Data Processing Notice

1. Introduction

Orasta ("Orasta", "we", "us", or "our") is a startup providing Meta Ads strategy, campaign management, advertising creative, and performance-related services to businesses worldwide.

This Data Processing Notice explains the general principles that may apply when we handle personal data in connection with our website, business enquiries, client relationships, advertising campaigns, lead generation, reporting, and related services.

This notice should be read together with our Privacy Policy, Cookie Policy, Terms of Use, and any applicable written service agreement or data processing agreement.

This notice is a general description of our intended approach. It does not replace a contract-specific data processing agreement where one is required.

2. Scope of This Notice

This notice may apply to personal data handled in connection with activities such as:

• Website enquiries and prospective client communications.
• Client onboarding and business relationship management.
• Meta Ads campaign planning, management, and optimisation.
• Advertising creative development and campaign reporting.
• Lead generation, lead handling, and campaign measurement.
• Customer relationship management and related marketing workflows.
• Technical support and project communications.

The precise activities performed depend on the services requested by each client. Not every activity listed above is necessarily performed for every client or through every engagement.

3. Controller and Processor Roles

3.1 Orasta as Controller or Data Fiduciary

When Orasta determines the purposes and means of processing personal data for its own business operations, we may act as a controller under applicable data protection laws or as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023, where applicable.

Depending on the circumstances, this may include processing business contact details, website enquiries, prospective client information, client account contacts, correspondence, and records required to manage our own business relationships.

3.2 Orasta as Processor or Data Processor

When Orasta processes personal data on behalf of a client and in accordance with that client's documented instructions, we may act as a processor or Data Processor under applicable law.

Depending on the agreed services, this may include handling campaign-related lead information, client-provided audience data, advertising reporting information, or other personal data made available to us for campaign delivery.

In these circumstances, the client will generally determine the purposes of processing and remains responsible for its own obligations as controller or Data Fiduciary, subject to the actual arrangement and applicable law.

3.3 Roles Depend on the Actual Activity

The role of each party must be determined by examining the actual processing activity, the decisions each party makes, and the applicable legal requirements. A party's contractual label alone does not necessarily determine its legal status.

Meta and other technology providers may have separate roles and responsibilities under their own terms and applicable data protection laws. Orasta does not determine those providers' legal roles merely by using their services.

4. Categories of Personal Data

Depending on the service and the information supplied or accessed, personal data may include:

• Business contact information: names, business email addresses, telephone numbers, job titles, and company details.
• Enquiry and communication data: messages, project briefs, proposals, feedback, support requests, and correspondence.
• Campaign information: campaign settings, performance reports, conversion measurements, and related advertising information.
• Lead information: information submitted through advertising lead forms or other client-approved lead-generation channels, where included in the agreed service.
• Audience information: client-provided audience lists or identifiers, where the client has authorised their use and the service requires them.
• Technical information: limited device, browser, website interaction, or diagnostic information where relevant technologies are enabled.
• Administrative information: project records, service history, billing contacts, and related business documentation.

We do not assume that every category is collected or processed in every engagement. The categories actually involved depend on the services, tools, data supplied, and relevant processing instructions.

5. Purposes of Processing

Where applicable to the engagement, personal data may be processed for purposes such as:

• Responding to enquiries and communicating with clients.
• Preparing proposals and providing contracted services.
• Planning, implementing, and managing advertising campaigns.
• Measuring campaign performance and preparing reports.
• Supporting lead management and agreed marketing workflows.
• Maintaining service quality and troubleshooting issues.
• Protecting systems, accounts, and business information.
• Managing invoices, records, disputes, and legal obligations.

Where Orasta acts as a processor, processing will be governed by the applicable client instructions and contractual terms, subject to legal obligations that apply to Orasta.

6. Instructions and Client Responsibilities

Where Orasta acts as a processor, the client is responsible for providing appropriate and lawful instructions for the processing activities it requests.

