PRIVACY POLICY
Last updated: 18 October 2026
Effective date: 18 October 2026
1. Who we are
This Privacy Policy explains how Austin Roy, a sole proprietor based in India, trading as Rampant Cortex™ ("Rampant Cortex™", "we", "us", "our"), collects and uses personal data when you visit rampantcortex.com (the "website"), contact us, or buy our services.
We decide how and why this personal data is used, so we are its "data fiduciary" under India's Digital Personal Data Protection (DPDP) Act, 2023 and its "controller" under the European Union (EU) General Data Protection Regulation (GDPR) and the United Kingdom General Data Protection Regulation (UK GDPR). You can contact us at connect@rampantcortex.com. We are based in Chennai, Tamil Nadu, India.
We provide business-to-business digital services, as described on the website and in your order. Our website and services are for businesses and for people aged 18 or over. We do not knowingly collect children's data. If we learn that we have, we will delete it.
2. The personal data we collect and why
| Category | What it includes | Why we use it | Legal basis (EU and UK GDPR) |
|---|---|---|---|
| Enquiry details | Name, email, business or brand name (optional), website (optional), phone number with country code (optional), the service you are interested in, your message and anything else you choose to tell us | To reply to your enquiry by email or, if you gave us your phone number, by a call about your enquiry, and to discuss our services | Legitimate interests (responding to business enquiries); steps before a contract |
| Call bookings | Name, email and an optional note, given when you book a call through the "Book a call" button | To arrange and hold the call you booked | Steps at your request before a contract; legitimate interests (responding to business enquiries) |
| Client and order details | Business contact details of the people we deal with, billing name and address, tax identification number, orders, invoices, emails and meeting notes | To provide our services, invoice you, keep records and manage our relationship | Contract; legal obligation (tax and accounting); legitimate interests (managing our client relationships and keeping business records) |
| Business leads | Name, work email, phone number, company, role and website, found in public sources such as company websites and professional profiles. In the United Kingdom and the EU, we use only general company email addresses (such as info@ or hello@), not those of named people | To contact businesses that may be interested in our services | Legitimate interests (offering our services to businesses) |
| Payment details | Amount, date, currency, payment method and transaction reference | To take payment, issue refunds and keep accounts | Contract; legal obligation |
| Website usage data | Internet Protocol (IP) address, browser and device type, pages requested, referring site, approximate location and security logs | To run, secure and protect the website | Legitimate interests (operating and securing the website) |
| Analytics data (only if you accept analytics cookies) | Pages viewed, time on site, device type and approximate location, collected through cookies | To understand how the website is used and improve it | Consent |
| Marketing preferences | Your opt-in choice, when you gave it, and any unsubscribe request | To send occasional marketing emails, only if you asked for them | Consent |
Where it comes from. Most of this data comes from you. Some comes from others: for example, a client or agency may give us your business contact details when you are their contact for an order, we find business contact details in public sources (such as company websites and professional profiles) to offer our services, and our payment provider tells us whether a payment was made.
Phone numbers. Giving your phone number is optional. We use it only to call you about your enquiry or order. We do not use it for marketing calls or text messages, and we do not share it except with the service providers listed in section 4.
Do you have to give it? No. But we need your contact details to reply to an enquiry, and the client, order and payment details to provide our services and meet our legal obligations. Analytics and marketing are optional.
Card and bank details are entered with our payment provider, not with us. We do not see or store full card numbers or banking passwords.
Under Indian law, we use personal data either with your consent or for a legitimate use allowed by the DPDP Act, for example where you have voluntarily given us your details for a specific purpose (such as sending an enquiry or placing an order), or where the law requires us to keep records.
Audit data. Our audits are about brands, not individuals. We use public web content, the answers that artificial intelligence (AI) search and answer engines give to our queries, and the brand information you give us. We do not need personal data about your customers, users or employees, and you must not send it to us. If we receive it by mistake, we will delete it and tell you. For clients and agencies, our Generative Engine Optimisation (GEO) Data Handling Terms also apply and prevail for audit data.
What we do not do. We do not sell or rent personal data. We do not make decisions about you by automated means that have legal or similarly significant effects.
