Privacy notice

Version 1.3 · Effective 13 October 2026 · Omvora Media & Automation

1. About this Privacy Notice

Omvora Media & Automation (“Omvora”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data.

This Privacy Notice explains:

  • what personal data we collect or otherwise process;
  • how and why we use it;
  • the purposes for which it is processed;
  • when we may share it;
  • the role we perform when processing personal data;
  • how we protect it;
  • how long we retain it;
  • how we handle personal-data breaches;
  • how consent works;
  • what this website stores in your browser, and how to change your choice about it;
  • how you may exercise your privacy rights;
  • how you may raise a grievance; and
  • how this Notice applies to our website, communications, software, SaaS products, automation services and client engagements.

This Notice is intended to operate consistently with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), other rules and directions made under that Act, the Consumer Protection Act, 2019 and other applicable Indian law, as amended or brought into force from time to time.

The DPDP framework is being brought into force in phases. The DPDP Rules were notified on 13 November 2025. Most of the obligations on Data Fiduciaries (notice, consent, security safeguards, breach intimation, retention and erasure, and the rights of Data Principals) commence on 13 May 2027. Until then, section 43A of the Information Technology Act, 2000 and the SPDI Rules continue to apply, and Omvora complies with them. Where a provision has a future commencement date, Omvora will comply with it from that date and may implement corresponding controls earlier; this Notice already describes those controls.

This Privacy Notice is intended to be understandable independently of other website information and, where used as the notice accompanying a consent request, to identify the relevant personal data and purpose of processing.

You may ask for this Notice in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to privacy@omvoramedia.com. If you need it in another format you can use, write to the same address; our accessibility statement explains how this website supports screen readers, keyboards and other ways of reading it.

2. Who we are

Omvora Media & Automation is a registered partnership firm.

  • Principal address: Hawal, Srinagar, Jammu & Kashmir 190011, India
  • General enquiries: hello@omvoramedia.com
  • Privacy and data grievances: privacy@omvoramedia.com
  • Grievance Officer: Mr Mujtaba Mirza
  • Telephone: +91 90040 22222
  • Hours: Monday to Friday, 11 am to 6 pm IST

3. Our role under data-protection law

Our role depends on the particular processing activity.

3.1 When Omvora is a Data Fiduciary

Omvora is a Data Fiduciary when Omvora determines the purpose and means of processing personal data.

This may include personal data processed for:

  • website enquiries;
  • business communications;
  • our own customer and supplier administration;
  • our own subscriptions;
  • our own billing and accounting;
  • security and fraud prevention;
  • service administration;
  • our own marketing where permitted; and
  • other purposes for which Omvora independently determines why and how personal data is processed.

3.2 When Omvora is a Data Processor

Omvora may act as a Data Processor when we process personal data on behalf of a client that determines the purpose and means of processing.

This may include:

  • WhatsApp automation;
  • Telegram automation;
  • customer-support systems;
  • social-media automation;
  • SaaS applications;
  • appointment and queue-management systems;
  • custom applications;
  • internal business tools;
  • CRM or workflow systems;
  • client databases;
  • marketing automation; and
  • other client-directed processing.

Where Omvora acts as a Data Processor, the relevant client may be the Data Fiduciary. The client’s privacy notice, instructions and applicable data-processing agreement may therefore govern the relevant processing.

We do not treat a client relationship as automatically making Omvora the Data Fiduciary for every piece of information handled through that relationship.

4. What personal data we process

The categories below describe the types of personal data Omvora may process depending on the service and your relationship with us. We do not necessarily collect every category from every person.

4.1 Identity information

This may include:

  • name;
  • username;
  • business or organisation name;
  • job title or professional role;
  • profile information;
  • account identifier;
  • customer identifier; and
  • information necessary to verify identity where verification is required.

4.2 Contact information

This may include:

  • email address;
  • telephone number;
  • mobile number;
  • messaging-app identifier;
  • WhatsApp number;
  • Telegram username or identifier;
  • business address;
  • correspondence address; and
  • other contact information you voluntarily provide.

4.3 Enquiry and communication information

If you contact Omvora, we may process:

  • your enquiry;
  • message contents;
  • project requirements;
  • service interests;
  • information you provide during a call;
  • email correspondence;
  • support correspondence;
  • attachments;
  • quotations and proposals;
  • meeting information; and
  • records necessary to manage the relationship.

4.4 What this website itself collects

  • Very little, by itself. This website has no accounts, no analytics, no advertising and no tracking pixels, and our own server sets no cookies. It does not read your location or your device identifiers. It can keep up to three preferences in your own browser, never sent to us: where you had scrolled to on the home page (kept only until you close the tab); if you press the sound button, whether sound is on or off; and, if you turn text animation off with the Animation switch, that choice (removed when you turn it back on). These three are remembered only if you allow it in the cookie & storage banner; otherwise they work while the page is open and are then forgotten. Cloudflare, which serves the website, may set its own security cookies. Section 23 lists every item.
  • Your cookie & storage choice. On your first visit a banner asks what this website may keep in your browser. Your choice is kept in your browser, and an anonymous receipt of it is kept on our server in India: a random receipt number, the choices, the banner’s version and the time — no IP address, no name and nothing else (section 23).
  • Connection logs. Pages are served through Cloudflare, which processes standard connection information (IP address, time, page requested) to deliver and secure the website, under its own terms. Our own web server, on our server in India, keeps access logs for security: IP address, time, page requested and browser type (see section 29 for how long).
  • The contact form. What you type — your name, your business if you give it, your email address, your phone number if you give it, which of our services you are asking about, and your message — goes to our enquiry service, which runs on our own server in India, separated from our other systems. It stores your enquiry and your consent record, emails the enquiry to us, and emails you a receipt. The form itself stores nothing in your browser. If the service cannot be reached, the form instead opens an email in your own mail app, addressed to us, carrying the same details and consent record.
  • Two separate consents. The form has two boxes, both unticked. The first — replying to your enquiry — is the only purpose the form needs, and the form does not send without it. The second — occasional updates about new services and offers, never more than one a month — is optional and can be left unticked. If you tick it, we email you a link to confirm, and send you nothing until you do.
  • A check that a person is sending the form. On the contact page only, Cloudflare Turnstile checks that the form is sent by a person and not by an automated program, so that our inbox and the form’s daily allowance cannot be exhausted by bots. It runs a script from Cloudflare that processes technical signals from your browser — your IP address, a fingerprint of the secure connection, your browser’s user-agent, and this website’s address — to tell people from bots. Usually you see nothing; sometimes it asks you to tick a box. Cloudflare says it cannot directly identify you from these signals, and uses them only to detect and block bots and to improve that detection. In the way we use it, it sets no cookie. Cloudflare’s Turnstile privacy addendum applies: https://www.cloudflare.com/turnstile-privacy-policy/
  • Your consent record. For each box we record whether you ticked it, the time, the enquiry reference, and the versions of this Notice and of the Contact & Consent notice. Your receipt email carries the same record, so both of us hold it.