Depending on the engagement and applicable law, clients may be responsible for:

• Establishing an appropriate legal basis for collecting and using personal data.
• Providing required privacy notices and obtaining valid consents where necessary.
• Ensuring that audience lists and lead information may lawfully be shared with Orasta and relevant providers.
• Ensuring that campaign targeting and advertising practices comply with applicable law and platform policies.
• Providing accurate instructions and identifying applicable restrictions on data use.
• Responding to individuals' requests where the client is responsible for doing so.

Orasta may request clarification where instructions appear unclear or raise material data protection concerns. Any suspension or refusal of processing will be handled in accordance with the relevant agreement and applicable law.

7. Legal Bases and Lawful Processing

Where Orasta determines the purposes and means of processing, we will identify and rely on an appropriate legal basis or lawful ground where required by applicable law.

Depending on the circumstances and jurisdiction, this may include taking steps requested before entering into a contract, performing a contract, complying with legal obligations, obtaining consent, or relying on another lawful ground permitted by applicable law.

Where Orasta acts as a processor, the client is generally responsible for determining and documenting the lawful basis for the processing it instructs, subject to the parties' respective legal obligations.

The legal basis applicable to any particular activity depends on the facts, jurisdiction, and type of personal data involved. This notice does not establish a single legal basis for every processing activity.

8. Disclosure and Sharing of Data

Personal data may be made available to third parties where necessary for an agreed service, authorised by the relevant client, or otherwise permitted or required by applicable law.

Depending on the actual service configuration, recipients may include:

• Advertising platforms: Meta services and other platforms selected for a campaign.
• Technology and hosting providers: providers used for website hosting, storage, security, communication, or technical operations.
• Analytics and reporting providers: tools used to measure or report performance, where enabled.
• Client-authorised recipients: the client's personnel, CRM systems, or service providers involved in an agreed workflow.
• Professional advisers: legal, accounting, or other advisers where necessary.
• Authorities: public authorities or other recipients where disclosure is required or permitted by applicable law.

The list above describes possible recipient categories, not a verified list of providers currently engaged by Orasta. The actual providers used for a particular service should be identified and documented where required.

9. Sub-processors and Service Providers

Where Orasta uses another provider to process client personal data on our behalf, that provider may act as a sub-processor, depending on its role and the applicable legal framework.

Where required by law or contract, we will address relevant sub-processor arrangements through appropriate contractual terms, confidentiality obligations, and data protection safeguards.

Where a client requires a list of sub-processors, details of relevant providers, or notification of changes, the applicable arrangements should be documented in the relevant data processing agreement or other written contract.

Orasta does not publish an exhaustive provider list in this notice because the actual service providers and integrations must first be verified.

10. International Data Transfers

Orasta serves clients internationally. Depending on the services, technology providers, and client locations, personal data may be accessed or processed in more than one country.

International transfers may be subject to specific requirements under applicable data protection laws. Where such requirements apply, the relevant parties should identify the transfer, assess the applicable conditions, and implement required safeguards.

Depending on the applicable legal framework, safeguards may include contractual arrangements, approved transfer mechanisms, or other measures permitted by law.

The countries involved and the safeguards required depend on the actual processing arrangement. This notice does not guarantee that every transfer mechanism is appropriate for every jurisdiction.

11. Data Retention and Deletion

Personal data should be retained only for as long as reasonably necessary for the relevant purpose, subject to applicable legal, contractual, operational, and security requirements.

Where Orasta acts as a processor, retention and deletion of client data will be governed by the applicable instructions and agreement, subject to any legal requirements that apply to Orasta.

At the end of an engagement, the parties should document how relevant personal data will be returned, deleted, or retained where required or permitted by law.

Specific retention periods depend on the data category, purpose, service configuration, and applicable obligations. This notice does not assign an unverified fixed retention period to every category of data.

12. Security and Confidentiality

We recognise the importance of protecting personal data against unauthorised access, disclosure, alteration, loss, or misuse.

Depending on the nature of the engagement and the information involved, appropriate measures may include:

• Limiting access to authorised personnel.
• Using appropriate account and access controls.
• Maintaining confidentiality obligations where applicable.
• Using suitable security practices for data transfer and storage.
• Reviewing access permissions when responsibilities change.
• Responding to suspected security incidents as appropriate.