AI tools. We use AI tools to find business leads, help us contact potential and existing clients, and keep our client contact records. These tools process only business contact details (such as name, work email, phone number, company and role) and our communications with you, under our instructions. We do not use AI tools on any other personal data, and our audits use brand data only. A GEO analyst reviews the outputs before any Report is delivered.
Client references. We may list a client's business name and logo in our client list. Clients can opt out at any time by emailing us, and we will stop that use going forward. We use a client's audit results, data, findings, quotes or testimonials only with prior written consent. For agencies, we use their name, logo or any of their material only with consent.
Marketing emails. We send marketing emails to people who have opted in, and, where the law allows, to existing clients about similar services and to businesses we have found in public sources. In Canada, we send them only with your express or implied consent, for example where your business email address is published without a statement that you do not want unsolicited messages and our email relates to your role. Each one says who we are and how we got your details, and includes our postal address, our contact details and a simple way to unsubscribe by replying to the email. We treat any reply asking us to stop as an unsubscribe and act on it within 5 business days.
3. Cookies
Cookies are small files stored on your device. We use:
- Essential cookies, which the website needs to work and stay secure, and which remember your cookie choice. These do not need consent.
- Analytics cookies, which help us understand how visitors use the website. These stay off until you click "Accept" in our cookie banner.
| Cookie | Provider | Purpose | Type and duration |
|---|---|---|---|
| __cf_bm, cf_clearance (where used) | Cloudflare | Security and bot protection | Essential; usually 30 minutes |
| Cookie-consent record | Rampant Cortex™ | Remembers your cookie choice | Essential; 12 months |
| _ga | Google (Google Analytics) | Distinguishes visitors | Analytics; 2 years |
| _ga_ followed by an ID | Google (Google Analytics) | Keeps track of a visit | Analytics; 2 years |
You can change your choice at any time through the "Cookie settings" link in the website footer, or block or delete cookies in your browser. Rejecting analytics cookies does not affect your use of the website. Google's own use of data is explained in its privacy policy. We use this opt-in approach for visitors everywhere, including in the United Kingdom, the EU, Canada and the United States.
4. Who we share personal data with
We share personal data only as needed for the purposes above, with:
- Google Workspace (Gmail, Google Calendar, Google Drive and Google Meet), for email, call bookings, documents and video meetings;
- Cloudflare, for website hosting, Domain Name System (DNS), content delivery and security, and for our website forms, including delivering enquiries to our inbox and keeping a backup copy of each enquiry;
- Google Analytics, provided by Google, for website analytics, only if you accept analytics cookies;
- our payment provider, to take payments and issue refunds. It also uses data under its own privacy policy, for example for fraud prevention and legal compliance;
- AI platforms we use for lead finding, outreach and contact management;
- professional advisers and banks, such as our accountant or lawyer, where needed;
- authorities, courts or regulators, where the law requires it or to protect our legal rights; and
- a successor business, if we move the business into a company or transfer it. This policy will continue to apply to your data.
Our service providers may use your data only to provide their services to us.
5. International transfers
We are based in India, and our service providers may store and process data in other countries, including the United States and countries in the EU. Your data may therefore be handled outside the country where you are, and may be accessible to courts, law enforcement and national security authorities in those countries. Indian law allows transfers outside India except to countries the Government of India restricts, and we will follow any such restriction.
If you are in the EU or the United Kingdom, your data is processed in India, which does not have an EU or United Kingdom adequacy decision. Where our providers transfer data, we rely on the safeguards they offer, such as the EU Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum. Some transfers are also necessary to perform our contract with you. You can ask us for more information about these safeguards.
If you are in Canada, Australia or New Zealand, we stay responsible for your data when our providers handle it outside your country, and we use providers whose contracts and security measures protect it to a standard comparable to your local law.
6. How long we keep personal data
| Data | How long we keep it |
|---|---|
| Enquiries (including any phone number and the backup copy of the form) and call bookings that do not lead to work | 12 months after our last contact |
| Business leads who do not become clients | 12 months after our last contact, or until you ask us to stop. If you opt out, we keep only your email address and the date on a do-not-email list |
| Client records (agreements, orders, emails and meeting notes) | The engagement, and 3 years after it ends |
| Audit data | 12 months after delivery of the report |
| Invoices, payment and accounting records | 8 years from the end of the financial year they relate to |
| Analytics data | 14 months |
| Consent records (cookie choices and marketing opt-ins) | While the consent applies, and 12 months after it ends |
| Marketing preferences | Until you unsubscribe. After that, we keep only your email address and the date on a do-not-email list, so that we do not email you again |
| Security logs | 12 months, or longer if we need them to deal with a security incident or the law requires it |
We keep data longer only where we must for accounting, tax or legal reasons (such as a dispute or a security incident), and only for as long as needed.