4.5 If you choose not to give us information

You do not have to give us any personal data to read this website.

If you do not give the details the contact form asks for, or do not tick the box that lets us reply, the form cannot send your enquiry; you can still write to us or telephone us instead. Leaving the optional updates box unticked changes nothing about how we answer you.

If you decline the functional preferences in the cookie & storage banner, the website works in the same way; it only stops remembering your sound, animation and scroll settings between visits.

For a paid service, some details are needed by law or to perform the service, for example the details an invoice must carry under GST law. If they are not given, we may not be able to provide that service.

5. Information processed through messaging and automation services

Depending on the service, Omvora may process information received through:

  • WhatsApp;
  • Telegram;
  • web chat;
  • email;
  • social-media messaging;
  • other communication channels; and
  • integrations authorised by the client or user.

This may include:

  • sender and recipient identifiers;
  • phone numbers;
  • usernames;
  • messages;
  • images;
  • audio;
  • video;
  • documents;
  • timestamps;
  • conversation metadata;
  • message status;
  • attachments;
  • customer requests;
  • order or booking information; and
  • information voluntarily included in a conversation.

Where Omvora processes this information on behalf of a client, the client’s instructions and applicable agreement determine the permitted processing.

6. Voice, audio, images and video

Some Omvora services may support:

  • voice messages;
  • audio transcription;
  • image understanding;
  • video processing;
  • content generation;
  • document processing; or
  • other multimodal functionality.

Where such functionality is enabled, the relevant audio, image, video, document or transcript may constitute personal data if it relates to an identifiable individual.

We process such material only for the relevant service purpose, subject to the applicable agreement and privacy requirements.

We do not assume that every image, voice recording or video may be used for unrelated purposes simply because it has been provided to an Omvora-powered service.

7. Business and account information

For clients and prospective clients we may process:

  • company or organisation details;
  • GST or tax information where required;
  • billing information;
  • purchase/order information;
  • subscription information;
  • service configuration;
  • account identifiers;
  • project details;
  • support history;
  • invoices;
  • payment status;
  • contract information;
  • authorised-user information;
  • API identifiers;
  • integration identifiers; and
  • other information necessary to provide the contracted service.

8. Integration credentials and technical access information

Where a client authorises Omvora to connect to a third-party service, we may process technical information such as:

  • API keys;
  • access tokens;
  • account IDs;
  • page IDs;
  • channel IDs;
  • webhook information;
  • integration configuration;
  • service credentials; and
  • other authentication or authorisation information.

Such information is treated as confidential security information.

Omvora will not use integration credentials for purposes unrelated to the authorised service.

Credentials should be provided through the secure mechanism specified for the relevant service and should not be unnecessarily transmitted through ordinary email or public communication channels.

9. Clinic and administrative SaaS information

Omvora may provide administrative software for clinics. Depending on the configuration, this may involve:

  • patient name;
  • contact information;
  • appointment information;
  • doctor/provider information;
  • booking information;
  • queue/token information;
  • appointment reminders;
  • payment status;
  • transaction references;
  • administrative communications; and
  • other information required for the administrative service.

Important limitation. Omvora’s clinic product is an administrative technology service. It is designed for functions such as:

  • bookings;
  • queues;
  • reminders;
  • administrative communication; and
  • payment workflows.

It is not a medical diagnostic service and does not provide medical advice, diagnosis or treatment recommendations.

Where a clinic determines the purposes and means of processing patient information, the clinic may be the Data Fiduciary and Omvora may act as its Data Processor. Patients see the clinic’s own privacy notice inside the service.

10. Payment and financial information

Where you purchase services from Omvora, we may process:

  • billing name;
  • billing address;
  • invoice information;
  • transaction reference;
  • payment status;
  • amount;
  • currency;
  • refund information; and
  • information required for accounting and tax purposes.

Where a third-party payment provider processes card or payment credentials, those credentials are handled according to the provider’s systems and applicable terms.

Omvora does not intentionally store complete card numbers, CVV numbers, PINs or authentication credentials unless a particular service expressly requires such processing and the applicable legal and security requirements have been satisfied.

11. Technical, security and usage information

When you access our website or services, infrastructure providers or security systems may process technical information such as:

  • IP address;
  • date and time;
  • browser type;
  • device information;
  • operating system;
  • requested resource;
  • referring information;
  • network information;
  • error information;
  • security events;
  • authentication events;
  • service logs; and
  • other information reasonably necessary for security, availability and operation.

Some technical information may be personal data where it can reasonably be associated with an identifiable individual.

12. Information we receive from other sources

Depending on the relationship, we may receive information from:

  • clients;
  • authorised representatives;
  • payment providers;
  • communication platforms;
  • social-media platforms;
  • integration providers;
  • hosting providers;
  • professional advisers;
  • fraud/security services;
  • publicly available business information; and
  • other persons or organisations authorised to provide the information.

