separately below.

Information you give us through our chatbot and AI voice calling agent. Our chatbot collects the messages you type and the contact details you choose to provide. Our AI voice calling agent collects your phone number, the audio of the call and a written transcript of it. We tell you at the start of a call that it is being handled by an automated agent and that it is being recorded and transcribed, and you may end the call at any point. Audio and transcripts are processed by the third-party voice and language model providers listed in the sharing section, and are retained for the period stated in the retention section.

Information collected automatically to keep the Site running and secure. When you visit the Site, our servers and content delivery network record your IP address, browser type, operating system, device type, referring URL, the pages requested, and the date and time of the request. This is a necessary part of delivering the Site to your device, diagnosing faults and protecting the Site against fraud, abuse and attack. We do not use it to build a profile of you.

We do not collect financial account details, government identifiers or payment card information through this Site, and we ask that you do not send them to us through our forms.

When you apply for a role at Saltbuzz, we collect your name, phone number, email address, current location, years of experience, resume, and any portfolio or profile links you provide. Depending on your experience level, we also collect either your institution, qualification and specialisation, or your current company, notice period and current CTC. You may also submit an optional cover letter.

We use this information only to assess your application, to communicate with you about it, and to consider you for other suitable openings at Saltbuzz. We do not use recruitment data for marketing unless you separately opt in to our newsletter, and we do not sell or share it with recruiters or job boards.

Application data is accessible only to the Saltbuzz team members involved in hiring for the relevant role. We retain applications for 12 months from the date of submission and then delete them. You may ask us to delete your application earlier by writing to grievance@saltbuzz.co, and we will do so unless we are required to retain it under applicable law.

Applications are accepted only from individuals aged 18 years or above. We do not knowingly process the personal data of children through our careers pages.

Applications submitted through our careers form are received at hr@rscgroup.co.in and stored in our Microsoft 365 environment, which is the same company under a different brand name. They are not shared with any organisation outside RSC Projects Private Limited.

If you are hired, the personal data in your application becomes part of your employment record and is then governed by our internal employee privacy notice rather than this policy.

We process your personal data only for the specific purposes set out below, and only for as long as each purpose is being served.

To respond to you. We use the name, contact details and message you submit to answer your enquiry, to ask follow-up questions, to prepare proposals and quotations, and to arrange calls or meetings.

To deliver work you have engaged us for. Where you become a client, we use your contact and project data to plan, execute, review and invoice the services set out in our engagement with you.

To assess job applications. We use recruitment data solely as described in the recruitment section above.

To send marketing communications. We send newsletters, case studies, services and job updates only to people who have specifically opted in to receive them. Marketing consent is always requested separately from any enquiry or job application, and you can withdraw it at any time.

To meet legal obligations and defend legal claims. We process personal data where the law requires us to, where we are complying with an order of a court or a lawful request from a governmental authority, and where necessary to establish, exercise or defend a legal claim.

We do not use your personal data to make decisions about you that produce legal or similarly significant effects without human involvement.

Under the Act, personal data may be processed only on the basis of your consent, or for a limited set of legitimate uses set out in Section 7 of the Act. We do not rely on any broader ground.

Most of what we do rests on your consent. Enquiries, chatbot and voice agent conversations, newsletter subscriptions, job applications and analytics cookies are all processed on the basis of consent that you give through a clear, specific, informed and unambiguous affirmative action.

Where you voluntarily provide your personal data to us for a specified purpose and have not indicated that you object to its use for that purpose, we may rely on the legitimate use recognised in Section 7 of the Act. In practice this covers situations such as you emailing us your business card details or handing them to us at an event.

Where we are complying with a legal obligation, an order of a court, or a lawful request from a governmental authority, we rely on the corresponding legitimate use under the Act.

We do not treat silence, inactivity, pre-ticked boxes or continued use of the Site as consent, and we do not bundle consent for one purpose into consent for another.

Where we rely on your consent, we ask for it at the point of collection through a clear, specific and unticked option, accompanied by a notice that tells you what data we are collecting and exactly what we will use it for. Your consent is limited to the personal data that is necessary for that stated purpose.

You may withdraw your consent at any time, and doing so is as easy as giving it. Every marketing email carries a working unsubscribe link. For anything else, use the request form at our request form or write to grievance@saltbuzz.co.

When you withdraw consent, we stop the processing that relied on it, and we instruct our processors to do the same, within a reasonable time. We then erase the personal data unless we are required to retain it under applicable law.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Where withdrawal means we can no longer provide something you have asked for, we will tell you plainly what the consequence is before it takes effect.

You may also give, manage, review or withdraw consent through a Consent Manager registered with the Board, once that framework becomes operational. If we begin accepting consent through a registered Consent Manager, we will say so here.

We will update soon.

A large part of our work involves handling personal data that belongs to our clients rather than to us. This includes campaign audiences, lead capture forms we build and operate for clients, CRM records, influencer and talent contacts, event registrations, and analytics on client-owned properties.

