Data Collection & Use Policy

01Purpose and scope

This policy sets the rules Adon Media Group Inc follows when it collects, uses and shares information through the campaigns, landing pages, forms and integrations we build and operate — for our clients and for ourselves. It applies to our team, and we require the partners who receive data from these campaigns to follow it as well.

It works together with our Privacy Policy, which covers this website and our business relationships, and our Acceptable Use Policy.

02Our role

• When we run a campaign for a client, the client is usually the business responsible for the data (the “business” or “controller”), and we act as its service provider or processor. We process the data only on the client’s documented instructions and under a written agreement.
• When we run a campaign for ourselves, we are the business responsible for the data, and the notice on the form explains who will receive it.
• In every case, the form a person fills in identifies who is collecting the information and links to the privacy policy that applies.

03Our principles

• Transparent: people know who is collecting their data, why, and who will receive it — before they submit.
• Consent-based: marketing calls, texts and data sharing happen only with the consent the law requires.
• Minimal: we collect only the fields needed for the request or offer.
• Secure: data is encrypted in transit and sensitive data is encrypted at rest.
• Accountable: we keep records that let us prove what was shown, what was agreed and where data went.

04What our forms may collect

Sensitive information (such as government ID or financial account numbers, or health details) is collected only when it is strictly necessary for the service the person requested and permitted by law. It receives additional protection, is never placed in URLs, analytics or advertising pixels, and is excluded from notifications and webhooks unless a recipient truly needs it.

05Notice at the point of collection

• Every form shows, near the submit button, who is collecting the information, the purpose and who may receive it.
• Every form links to the applicable privacy policy and terms.
• Consent checkboxes are never pre-checked, and disclosures are never hidden, shrunk or obscured.
• We do not use misleading headlines, fake urgency, fake endorsements or “dark patterns” to obtain submissions or consent.

06Consent capture: TCPA and E-SIGN

Express written consent for calls and texts

Where marketing calls or texts may use automated technology or prerecorded or artificial voices, we obtain prior express written consent as required by the Telephone Consumer Protection Act (TCPA) and state laws. The disclosure:

• is clear, conspicuous and separate from unrelated terms;
• identifies the business or businesses that may contact the person — and names each one where applicable law or a partner’s requirements call for it;
• states that calls or texts may use automated technology or prerecorded messages;
• states that consent is not a condition of any purchase;
• explains that message and data rates may apply and how to opt out (for example, reply STOP).

E-SIGN consent

Where agreements or disclosures are provided electronically, we obtain consent under the federal E-SIGN Act and applicable state laws, including notice of the right to receive paper copies, how to withdraw consent, and the hardware and software needed to access the records. A checkbox or click, with the surrounding disclosure, serves as the electronic signature.

What we record with every consent

• the exact consent text shown and its version ID;
• a timestamp (UTC) of the submission;
• the IP address and user agent;
• the page URL and form identifier;
• the recipients or recipient categories disclosed at the time.

Consent versioning

Any change to consent wording creates a new version. Earlier versions are archived, so each record can be matched to the exact wording the person saw. Consent records can be produced to clients, partners and regulators on a valid request.

07Validation and quality

Before a submission is accepted or delivered, it passes automated checks:

• required fields and format checks;
• email and phone validation;
• duplicate detection;
• bot, fraud and abuse screening, such as velocity limits and honeypots;
• suppression and opt-out checks.

Records that fail these checks are not delivered.

08Data minimization

• Forms ask only for what the request or offer needs.
• In ping-post delivery, the “ping” carries only partial, non-identifying data. Full details go only to the accepting recipient.
• Personal information is kept out of URLs, analytics events and advertising pixels.
• Hashed identifiers are sent to advertising platforms for conversion matching only where consent and platform rules allow it.
• Internal reporting uses aggregated or de-identified data wherever possible.

09Security and encryption

• All forms, APIs and deliveries use TLS (HTTPS) in transit.
• Sensitive records are encrypted at rest with AES-256-GCM, with keys kept out of source code.
• Access is limited to people who need it, under least-privilege roles, and access is logged.
• Systems are monitored around the clock, and backups are protected.

More detail is on our Security & Compliance page.

10Real-time delivery and sharing

• Data is delivered in real time over secure APIs, webhooks or CRM integrations — only to recipients the person agreed to, as disclosed on the form.
• Routing rules, including price-tier waterfalls, operate only within those disclosed recipients and the consent given.
• We do not resell or re-share data beyond the scope disclosed at collection.
• Every delivery attempt, response and outcome is logged for reconciliation and audit.
• When a person opts out of sale or sharing, including through a Global Privacy Control signal, their data is not sold or shared.

11Opt-outs, suppression and Do-Not-Call

• Any reasonable method works. People can opt out by replying STOP, clicking unsubscribe, emailing, calling or telling an agent. We honor opt-outs promptly and within the time limits set by law.
• Internal suppression list. Opt-outs are added to a suppression list that is checked before any outreach or delivery, and passed on to the partners who received the data.
• Do-Not-Call. Where we or our clients place telemarketing calls or texts, numbers are checked against the National Do Not Call Registry, applicable state lists and our internal list, unless valid consent or an exemption applies.
• Email. Commercial emails follow the CAN-SPAM Act, include a working unsubscribe option, and unsubscribe requests are honored within 10 business days.
• Global Privacy Control. A GPC signal is treated as an opt-out of sale and sharing for that browser.

12Retention schedule

When we act as a service provider, the client’s written instructions may set different periods. We may keep records longer when the law requires it or to resolve disputes.

13Partner and client obligations

Every partner that receives data from our campaigns, and every traffic supplier we work with, must:

• use the data only for the purpose disclosed to the person;
• comply with the TCPA, the Telemarketing Sales Rule, CAN-SPAM, state telemarketing and privacy laws, and advertising-platform policies;
• honor opt-outs and Do-Not-Call requirements, and pass opt-outs back to us;
• not resell or re-share data unless that was disclosed and consented to;
• protect data with appropriate security and tell us promptly about any incident affecting it;
• delete data when it is no longer needed for the disclosed purpose;
• cooperate with consent and compliance audits;
• for traffic suppliers: send no bot, incentivized-without-disclosure or misleading traffic, and use only approved creatives.

Breaking these rules can lead to suspension, termination and withholding of payment for affected traffic, under our agreements.

14Reviews and accountability

• We review forms, consent wording and disclosures before launch and whenever they change.
• We monitor partner compliance and investigate complaints.
• People who handle campaign data are trained on these rules.
• We follow a documented incident-response process, described on our Security page.

15Questions and requests from consumers

If you submitted a form we operate and want to know what happened to your information, opt out or request deletion, email hello@adonmedia.group with the subject “Data request”. If we processed your data for a client, we will pass your request to that client and help them respond.

16Contact

For questions about this policy, contact:

Adon Media Group Inc
Email: hello@adonmedia.group
Phone: +91 9194135536