We will use information received from another source only for an appropriate and lawful purpose.

13. How we collect personal data

We may collect or receive personal data when you:

  • visit our website;
  • contact us;
  • submit an enquiry;
  • email us;
  • call us;
  • communicate through WhatsApp or Telegram;
  • request a quotation;
  • enter into a service agreement;
  • purchase or subscribe to a service;
  • use an Omvora SaaS product;
  • interact with a client service powered by Omvora;
  • submit information to an Omvora-operated application;
  • request customer support;
  • authorise an integration;
  • make a payment;
  • communicate with us after a service; or
  • otherwise voluntarily provide information.

14. Purposes for which we process personal data

We process personal data only for specified and lawful purposes. These may include:

14.1 Responding to enquiries

To:

  • receive your enquiry;
  • understand your requirements;
  • respond to questions;
  • arrange meetings;
  • provide demonstrations;
  • prepare quotations; and
  • communicate about the requested service.

14.2 Providing services

To:

  • operate software;
  • provide automation;
  • manage workflows;
  • provide customer support;
  • process authorised communications;
  • maintain integrations;
  • process bookings;
  • manage queues;
  • send reminders;
  • process agreed administrative workflows; and
  • perform the contracted service.

14.3 Account and relationship administration

To:

  • create and manage accounts where applicable;
  • maintain client records;
  • manage subscriptions;
  • issue invoices;
  • process payments;
  • handle refunds;
  • provide support;
  • manage contracts; and
  • administer the business relationship.

14.4 Security

To:

  • protect systems;
  • detect malicious activity;
  • investigate incidents;
  • prevent fraud;
  • maintain audit and security records;
  • authenticate users;
  • control access; and
  • maintain availability and integrity.

14.5 Service improvement

Where permitted by applicable law and the relevant agreement, we may use appropriately controlled information to:

  • troubleshoot;
  • test;
  • maintain;
  • improve reliability;
  • improve usability;
  • identify errors; and
  • improve our services.

Where information is not required in identifiable form for a particular improvement activity, we will seek to use aggregated, anonymised or de-identified information where reasonably appropriate.

To:

  • comply with applicable law;
  • maintain required records;
  • respond to lawful requests;
  • meet tax/accounting obligations;
  • protect legal rights;
  • investigate disputes; and
  • cooperate with lawful authorities.

We do not sell or rent personal data, and we do not share it with anyone for their own marketing.

15. Lawful grounds under the DPDP framework

Under the DPDP Act, personal data may be processed for a lawful purpose based on:

  1. consent; or
  2. certain legitimate uses specifically recognised by section 7 of the Act.

We will not treat a generic commercial interest as an unlimited DPDP lawful basis.

Where consent is required, we will obtain consent in the manner required by applicable law.

Where processing falls within a statutory legitimate use, we may process the relevant personal data without obtaining consent where the statutory conditions are satisfied. Section 7 of the DPDP Act includes, for example, processing for a specified purpose for which you have voluntarily provided your personal data and have not indicated that you do not consent to its use.

Other applicable laws may independently require or authorise particular processing.

For the processing this website and our own business carry out as Data Fiduciary, the grounds are:

What we process Personal data Why Ground
Replying to an enquiry sent through the contact form Name, business (if given), email, phone (if given), service asked about, message To answer you and, if you ask, prepare a proposal Your consent (the first box)
Occasional updates Email address To send updates about new services and offers, never more than one a month Your consent (the second box, confirmed by email)
Remembering your preferences in your browser The three preferences in section 23 To keep your sound, animation and scroll settings between visits Your consent in the cookie & storage banner
Keeping the anonymous receipt of your banner choice Receipt number, choices, banner version, time To be able to show what was chosen, as the DPDP Act requires a Data Fiduciary to prove consent Our legal obligation (section 6(10) of the DPDP Act)
Delivering and protecting the website IP address, time, page requested, browser type; Cloudflare’s security signals To serve the page you ask for, keep the website available and stop attacks The use for which your browser sends this information (section 7(a) of the DPDP Act), and the logs the CERT-In directions require
Emails and calls you start yourself, and client relationships What you tell us, contract, invoice and payment details To answer you and to provide the service you asked for The specified purpose for which you gave us the data (section 7(a) of the DPDP Act)
Tax and accounting records Billing and invoice details To keep the records GST and income-tax law require Legal obligation
Disclosures the law requires Only what is required To comply with a law, a court order or a lawful request from an authority Sections 7(d) and 7(e) of the DPDP Act

Where Omvora relies on consent, consent will be:

  • free;
  • specific;
  • informed;
  • unconditional;
  • unambiguous;
  • given through clear affirmative action; and
  • limited to personal data necessary for the specified purpose.

The consent request will be presented in clear and plain language.

We will not treat silence, inactivity, pre-ticked boxes or mere browsing as affirmative consent where affirmative consent is legally required. Using this website is never taken as consent to anything: every consent on it is a separate box or switch that starts off.

No consent on this website is a condition of reading it. Each is asked for one purpose, and saying no to one does not affect another.

We keep what we need to be able to show that the notice was given and the consent obtained (see section 18).

You give, review and withdraw your consents directly with us. We do not use a Consent Manager registered with the Data Protection Board of India.

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal will be made available through a method that is reasonably comparable in ease to the method through which consent was provided. For consents given through this website: every update carries a one-tap unsubscribe link; replying STOP works too; or send one line to privacy@omvoramedia.com. The link and STOP replies are handled automatically. For the cookie & storage banner: open Cookie settings at the foot of any page and switch the preference off, or press Decline all — as easy as it was to allow.

Withdrawal:

  • does not invalidate processing lawfully completed before withdrawal;
  • may affect our ability to provide a service that requires the relevant data; and
  • does not prevent processing where another lawful basis or legal requirement permits or requires continued processing.