In those situations our client is the Data Fiduciary and Saltbuzz is a Data Processor. We process that data only on the client's documented instructions, under a written agreement that sets out the purpose, the security safeguards, the restrictions on onward transfer, the assistance we provide with rights requests and breach reporting, and our obligation to erase or return the data at the end of the engagement.

This Privacy Policy does not govern that data. If you want to access, correct or erase personal data held by one of our clients, please contact that organisation directly. If you approach us instead, we will not act on the request ourselves, but we will pass it to the client without undue delay and support them in responding to it.

We do not use client data for our own purposes, we do not merge it with our own contact lists, and we do not use it to train any model.

We do not sell, trade or rent your personal data, and we do not disclose it for anyone else's advertising purposes.

We share personal data with service providers who process it on our behalf under written agreements that bind them to our instructions, require reasonable security safeguards, and prohibit them from using the data for their own purposes. The current categories are hosting and content delivery, transactional and marketing email, website analytics, internal communication and storage, and the voice and language model providers that operate our chatbot and AI voice calling agent.

The specific providers we use in each category are listed and kept current at our sub-processor list. We publish that list separately so it stays accurate between revisions of this policy.

We may disclose personal data where required by law, by an order of a court, or by a lawful request from a governmental authority, or where necessary to protect the rights, property or safety of Saltbuzz, our clients, our people or the public.

In the event of a merger, acquisition or sale of assets, personal data may transfer as part of the business. We will notify you before your data becomes subject to a materially different privacy policy, and where the processing rests on consent we will ask for it again.

We share your personal data in any other circumstance only with your explicit consent.

Sharing your data with someone does not end our responsibility for it. Under the Act we remain accountable for processing carried out on our behalf.

Some of the service providers we use store or process data on servers outside India, including in the United States and the European Union. This means your personal data may be transferred outside India.

The Act permits such transfers subject to any restrictions or conditions that the Central Government may specify. We monitor those notifications and will stop or reroute a transfer if a restriction applies to it. We also require every provider we use to maintain security standards consistent with this policy.

Where we work with clients in the UAE or the United States, project-related personal data may be shared with them under contractual confidentiality and data protection obligations.

If we are ever notified as a Significant Data Fiduciary, additional restrictions on transferring certain categories of personal data and traffic data outside India would apply to us, and we would update this policy accordingly.

Our Site links to and embeds content from third-party platforms including Instagram, LinkedIn, Facebook, YouTube and Behance. Embedded content may set its own cookies and may receive your IP address when it loads.

We are not responsible for the privacy practices of these platforms. Any interaction you have directly with them is governed by their own privacy policies, and we encourage you to read them.

Where technically possible, we load embedded content only after you have accepted the relevant cookie category.

We keep personal data only for as long as the purpose it was collected for is still being served, and we erase it once that purpose is no longer being served or you withdraw the consent it rested on, whichever comes first, unless a longer period is required by law.

Enquiry and contact form submissions are retained for up to 3 years from our last substantive exchange with you. This is our own commercial retention period, set so that we can pick up a conversation where we left it, and it is not a period mandated by the Act.

Chatbot transcripts are retained for 12 months. Voice agent call recordings are retained for 90 days and the written transcripts for 12 months, after which the recordings and transcripts are deleted.

Job applications are retained for 12 months from the date of submission. Marketing contacts are retained until you unsubscribe or withdraw consent. Client project records are retained for the duration of the engagement and for the period afterwards required by contract, tax and limitation law.

The Rules require us to retain personal data, related traffic data and system logs for a minimum period, currently one year, so that they remain available for lawful requests and investigations. Where that minimum applies, it takes precedence over the shorter periods above, after which the data is erased.

You may ask us to erase your personal data earlier at any time. We will action the request unless we are required to retain the data under applicable law, in which case we will tell you what we are retaining and why.

The Act gives you the following rights over the personal data we hold about you.

The right to access. You may obtain a summary of the personal data we hold about you, the processing activities we carry out on it, and the identities of every other Data Fiduciary and Data Processor with whom we have shared it, together with a description of what was shared.

The right to correction, completion and updating. You may have inaccurate or misleading data corrected, incomplete data completed, and outdated data updated.

The right to erasure. You may have your personal data erased where it is no longer needed for the purpose it was collected for, or where you withdraw the consent it rested on, unless retention is required by law.

The right to withdraw consent. You may withdraw consent at any time, as described in the consent section above, and you may object at any time to the use of your data for direct marketing.

The right to nominate. You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. To register a nominee, write to grievance@saltbuzz.co with the nominee's name and contact details.

The right to grievance redressal. You may complain to us about how we handle your personal data, and escalate to the Board if you are not satisfied. This is described in the next section.

These rights apply to you. They do not extend to personal data we process on behalf of a client, which is dealt with in the section on when we act as a Data Processor.