The specific controls in place may vary according to the systems, providers, and services used. No website, network, or storage system can be guaranteed to be completely secure.

Where applicable law or contract requires notification of a personal data breach, the responsible party will follow the relevant notification requirements.

13. Data Subject Rights and Requests

Depending on the applicable law and the circumstances, individuals may have rights concerning their personal data. These may include rights to access, correct, erase, restrict, object to, or obtain a copy of certain personal data, as well as rights relating to consent and complaints.

The availability and scope of these rights depend on the jurisdiction, the applicable legal basis, and any relevant exceptions.

Where Orasta acts as a controller or Data Fiduciary, requests concerning our own processing may be sent directly to us using the contact details below.

Where Orasta acts as a processor, we may refer a request to the relevant client or assist the client in responding, as required by the applicable agreement and law.

To help us identify the relevant processing activity, please describe your relationship with Orasta and the nature of your request. We may need to verify identity or authority before taking action.

14. Children's and Sensitive Personal Data

Our business services are directed primarily at businesses and their authorised representatives. Clients should not provide children's data or sensitive personal information for advertising or audience targeting unless the processing is lawful, necessary for the agreed service, and supported by the required safeguards and permissions.

Certain categories of data may receive additional protection or be subject to specific restrictions under applicable law or advertising platform policies.

Clients must inform Orasta of relevant restrictions and should avoid transferring data that is unnecessary for the agreed services.

15. Automated Processing and Advertising Decisions

Digital advertising platforms may use automated systems for ad delivery, audience selection, measurement, moderation, fraud prevention, and other platform functions.

The operation of those systems is subject to the relevant provider's services, settings, policies, and legal obligations. Orasta does not control all decisions made by third-party advertising platforms.

Where an engagement involves automated processing that is subject to specific legal requirements, the relevant responsibilities and safeguards should be assessed and documented for that engagement.

16. Cookies and Website Technologies

Our website may use cookies, pixels, analytics tools, or other technologies depending on its actual configuration. The purposes and available choices relating to such technologies are described in our Cookie Policy.

This Data Processing Notice does not itself install tracking technologies, activate a consent mechanism, or determine the configuration of third-party tools.

17. Data Processing Agreements

Certain clients or jurisdictions may require a separate Data Processing Agreement (DPA) or data processing addendum that specifies the parties' responsibilities and processing arrangements.

Depending on the services and applicable law, such an agreement may address:

• The subject matter, duration, nature, and purpose of processing.
• The categories of personal data and individuals concerned.
• Documented processing instructions and confidentiality.
• Security measures and assistance with data subject requests.
• Sub-processors and international transfers.
• Personal data breach assistance and notification.
• Data return, deletion, and compliance documentation.

If your organisation requires a DPA, please contact us before transferring personal data or commencing the relevant processing activities. Any DPA must be reviewed and agreed by the parties and tailored to the actual services and legal requirements.

18. Applicable Laws and International Clients

Orasta works with clients in different jurisdictions. Applicable requirements may include India's data protection framework and, where relevant, the EU GDPR, UK GDPR, or applicable US state privacy laws.

The applicability of a particular law depends on factors such as the parties' locations, the individuals involved, the nature of the processing, and the relevant statutory conditions.

This notice is not a declaration that Orasta is subject to every law mentioned or that every legal requirement has been independently assessed. The parties should identify the laws applicable to each engagement and document the required arrangements.

19. Changes to This Notice

We may update this Data Processing Notice to reflect changes to our services, processing activities, technology providers, business practices, or applicable legal requirements.

The updated version will be published on this page, with the effective date amended where appropriate. Where required by law or contract, material changes will be communicated through the appropriate channel.

20. Contact Orasta

For questions about this Data Processing Notice, data processing arrangements, or a request concerning personal data, please contact:

Orasta
Website: https://orasta.pro
Email: info@orasta.pro
Phone: +91-83902-55412