After a valid withdrawal, Omvora will cease the relevant consent-based processing within a reasonable period and will instruct relevant processors to do the same, unless continued processing is required or authorised by law.

Where consent is relied upon, Omvora may retain evidence of:

  • the consent provided;
  • the purpose;
  • the relevant notice version;
  • date and time;
  • method of consent;
  • relevant communication;
  • withdrawal;
  • withdrawal date; and
  • the resulting processing status.

This may be necessary to demonstrate compliance and protect legal rights.

For the cookie & storage banner the record is the anonymous receipt described in section 23: a random receipt number, the choices, the banner’s version and the time, with no IP address and no name.

19. Client data and Data Processing

Where Omvora acts as a Data Processor:

  • the client determines the relevant purposes;
  • Omvora processes information according to documented instructions;
  • Omvora will apply appropriate contractual and security safeguards;
  • Omvora may use authorised subprocessors where permitted;
  • Omvora will assist the client with applicable privacy obligations to the extent required by the agreement and law; and
  • client data will not be treated as Omvora’s own marketing database merely because we technically process it.

If you are interacting with an Omvora-powered service on behalf of another organisation, that organisation may be the relevant Data Fiduciary.

20. AI and automated systems

Omvora may use artificial intelligence and automated systems in some services. Depending on the product, AI may be used for:

  • understanding messages;
  • classification;
  • drafting;
  • translation;
  • transcription;
  • summarisation;
  • customer support;
  • content generation;
  • recommendations;
  • workflow automation; and
  • other functions expressly described for the service.

AI output may be inaccurate, incomplete or inappropriate.

Where appropriate, Omvora’s services provide for:

  • human approval;
  • human escalation;
  • correction;
  • review; or
  • intervention.

AI processing will not automatically create permission to use personal data for an unrelated purpose.

Where an external AI or technology provider is used, the applicable provider may process relevant information according to the service configuration, contractual terms and applicable law.

21. Human involvement

Where a service is designed to provide human escalation, users may request human assistance where that functionality is available. For example, customer-support automation may hand a conversation to a human operator.

The existence of AI or automation does not by itself mean that a person will never review information.

22. Marketing and promotional communications

We may send promotional communications where we are legally permitted to do so and where any required consent or preference has been obtained. Promotional calls and SMS, where used, follow the Telecom Regulatory Authority of India’s commercial-communication rules, including the National Do Not Call preferences.

Marketing preferences are separate from consent necessary to respond to an enquiry or provide a requested service where separation is required.

You may withdraw a marketing preference using:

  • the one-tap unsubscribe link in every update, or replying STOP;
  • the relevant account or communication preference; or
  • privacy@omvoramedia.com.

Your address is removed from our updates list automatically — at once for the link, within minutes for a STOP reply — and in every case within 7 days. We keep only a one-way hash of the address, so that the withdrawal keeps being honoured.

Withdrawal from marketing does not necessarily affect non-marketing communications required to provide a service or comply with law.

23. Cookies and similar technologies

Current public website position

Cookies are small files a website asks your browser to keep; “localStorage” and “sessionStorage” are similar places in your browser where a website can keep a setting. This section lists every one of them this website uses.

The public Omvora website uses no analytics, no advertising trackers and no behavioural advertising systems, and our own server sets no cookies. Its content-security policy allows no third-party scripts, except Cloudflare Turnstile on the contact page (section 4.4), which checks that the form is sent by a person and sets no cookie.

We do not use the public website to build advertising profiles from your visit.

Essential technical processing nevertheless occurs through infrastructure used to deliver and secure the website. For example, Cloudflare processes technical connection information such as IP address and request information, and may set the security cookies listed below.

Everything this website stores in your browser

Name Set by Type Category Purpose How long Needs your consent?
__cf_bm Cloudflare Cookie Strictly necessary Bot management: tells people from automated traffic, to keep the website available. Set only when Cloudflare needs it About 30 minutes No
cf_clearance Cloudflare Cookie Strictly necessary Holds the result of Cloudflare’s bot detection: Cloudflare adds a small script to each page it serves, and when that script runs in your browser, this cookie records the outcome. Also set when Cloudflare checks a visitor, and for every visitor while the website is under attack and its “under attack” protection is on Set by Cloudflare No
Turnstile check Cloudflare Script, contact page only Strictly necessary Confirms that a person is sending the contact form (section 4.4) No cookie in the way we use it No
omvora-consent Omvora localStorage Strictly necessary Keeps your choice in the cookie & storage banner and its receipt number, so the banner is not shown again until you change it or the banner’s version changes Until you clear it or choose again No
omvora-sound Omvora localStorage Functional / preferences Remembers whether you turned sound on or off. Set only when you press the sound button Until you clear it Yes
omvora-motion Omvora localStorage Functional / preferences Remembers that you turned text animation off Removed when you turn animation back on Yes
omvora-place Omvora sessionStorage Functional / preferences Returns you to where you were on the home page Until you close the tab Yes
lastExternalReferrer, lastExternalReferrerTime Meta (Facebook / Instagram), not this website localStorage Not used by us (advertising) Written by Meta’s own script, which the Instagram and Facebook in-app browsers add to every page they show. This website loads no Meta script (its security policy allows only its own scripts) and never reads these values; each time one of our pages loads, it deletes them Deleted by us on every page load No: we do not set or use them

Performance / analytics and targeting / advertising: none are used on this website. The banner shows them as “not used on this website”, with no switch that would do anything.

If you open this website inside the Instagram or Facebook app, that app’s own browser can add Meta’s tracking script to the page and write the two lastExternalReferrer items above; they are not ours, we do not use them, and our page removes them. To avoid them entirely, open the website in your usual browser.

The three functional items stay in your browser and are never sent to us. Without your consent they still work while the page is open, but are not remembered.