The quickest route is the request form at our request form. It records your request, gives you a reference number, and starts our response clock. You can also write to grievance@saltbuzz.co with the word 'Privacy Request' in the subject line.

So that we can find your data, please tell us which right you are exercising and give us the email address or phone number you used when you contacted us. Where we cannot identify you from what we hold, or where the request comes from an address we do not recognise, we may ask you for reasonable additional information to verify your identity before we act. We ask for the minimum needed and we do not retain it afterwards.

We respond to access, correction and erasure requests within 30 days of receiving a verifiable request. If a request is complex and we need longer, we will tell you within those 30 days and explain why.

There is no charge for exercising your rights.

If we decline a request, we will tell you the reason and how to escalate it.

The Act places a small number of duties on you as well, and we set them out here so that they are not a surprise.

You must not impersonate another person when providing personal data to us, and you must not suppress material information when submitting personal data for a document, identifier or proof of identity issued by the State.

You must not register a false or frivolous grievance or complaint.

You must provide information that is verifiably authentic when exercising your right to correction or erasure.

The Act provides for a penalty of up to INR 10,000 for breach of these duties. That penalty is imposed by the Board, not by us.

If you have a question, concern or complaint about how we handle your personal data, please contact our Grievance Officer.

Sayantan Pakhira, Grievance Officer, Saltbuzz. Email: grievance@saltbuzz.co. Postal address: Street Number 25, GP Block, Sector V, Bidhannagar, Kolkata, West Bengal 700091, India.

We acknowledge every privacy-related complaint within 7 business days and aim to resolve it within 30 days of receipt. The Act allows up to 90 days for grievance redressal, and we will never exceed that period. Where a complaint will take us longer than 30 days, we will tell you why and give you a date.

You do not need to have made a request first in order to complain, and complaining costs you nothing.

If you are not satisfied with our response, or if we do not respond within the required period, you may escalate your complaint to the Data Protection Board of India in accordance with the Act. Details of how to do so are published by the Board at DPB_COMPLAINT_URL (currently not live).

We apply reasonable security safeguards to protect personal data against unauthorised access, alteration, disclosure and loss, and we maintain those safeguards whether the data is held by us or by a processor acting for us.

Our measures include encryption of data in transit using SSL/TLS, encryption or masking of personal data at rest where the platform supports it, hosting on managed infrastructure with access controls, role-based access limits so that team members can reach only the data their work requires, multi-factor authentication on administrative accounts, maintenance of access logs and system logs for the period required under the Rules, regular backups, and periodic review of who has access to what.

We impose equivalent obligations on our processors by contract, and we review them before we onboard them.

No method of transmission or storage is completely secure. While we protect your information using commercially reasonable means, we cannot guarantee absolute security, and we do not ask you to send us sensitive financial or identity documents through the Site.

A personal data breach means any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability.

On becoming aware of a breach, we will inform each affected individual without delay, in clear and plain language, describing the nature, extent and timing of the breach, its likely consequences for you, the measures we have taken to contain it and prevent a recurrence, the steps you can take to protect yourself, and the contact details of the person who can answer your questions about it.

We will also intimate the Data Protection Board of India without delay with the information available to us at that point, and we will furnish a detailed report to the Board within 72 hours of becoming aware of the breach, or within any longer period the Board allows on our written request. That report covers the events leading to the breach, the remedial measures taken, the findings on who caused it, and confirmation of the intimations sent to affected individuals.

We maintain a breach response procedure and log every incident, including those that turn out not to be reportable.

Our Site and services are not directed at individuals under the age of 18, and we do not knowingly collect their personal data. Our enquiry and careers forms are intended for adults only.

We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

Where we ever need to process the personal data of a child, or of a person with disability who has a lawful guardian, we will first obtain and verify the consent of the parent or lawful guardian in the manner prescribed under the Rules, and we will not undertake any processing likely to cause a detrimental effect on the wellbeing of a child.

If you believe a child's personal data has been provided to us, contact grievance@saltbuzz.co and we will verify and delete it promptly.

This Privacy Policy is published in English. You may ask to receive it in Bengali or in any other language listed in the Eighth Schedule to the Constitution of India, and we will provide it at no cost.

To request a copy in another language, write to grievance@saltbuzz.co. We will supply it within 15 business days.

Where a translation and the English version differ, the English version governs, and we will correct the translation.

We may update this Privacy Policy to reflect changes in our practices, our service providers, or the law. Every revision carries an updated 'Last Updated' date and a version number at the top of this page, and we keep previous versions available on request.

Where a change materially affects how we process your personal data, for example a new purpose, a new category of recipient, or a longer retention period, we will notify you directly and, where the processing rests on consent, ask for your consent again. We will not treat continued use of the Site as agreement to such a change.

Minor clarifications and corrections are published here without separate notice.

Where we hold personal data collected before this policy took effect, we will issue a notice covering that data as required by the Rules, so that you have the same information about it as you would have had at the time.