You may ask us to delete your data sooner. We will do so within one month, except data we must keep for those reasons. Copies in our providers' backups are usually deleted within 6 months, and we do not use them in the meantime.
7. How we protect personal data
We use reasonable security practices and procedures to protect personal data, including access controls, two-factor authentication on our business accounts, encrypted connections (Hypertext Transfer Protocol Secure, HTTPS), and limiting access to people who need it. Non-public client information is also protected by the confidentiality terms in our client agreement, which last for 5 years after that agreement ends.
No system is completely secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires, and take reasonable steps to limit its effect.
8. Your rights by region
Everyone. You may ask us to give you access to your personal data or to correct, update or delete it, and you may withdraw any consent you have given.
India. Under the DPDP Act, you may ask for a summary of your personal data and how we use it, and the identity of those we have shared it with; ask us to correct, complete, update or erase it; use our grievance process (section 9); and nominate another person to exercise your rights if you die or become unable to do so. If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India. These rights and the Board's complaint process apply in full from 13 May 2027. Until then, we also follow the Information Technology Act, 2000 and its rules on reasonable security practices.
EU and United Kingdom. You may ask for access to, correction or deletion of your personal data; ask us to restrict its use; object to our use of it based on legitimate interests; object at any time to direct marketing; receive data you gave us in a portable format; and withdraw consent. You also have the right to complain to the data protection supervisory authority where you live or work (in the United Kingdom, the Information Commissioner's Office, ico.org.uk). You can also complain to us first (section 9).
Canada. Under the Personal Information Protection and Electronic Documents Act (PIPEDA), we collect, use and share your personal information with your consent, which may be implied where it is reasonable (for example, when we use published business contact details to contact you about your work), or as the law otherwise allows. You may ask for access to and correction of your personal information, and withdraw your consent, subject to legal or contractual limits. You may complain to the Office of the Privacy Commissioner of Canada, priv.gc.ca.
Australia. As a small business, we may not be covered by the Privacy Act 1988, but we follow the Australian Privacy Principles anyway. You may ask for access to and correction of your personal information. Please complain to us first (section 9). If we do not respond within 30 days, or you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner, oaic.gov.au.
New Zealand. Under the Privacy Act 2020, you may ask for access to and correction of your personal information. When we collect your information from public sources or from others, we tell you in our first email how we got your details and where to find this policy, as information privacy principle 3A requires. You may complain to the Office of the Privacy Commissioner, privacy.org.nz.
United States. State privacy laws in the United States, such as the California Consumer Privacy Act, apply only to businesses above revenue or data-volume thresholds that we do not currently meet. We still do not sell personal information or share it for cross-context behavioural advertising, and we will honour Global Privacy Control browser signals where the law requires.
How to use your rights. Email connect@rampantcortex.com with the subject "Privacy request". We may need to confirm your identity first. We reply within one month, or sooner where the law requires (20 working days in New Zealand and 30 days in Canada), or tell you within that time if we need longer where the law allows. There is no charge in normal cases.
Withdrawing consent is as easy as giving it: use "Cookie settings" on the website, reply to any marketing email with "UNSUBSCRIBE" in the subject line (or just ask us to stop), or email us. Withdrawal does not affect our use of your data before you withdrew. If you ask us to stop using data we need to provide a service, we may not be able to continue that service.
9. Grievance Officer
If you have a question or complaint about your personal data, contact our Grievance Officer:
- Name: Austin Roy
- Designation: Proprietor, Rampant Cortex™
- Email: grievanceofficer@rampantcortex.com
- Address: Chennai, Tamil Nadu, India
We will acknowledge your grievance within 48 hours and aim to resolve it within one month.
10. Changes to this policy
We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date and, where a change is significant, tell our clients by email.
Complaints: email our Grievance Officer at grievanceofficer@rampantcortex.com.