The cookie & storage banner

On your first visit, and again whenever the banner’s version changes, a banner asks what this website may keep in your browser. It does not block the page. It offers:

  • Accept all — strictly necessary items and the functional preferences;
  • Decline all — strictly necessary items only;
  • Show details — the table above; and
  • Save my choices — the choices you set with the switches.

Strictly necessary items are always on and cannot be switched off, because the website cannot be delivered safely without them. Nothing is set in the functional category until you allow it.

Changing your mind. Open Cookie settings at the foot of any page to see or change your choice at any time. Changing or withdrawing a choice is as easy as giving it. When you switch the functional preferences off, the website removes them from your browser.

Your consent receipt. Each choice is recorded on Omvora’s own server in India as an anonymous receipt: a random receipt number (also kept in your omvora-consent value), the choices, the banner’s version and the time. It holds no IP address, no name and nothing else. It is kept for 1 year after the choice, so that we can show what was chosen, and then deleted. The receipt number is shown in the banner’s details; quote it to privacy@omvoramedia.com to ask about the receipt or to have it erased.

Your browser’s own controls

Your browser lets you see, block and delete cookies and site storage, usually under its privacy or site settings. Clearing this website’s storage removes your preferences and your banner choice, and the banner will ask again. If you block Cloudflare’s security cookies, Cloudflare may check your browser more often, and while the website is under attack it may not be able to let you in.

Future changes

If Omvora introduces:

  • analytics;
  • advertising;
  • marketing pixels;
  • non-essential cookies;
  • behavioural tracking;
  • personalisation technologies; or
  • similar technologies,

we will update this Privacy Notice and the banner’s table, and ask for your consent in the banner before deploying technologies for which consent is required. A new banner version asks you again.

24. Do Not Track

Some browsers provide a “Do Not Track” signal. Browser implementations are not uniform. Because this website does not track visitors, the signal changes nothing on it. Where applicable law requires Omvora to recognise a particular browser privacy signal, we will implement the required mechanism.

25. Who we may share personal data with

We may disclose personal data to the following categories where necessary and lawful.

Technology and infrastructure providers, including providers of:

  • hosting (for example Cloudflare, which serves this website and routes our email);
  • cloud infrastructure;
  • databases;
  • security;
  • backups;
  • email (Google, whose Gmail service holds our mailbox and sends our email);
  • messaging;
  • communications;
  • monitoring;
  • AI;
  • transcription;
  • analytics where introduced;
  • payment processing; and
  • other technology required to provide a service.

Client organisations, where processing is performed for a client.

Professional advisers, such as:

  • accountants;
  • auditors;
  • lawyers;
  • consultants; and
  • other professional advisers.

Payment providers, for payment, settlement, reconciliation and refunds.

Government and regulatory authorities, courts and law enforcement — for example courts and tribunals, the Data Protection Board of India, CERT-In, law-enforcement and investigating agencies, and tax authorities — where disclosure is:

  • required by law;
  • required by a valid legal process;
  • required by a competent authority; or
  • otherwise permitted by applicable law.

Security and fraud providers, where reasonably necessary to detect, prevent or investigate fraud, abuse, security incidents or unlawful activity.

Anyone you ask us to share with, when you ask us to.

We do not sell personal data, and we do not share it with advertisers or data brokers.

26. Subprocessors

Where Omvora uses a third-party service provider to process personal data on our behalf, we seek to ensure that the provider is subject to appropriate contractual, confidentiality, security and privacy obligations.

Depending on the service, subprocessors may include providers for:

  • cloud hosting;
  • databases;
  • communications;
  • AI;
  • email;
  • storage;
  • backups;
  • payments;
  • monitoring;
  • transcription;
  • security; and
  • other infrastructure.

The specific subprocessors applicable to a client service may be identified in the relevant agreement or subprocessor register.

27. International data processing

Some infrastructure or technology providers may process personal data outside India. Accordingly, personal data may be processed or stored in another country depending on:

  • the service;
  • the selected infrastructure;
  • the provider;
  • the client’s configuration; and
  • applicable law.

Where the DPDP Act or other applicable Indian law imposes restrictions or conditions on transfers or processing outside India, Omvora will comply with those requirements. In particular, we will not transfer personal data to a country or territory to which the Central Government has restricted transfers under section 16 of the DPDP Act, and we will meet any requirement the Central Government specifies under rule 15 of the DPDP Rules about making personal data available to a foreign State or an entity under its control.

For this website, the providers that may process personal data outside India are Cloudflare, which serves and protects the website through its global network, and Google, whose Gmail service holds our mailbox, including the email copy of each enquiry. The enquiry service, its consent records and the banner’s consent receipts are on our own server in India.

Where personal data is processed outside India, we seek to use providers that commit to protect it by contract, and it may be subject to the laws of the country where it is processed, including requests from authorities there.

We will not represent that all Omvora data is permanently stored exclusively within India unless the relevant service documentation expressly states this.

28. Security safeguards

Omvora maintains reasonable technical and organisational safeguards appropriate to the nature and risk of processing. Depending on the system, safeguards may include:

  • encryption in transit;
  • encryption or equivalent protection at rest where appropriate;
  • access controls;
  • role-based access;
  • multi-factor authentication;
  • secure credential management;
  • restricted administrative access;
  • security monitoring;
  • logging;
  • backup procedures;
  • recovery procedures;
  • vulnerability and patch management;
  • device security;
  • incident-response procedures;
  • vendor controls;
  • confidentiality obligations; and
  • periodic review of security measures.

From the date the DPDP Rules apply, these include at least what rule 6 of the Rules sets: protecting personal data by encryption, masking or similar means; controlling access to the systems that hold it; logs, monitoring and review so that unauthorised access is detected, investigated and remedied; backups so that processing can continue if data is lost or damaged; keeping those logs and the related personal data for one year; security terms in our contracts with Data Processors; and the technical and organisational measures that make these safeguards work in practice.

