Privacy policy

Lulu Marketing is a marketing platform operated by BuzzSpark E Services Private Limited, trading as Lulu Marketing ("BuzzSpark", "we", "us"), a company incorporated in India, with its office at B-98, Sector-C, Near Wireless Chauraha, Mahanagar, Lucknow - 226006, Uttar Pradesh, India. This policy explains what personal data we process, why, and the choices you have. It is written to meet India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules, and the requirements of Meta Platform Terms.

1. Who this policy covers

• Customers: businesses that use Lulu Marketing to plan, run and measure their marketing, and the people who sign in on their behalf.
• Partners: vendors such as printers and outdoor media owners who use our partner portal.
• End users: people who interact with our customers' ads, Pages, Instagram accounts, lead forms, WhatsApp numbers or websites.

2. Data we access through Meta (Facebook, Instagram, WhatsApp)

When a customer connects their Meta assets to Lulu Marketing, or shares them with our business, our app "Lulu Marketing Hub" accesses the following, only for the assets that customer has authorised:

We do not sell Meta data, use it to build profiles for advertising outside the customer's own account, share it with data brokers, or use it for purposes other than providing the service to the customer who authorised it.

3. Other data we process

• Account data: name, work email, phone, password (stored only as a salted hash), organisation and role.
• Google Ads: campaign structure and performance (spend, impressions, clicks, conversions) for accounts a customer connects.
• SMS: recipient phone numbers, message content and delivery reports for campaigns a customer sends through us, handled under India's DLT rules.
• Voice: phone numbers dialled, call outcomes and durations for voice campaigns a customer runs, within permitted calling hours and do-not-call rules.
• Offline media: details of hoardings, print and other placements a customer books, including vendor proof-of-work photos and their locations.
• Website measurement: when a customer uses our tracking, we record visits and conversions on their website. IP addresses are hashed with a secret salt rather than stored raw.
• Partner data: business details, phone number, and, where a partner chooses to provide them, PAN, GST and bank details for payouts, plus proof-of-work photos with location.
• Technical data: logs needed to run and secure the service. We keep access tokens and passwords out of logs.

4. Why we process it (purpose and legal basis)

We process personal data to provide the service our customers contract us for; to secure it and prevent fraud; to meet legal obligations (for example tax records and lawful requests); and, for our own account holders, on the basis of the consent or legitimate uses permitted by the DPDP Act. For end users' data inside a customer's Meta assets, the customer decides the purpose and we act on their instructions as their processor.

5. Sharing

• The customer who authorised the data, and people in their organisation they give access to.
• Service providers who host or support the service under contract, such as cloud hosting (Amazon Web Services, Mumbai region (India)), email and SMS delivery.
• Meta, Google and other platforms, only to carry out actions the customer requests on those platforms.
• Authorities, where Indian law requires it.

We do not sell personal data.

6. Retention

• Meta data (ad performance, Page and Instagram content, messages, leads, catalogues) is kept while the customer's account and connection are active. When a customer disconnects an asset or closes their account, we delete the related Meta data within 30 days, except where the law requires us to keep records.
• Lead form submissions and message history are kept for 24 months, or until the customer deletes them, whichever is sooner.
• Aggregated performance figures that no longer identify anyone may be kept for the customer's reporting history.
• Access tokens are deleted when a connection is removed.
• Account and billing records are kept as long as Indian tax and company law requires.

7. Security

Data is encrypted in transit (HTTPS). Customer data is isolated per organisation at the database level (row-level security). Access tokens are held only on our servers, with restricted access, and are never sent to browsers. Passwords are hashed with Argon2. Access is limited to staff who need it. No system is perfectly secure; if a breach affects you, we will notify you and the Data Protection Board of India as the law requires.

8. Meta Platform Terms

We access Meta data only through Meta's official APIs, only with the permissions a customer grants, and only to provide the features described above. We comply with the Meta Platform Terms and Developer Policies: we do not sell or license Platform Data, we do not use it to discriminate or for eligibility decisions, we delete it when it is no longer needed or when Meta or the customer asks, and we honour deletion requests Meta forwards to us.

9. Your rights

You can ask to access, correct or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance. Email admin@buzzspark.in. For data a business holds about you through their use of Lulu Marketing, you may also contact that business directly; we will help them respond. To delete data connected to your Facebook account, see our data deletion page.

10. Grievance officer (Digital Personal Data Protection Act, 2023)

11. Requests from government and law enforcement

We disclose personal data to a public authority only when Indian law requires it, and only under this policy:

• Legal review of every request. Each request is checked before we act on it: it must come from an authority empowered to make it, cite its legal basis, be in writing, and be limited to specific accounts and data. Informal or verbal requests are declined.
• We challenge unlawful or overbroad requests. If a request lacks a valid legal basis, is broader than the law allows, or conflicts with the law of the place where the data belongs, we ask the authority to narrow or withdraw it, and where appropriate we contest it through the available legal process.
• Data minimisation. When a request is valid, we disclose only the minimum data needed to comply with it, and nothing beyond the accounts and period it names.
• Notice. Where the law allows, we tell the affected customer before disclosing, so that they can seek their own remedy.
• A record of every request. We keep a written log of each request received: the authority, date, legal basis, what was asked, our assessment, and what, if anything, was disclosed. The log is reviewed by the company's directors.

This policy also applies to data we access through Meta's platforms. Questions: admin@buzzspark.in.

12. Children

Lulu Marketing is a business service and is not directed at children under 18. We do not knowingly process their data except as part of a customer's ordinary business communications.

13. Changes

We will post updates here and change the effective date. Material changes will be notified to account holders by email.