Privacy Policy

Burraq Quantum (OPC) Private Limited(“we”, “us”, the “Company”) operates Rumin, a marketing automation service. Rumin is a brand of the Company.

This policy explains what personal data we handle, why, and what rights you have. It applies to our website and to the Rumin service.

Two different roles.For account and billing data we decide why and how data is processed, and we are the controller (the “data fiduciary” under Indian law). For data you bring into your workspace, including contact records you upload, you are the controller and we act as a processor on your instructions. Where you are a customer’s customer and are reading this, your relationship is with the business whose workspace holds your data, and they can answer requests about it.

Information you give us

• Account details — the email address used to sign in, your name where you provide it, and your role in a workspace.
• Billing details — the contact and country information needed to invoice, and a record of your subscription. We do not receive or store card numbers.
• Content and configuration — your company profile, your settings, and material you create in the Service.
• Communications — messages you send us for support.

Information from accounts you connect

• Authorisation credentials for advertising and analytics accounts you choose to connect. These are held on our servers, used only to perform the actions you ask for, never sent to your browser, and revoked when you disconnect the account.
• Campaign and performance data — structure, spend, results and related metrics from those accounts.

Contact data you upload

If you use conversion tracking, you may upload records that include email addresses, telephone numbers or advertising click identifiers. These are used only to match your recorded outcomes to advertising activity, and are held within your workspace. Where identifiers are sent to an advertising platform at your direction, they are irreversibly transformed first so the platform cannot read the original values.

Information collected automatically

• Service logs — records of actions taken in the Service, kept so that both of us can see what happened and when.
• Technical data — limited information needed to keep the Service secure and available, such as request counts used to prevent abuse.

Cookies

Strictly necessary cookies keep you signed in and keep your session secure. These are always set, because the Service cannot work without them.

Analytics cookies tell us which pages are useful and where people stop reading.

Advertising cookies let us show our own advertising to people who have visited this website. We do not sell this data, and we do not let anyone else advertise to you on the strength of it.

You choose each of these separately, and nothing is stored and no identifier is created for either until you do. If you decline we ask once and remember the answer. You can change your mind by clearing this site’s data in your browser.

Under India’s Digital Personal Data Protection Act 2023 we process personal data on the basis of your consent, or for the legitimate uses that Act permits, including providing a service you have requested.

We do not sell personal data and we do not use your content to train publicly available AI models.

One thing worth stating precisely.Where you use conversion tracking or audience features, we send transformed contact identifiers to the advertising platform you have connected, because you have instructed us to. We do that strictly as your service provider, for the purpose you set, and we do not use those identifiers for our own purposes or for anyone else’s advertising. We describe it here rather than claim we never share anything, because the second statement would not be true.

Aggregated data. We may derive aggregated, de-identified statistics from use of the Service to evaluate and improve it. This material cannot identify you, your business or any individual, is not re-identified, and never includes the personal data of your own customers.

We share personal data only with the categories of recipient below, only as far as each needs it, and under written terms requiring them to protect it and to act on our instructions.

A current list of the specific providers we use, which you may need for your own compliance records, is available on request to privacy@burraquantum.com. If a provider changes in a way that materially affects your data, we will tell affected customers.

If the Company is involved in a merger, acquisition or sale of assets, personal data may transfer to the successor, who remains bound by this policy until it is replaced with notice to you.

We operate from India and use providers located in India, the European Economic Area and the United States, so personal data may be transferred across borders.

Where data protected by UK or EU law is transferred outside those areas, we rely on the European Commission’s Standard Contractual Clauses, or the UK Addendum, together with additional safeguards where needed. You may request a copy of the safeguards that apply at privacy@burraquantum.com.

Ending a trial pauses automated work; it deletes nothing. You can export your workspace data at any time, and deleting a workspace removes its data from our active systems. Backups are overwritten on their own cycle, within 30 days.

Depending on where you live, you may have the right to:

• ask what personal data we hold about you and get a copy;
• have inaccurate data corrected, and incomplete data completed;
• have data erased;
• restrict or object to how we use it;
• receive it in a portable form;
• withdraw consent at any time, without affecting past processing;
• nominate another person to exercise your rights if you cannot;
• not be discriminated against for exercising any of these rights.

Export and deletion are available directly in the Service. For anything else, write to privacy@burraquantum.com. We respond within 30 days, and will tell you if we need longer. We may need to verify your identity first.

If your data sits in a customer’s workspace, we will refer your request to that customer, who is responsible for answering it.

Complaints. If you are unhappy with our response you may complain to the Data Protection Board of India, or to your local supervisory authority in the UK or EEA. We would rather hear from you first.

California and several other states give residents rights over personal information. The rights listed above are available to you regardless of where you live, and we do not discriminate against anyone for exercising them.

We have never sold personal information and we never will.

California treats showing you our own advertising based on your visit as “sharing”. That only happens if you switch advertising cookies on yourself: they are off until you say otherwise, so nothing is shared unless you choose it. You can turn it back off at any time using Cookie choices at the bottom of any page, which is our equivalent of a Do Not Sell or Share control. We have not shared personal information in the preceding 12 months.

Where we transmit transformed contact identifiers to an advertising platform for a customer, we do so only on their instruction and as their service provider, as described above.

We do not knowingly collect or process sensitive personal information for the purpose of inferring characteristics about anyone. To make a request, write to privacy@burraquantum.com.

As required by Indian law, the following officer answers grievances about how we handle personal data:

TO CONFIRM
Burraq Quantum (OPC) Private Limited
TO CONFIRM
privacy@burraquantum.com

Grievances are redressed within 30 days of receipt. You must raise a grievance with us before approaching a regulator.

The Service analyses your advertising data and proposes changes, and can apply them within limits you set. These decisions concern advertising accounts, not people: they do not evaluate individuals and produce no legal or similarly significant effect on any person.

You control how much the Service may do without asking, every proposed change is shown with its reasoning before it is applied, and you can require approval for everything.

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit, strict separation between customer workspaces, access limited to those who need it, credentials held server-side only, and a record of actions taken in the Service.

No service can promise perfect security. If a breach affects your personal data we will notify you and the relevant authorities as the law requires.

The Service is for businesses and is not directed at children. We do not knowingly collect personal data of anyone under 18. If you believe a child has provided us data, write to privacy@burraquantum.com and we will delete it.

We may update this policy. Material changes take effect at least 30 days after we announce them by email or in the Service, and the effective date above is updated. Previous versions are available on request.

Burraq Quantum (OPC) Private Limited
TO CONFIRM
Privacy: privacy@burraquantum.com · Support: support@burraquantum.com