These safeguards are set out in a documented security programme with managerial, technical, operational and physical controls suited to the information we hold, which is the approach rule 8 of the SPDI Rules describes. Omvora does not hold an IS/ISO/IEC 27001 certification.

This website is served over HTTPS only, with strict transport security, and keeps no personal data in your browser: the only item it keeps there regardless of your choice is your banner choice with its anonymous receipt number. Enquiries sent through it are held by our enquiry service on our own server in India, in a container that is isolated from our other systems and reachable only through the website.

No internet-connected system can be guaranteed to be completely secure.

29. Security logs and cyber-security requirements

Where applicable to Omvora’s systems and activities, we maintain technical and security logs in accordance with applicable cyber-security requirements:

  • the CERT-In directions of 28 April 2022 under section 70B of the Information Technology Act, 2000, which require covered entities to keep ICT-system logs for a rolling 180 days within Indian jurisdiction and to report specified cyber-security incidents to CERT-In within 6 hours of noticing them; and
  • from 13 May 2027, the DPDP Rules, which require Data Fiduciaries to keep the logs of processing, and the related personal data, for at least one year for the purposes the Rules specify.

This retention is separate from ordinary customer-data retention and does not mean that all personal data is retained for these periods.

30. Personal-data breaches

Omvora maintains an incident-response process for suspected personal-data breaches. When a breach is identified, we will:

  1. detect and record the incident;
  2. contain and investigate it;
  3. assess affected systems and data;
  4. assess potential consequences;
  5. implement mitigation;
  6. determine applicable notification requirements;
  7. notify affected Data Principals where required;
  8. notify competent authorities where required;
  9. document remedial measures; and
  10. take reasonable steps to prevent recurrence.

From the date the DPDP breach rules apply, we will, on becoming aware of a personal-data breach, inform each affected Data Principal without delay, in clear and plain language and through the email address or other contact you gave us, of what happened (its nature, extent and timing), its likely consequences, what we are doing about it, what you can do to protect yourself, and whom to contact; inform the Data Protection Board of India without delay; and give the Board a detailed report within 72 hours, or any longer period the Board allows. Cyber-security incidents are also reported to CERT-In where its directions require.

Where Omvora is a Data Processor, we inform the client without delay so the client can meet its own obligations.

31. Data retention

Omvora does not retain personal data indefinitely. Retention depends on:

  • the purpose for which the data was collected;
  • the nature of the relationship;
  • contractual requirements;
  • security requirements;
  • accounting requirements;
  • tax requirements;
  • dispute resolution;
  • legal claims;
  • statutory retention requirements; and
  • applicable law.

Enquiry information. An enquiry is kept for 12 months from when it arrives, then deleted automatically — from our enquiry service and from our mailbox — unless it has become work with us or another lawful retention reason applies.

Updates list. An address is kept until you withdraw, then removed automatically (see section 22). A request to receive updates that is never confirmed is deleted after 30 days.

Client records. Kept for the duration of the client relationship and afterwards for the period reasonably required for legal, tax, accounting, contractual, security or dispute-resolution purposes. Invoices and accounting records are kept only for the minimum period Indian tax and GST law requires, and then deleted.

Client-controlled data. Where Omvora is a Data Processor, data is kept, returned or deleted as the client’s agreement and instructions require, and in any event as required by law.

Consent records. Kept for as long as the processing they cover continues. Afterwards they are reduced to what proves the consent — a one-way hash of the email address, the purpose, the times and the notice versions — and kept for three years, the general limitation period, then deleted.

Security logs. Our web server’s access logs are kept for 180 days, on our server in India, as section 29 describes. Security events recorded by our enquiry service are kept for one year, longer only while an incident needs them.

Cookie & storage choices. The anonymous receipt of a banner choice is kept on our server for 1 year after the choice, then deleted. What is kept in your own browser, and for how long, is in the table in section 23.

Privacy requests and grievances. The record of how we handled a request or grievance is kept for three years after it is closed, so that we can show what we did.

Our audit trail. A record of what our systems and staff did with personal data — references and times, never the content itself — is kept for three years, protected so that it cannot be altered unnoticed.

AI conversations. Where an Omvora service retains AI interactions, the retention period depends on the service and purpose. AI interactions may be retained for purposes such as:

  • providing the service;
  • customer support;
  • troubleshooting;
  • security;
  • abuse prevention;
  • dispute resolution;
  • quality assurance; or
  • lawful service improvement.

They will not be retained indefinitely merely because they were processed.

Deletion. When personal data is no longer required and no lawful retention requirement remains, Omvora will take reasonable steps to:

  • delete it;
  • anonymise it; or
  • otherwise render it no longer identifiable.

Where a Data Processor holds personal data we made available to it, we will have it erased too, as section 8(7) of the DPDP Act requires.

The DPDP Rules require an advance message at least 48 hours before erasure only from the classes of Data Fiduciary listed in their Third Schedule (large e-commerce, online-gaming and social-media platforms). Omvora is not one of them, so the enquiry and updates periods above run without a separate message; you can ask us at any time what we hold and until when.

32. Accuracy

Where personal data is used to make a decision that affects a Data Principal or is disclosed to another Data Fiduciary, Omvora will take reasonable steps to ensure that relevant personal data is accurate, complete and consistent to the extent required by applicable law.

You should notify us if information that we maintain about you is inaccurate.

33. Your privacy rights

Subject to the DPDP Act, the DPDP Rules and applicable law, you may have the following rights, which you may exercise free of charge:

  • Right to access information — a summary of the personal data processed about you, the processing activities, and the identities of the other Data Fiduciaries and Data Processors it has been shared with, subject to applicable legal limitations.
  • Right to correction — of inaccurate or misleading personal data.
  • Right to completion — of incomplete personal data.
  • Right to updating — of personal data.
  • Right to erasure — where the personal data is no longer required for the specified purpose and no lawful retention requirement applies.
  • Right to withdraw consent — where processing relies on consent.
  • Right to grievance redressal — concerning our processing of your personal data.
  • Right to nominate — another individual to exercise your rights, in accordance with applicable law, in the event of your death or incapacity. To nominate, write to privacy@omvoramedia.com with the name and contact details of the person you nominate; you can change or cancel a nomination the same way.

These rights apply to personal data you gave us with your consent or for a purpose you gave it for (section 7(a) of the DPDP Act). Erasure does not reach records the law requires us to keep, such as tax records, and we will tell you which records those are.

33.1 Your duties

The DPDP Act (section 15) also asks you, when you use these rights, to:

  • follow the law while using them;
  • not impersonate another person when giving personal data;
  • not hide material information when giving personal data for an official document, identifier or proof of identity or address;
  • not file a false or frivolous grievance or complaint with us or with the Board; and
  • give only information that is verifiably authentic when asking for correction or erasure.

34. How to exercise your rights

Send a request to privacy@omvoramedia.com.

Your request should include enough information for us to:

  • identify you;
  • understand the request;
  • locate the relevant personal data; and
  • prevent unauthorised disclosure of another person’s data.

We may request reasonable verification where necessary.

To find your records we usually need only the email address or phone number you used with us, and, if you have one, the enquiry reference on your receipt email or the receipt number shown in the cookie & storage banner’s details.

We acknowledge a request within 2 working days — in practice, an email sent to privacy@omvoramedia.com is registered and acknowledged automatically within minutes, with a reference number and the date by which we will respond — and complete it within 30 days, or tell you within that time why we cannot. This is well within the ninety days the DPDP Rules allow. Every reply to a request names the person who can answer your questions about the processing, the Grievance Officer in section 37, with his contact details.

This address is published in this Notice and at the foot of every page of this website.

35. Requests concerning client-controlled data

If Omvora processes your personal data on behalf of a client, the client may be the relevant Data Fiduciary. In such cases, you may be directed to the client for exercising your rights.

Omvora will provide reasonable assistance to the relevant Data Fiduciary as required under the applicable agreement and law.

36. Identity verification

We may request reasonable information to verify that a rights request is genuinely made by the relevant Data Principal or an authorised representative.

We will not request unnecessary information merely to exercise a privacy right.

37. Grievance redressal

For privacy and personal-data grievances:

Grievance Officer: Mr Mujtaba Mirza Omvora Media & Automation Email: privacy@omvoramedia.com Phone: +91 90040 22222 Address: Hawal, Srinagar, Jammu & Kashmir 190011, India

We acknowledge a grievance within 2 working days and resolve it within 30 days of receiving it. This is within the one month the SPDI Rules require and the ninety days the DPDP Rules allow.

Each grievance sent to privacy@omvoramedia.com is registered automatically with a reference number; quote it to follow up. We handle every grievance fairly, courteously and on time, and when we answer we tell you how to take the matter further (section 39).

Hours: Monday to Friday, 11 am to 6 pm IST. Email reaches us at any time.

38. Data Protection Officer

Omvora will appoint and publish the details of a Data Protection Officer if and when Omvora becomes a Significant Data Fiduciary or another applicable law requires appointment of a DPO.

Until such appointment is legally required, the Grievance Officer named in this Notice is the person authorised to answer questions about the processing of your personal data on Omvora’s behalf. His business contact information is in sections 2 and 37.

Omvora has not been notified as a Significant Data Fiduciary.

We do not describe an individual as a statutory DPO merely for marketing purposes.

39. Data Protection Board of India

If you have first raised a grievance with Omvora and it remains unresolved, or you are dissatisfied with the response, you may complain to the Data Protection Board of India, which the DPDP Act establishes as its enforcement body, in the manner the Board prescribes, subject to the applicable statutory procedure and commencement of the relevant provisions. The Act requires a grievance to be raised with the Data Fiduciary first. The Board works as a digital office, so a complaint to it is made online, in the manner it publishes. No consent you give us can take away your right to complain to the Board.

40. Children

For purposes of the DPDP Act, a child means an individual who has not completed eighteen years of age.

Omvora’s public website and business services are designed for businesses and adults. The contact form asks you to confirm that you are 18 or older.

We do not intentionally seek to collect children’s personal data through ordinary business enquiries.

Where a service is reasonably likely to process children’s personal data, Omvora will implement the applicable requirements, including the required verifiable parental or lawful-guardian consent mechanism.

Omvora will not knowingly use children’s personal data for tracking, behavioural monitoring or targeted advertising directed at children.

If you believe a child has provided personal data to Omvora without the required authorisation, contact privacy@omvoramedia.com and we will delete it.

Persons with disability. Where a person with disability cannot take legally binding decisions and has a lawful guardian, the guardian gives consent and uses the rights in this Notice on their behalf. We will check that the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law, as rule 11 of the DPDP Rules requires.

41. Personal data relating to health and other sensitive information

The DPDP Act does not create the separate “sensitive personal data or information” category used by the SPDI Rules. However, while the SPDI Rules apply, passwords, financial information such as bank-account or payment-instrument details, and medical records and history are sensitive personal data or information under them, and we handle such information as those Rules require. Health-related information also carries significantly greater privacy, security and contractual risk.

Where Omvora processes health or patient-related information:

  • we apply appropriate security controls;
  • access is restricted to authorised persons;
  • processing is limited to the agreed service;
  • the clinic/client remains responsible for its own legal obligations where it determines the processing;
  • Omvora will not use patient information for advertising; and
  • the administrative clinic product does not provide medical diagnosis or treatment.

42. Third-party websites

Our website may contain links to:

  • social-media platforms;
  • payment providers;
  • client platforms;
  • third-party services;
  • documentation; or
  • other websites.

Those websites have their own privacy practices. This Privacy Notice does not govern processing performed independently by third parties. You should review the privacy notice of the relevant third party before providing personal data to it.

43. Third-party platforms

When Omvora integrates with platforms such as WhatsApp, Telegram, Meta, payment providers, hosting providers, AI providers or other third-party systems, those providers may independently process personal data under their own terms and policies.

Omvora cannot control:

  • their independent processing;
  • their infrastructure;
  • their legal obligations;
  • their availability; or
  • changes they make to their services.

Where Omvora is responsible for selecting a processor for a service, we will take reasonable steps to ensure appropriate contractual and security protections.

44. Fraud, abuse and security

We may process information where reasonably necessary to:

  • prevent fraud;
  • investigate abuse;
  • protect systems;
  • protect customers;
  • protect employees;
  • investigate security incidents;
  • enforce our terms;
  • prevent unlawful activity; or
  • protect our legal rights.

Such processing will be limited to what is reasonably necessary and permitted by law.

Protect yourself from people pretending to be us. Omvora will never ask you, by email, message or telephone, for an OTP, a CVV, a card or UPI PIN, a password, or your full card or bank-account details. We do not call or message people offering prizes, free gifts or lucky-draw rewards. We take payment only as a quotation or invoice from us states. Our only contact details are those in section 2. If someone claiming to be Omvora asks for any of these, do not reply or pay: report it to privacy@omvoramedia.com, and, if you have lost money, to your bank and to the national cyber-crime helpline 1930 or cybercrime.gov.in.

We may disclose personal data where necessary to:

  • comply with applicable law;
  • respond to a valid legal process;
  • comply with a court order;
  • respond to lawful government requests;
  • cooperate with regulators;
  • establish or defend legal rights;
  • investigate fraud;
  • investigate security incidents; or
  • protect the safety of individuals.

We will seek to limit disclosures to the information reasonably required for the relevant purpose, and we will tell you about a disclosure unless the law forbids it.

46. Business transfers

If Omvora undergoes:

  • restructuring;
  • merger;
  • acquisition;
  • sale of assets;
  • change in business structure; or
  • transfer of a service,

personal data may be transferred as part of that transaction where legally permitted.

Any successor or acquiring entity will be bound by applicable law and by the commitments in this Notice for the personal data it receives. Where required, affected individuals will receive appropriate notice and, where the law requires, will be asked for fresh consent.

47. International users, governing law and jurisdiction

Omvora is based in India. The website may technically be accessible from outside India, but our services and legal obligations may differ depending on where a user is located.

Where another jurisdiction’s mandatory privacy law applies to a particular processing activity, Omvora will assess and comply with the applicable requirements to the extent required.

This Notice primarily addresses Indian law. It is governed by the laws of India, and, subject to your right to approach the Data Protection Board of India or any other authority the law provides, the courts at Srinagar have jurisdiction.

48. Changes to this Privacy Notice

We may update this Notice when:

  • our services change;
  • our data-processing practices change;
  • our technology changes;
  • new processors are introduced;
  • applicable law changes; or
  • additional privacy safeguards are implemented.

The version number and effective date will be updated when material changes are made. Where a change affects personal data we already hold about you, we will tell you by email or through the service.

Where required, we will provide additional notice or obtain fresh consent. We will not treat an old consent as automatically authorising an unrelated new processing purpose where fresh consent is legally required; consent given under an earlier version covers only the purposes that version named.

49. Effective date

Version: 1.3 · Effective: 13 October 2026 · Last reviewed: 13 October 2026

Version 1.3 changes our hours to Monday to Friday, 11 am to 6 pm IST (sections 2 and 37); how quickly we acknowledge and resolve a grievance is unchanged. Version 1.2 (28 September 2026) declared the storage keys Meta’s in-app browser writes as not ours and described how the website removes them. Version 1.1 adds Cloudflare Turnstile on the contact form (section 4.4); the cookie & storage banner, the table of everything the website stores in your browser and the anonymous consent receipt (sections 4.4 and 23); what happens if you do not give information (section 4.5); the ground for each use (section 15); transfers outside India (section 27); the minimum security safeguards (section 28); your duties (section 33.1), response times and how to nominate (sections 33 and 34); persons with disability (section 40); and a warning about people pretending to be us (section 44). Version 1.0 was effective from 23 September 2026.

50. Contact us

Omvora Media & Automation Registered partnership firm Hawal, Srinagar, Jammu & Kashmir 190011, India

Appendix A — Processing summary

Data category Examples Primary purpose
Identity Name, user ID Identification/service
Contact Email, phone, WhatsApp Communication
Enquiry Messages, requirements Responding/proposals
Account Login/account identifiers Service operation
Messaging Chats, metadata, attachments Automation/support
Voice Audio/transcripts Requested service
Media Images/video/documents Requested service
Business Company, role, billing Client administration
Payment Transaction/reference/status Payment/accounting
Integration Tokens, IDs, API configuration Connecting services
Clinic administration Booking, queue, reminder, payment status Administrative service
Technical IP, browser, device, logs Security/operation
Consent Timestamp, purpose, notice version, withdrawal Consent management
Browser storage Banner choice, sound, animation and scroll preferences (section 23) Security, your choice, your preferences
Consent receipt Random receipt number, choices, banner version, time Showing what was chosen
Support Tickets/correspondence Customer support
Security Authentication/security events Security/fraud prevention

Appendix B — Rights request

To request access, correction, completion, updating, erasure, withdrawal of consent, nomination, or to raise a privacy grievance:

Email: privacy@omvoramedia.com Subject: DPDP Privacy Request — [Request Type]

Please provide:

  1. your name;
  2. contact information;
  3. nature of your request;
  4. relevant account/service information, if applicable; and
  5. any information reasonably necessary to identify the relevant records.

Do not send passwords, OTPs, CVVs, PINs or unnecessary identity documents by ordinary email.

Omvora may request reasonable verification where required to protect against unauthorised disclosure.