1. Introduction & who we are

Yamm Labs (“Yamm Labs,” “we,” “us,” or “our”) is a brand and design agency serving the financial services and fintech sector. We respect your privacy and are committed to protecting the personal data you share with us. This Privacy Policy explains what information we collect through our website www.yammlabs.com (the “Site”) and related services, how we use and safeguard it, and the rights and choices available to you.

For the purposes of applicable data protection law, the data controller (or, under India’s Digital Personal Data Protection Act, 2023, the “Data Fiduciary”) is:

Yamm Labs
G1/14C, DLF GARDEN CITY, PHASE 1-A, SECTOR-92, GURUGRAM, HARYANA, 122505
Email: info@yammlabs.com

2. Scope of this policy

This policy applies to personal data we collect from visitors to our Site, prospective and current clients, people who contact us or download our resources, and other individuals who interact with our marketing. It does not apply to third-party websites we link to, or to data we process solely on behalf of our clients as a processor/data processor under a separate services agreement (in those cases, our client’s privacy policy governs, and we process data according to their instructions and our contract).

3. Information we collect

3.1 Information you provide directly

• Contact & enquiry data — when you complete a form, request a proposal, or email us: your name, work email, company name, job role, phone number (if provided), and the contents of your message.
• Resource & lead-magnet data — when you download a guide, checklist, or report, or register for a call: your name, work email, company, and role.
• Client engagement data — information exchanged in the course of providing services, including project materials and business contact details.

3.2 Information collected automatically

• Technical & usage data — IP address, browser type and version, device type, operating system, referring URLs, pages viewed, time spent, and clickstream data.
• Cookies & similar technologies — as described in Section 5, including analytics and advertising identifiers.

We do not intentionally collect special or sensitive categories of personal data (such as health, biometric, or financial account data) through our Site. Please do not submit such information through our forms.

4. How we use your information

We use personal data for the following purposes:

Purpose	Examples
Respond to enquiries	Reply to your message, prepare proposals, schedule calls
Deliver resources	Send the guide, checklist, or report you requested
Provide services	Deliver, manage, and improve our work for clients
Marketing & communications	Send relevant updates and offers where permitted; you may opt out at any time
Analytics & improvement	Understand how the Site is used and improve content and performance
Advertising & remarketing	Measure campaigns and show relevant ads on Google, Meta, LinkedIn and similar platforms (see Section 6)
Security & legal	Protect the Site, prevent fraud/abuse, and comply with legal obligations

5. Cookies & tracking technologies

We use cookies and similar technologies (such as pixels, tags, and local storage) to operate the Site, remember preferences, measure traffic, and support advertising. Cookies fall into these broad categories:

• Strictly necessary — required for the Site to function.
• Analytics/performance — help us understand usage (e.g., Google Analytics).
• Advertising/targeting — used to measure and personalise ads (e.g., Google Ads, Meta Pixel, LinkedIn Insight Tag).

Where required by law, we request your consent for non-essential cookies through a cookie banner, and you can withdraw consent or change your preferences at any time. You can also control cookies through your browser settings. Disabling some cookies may affect Site functionality.

6. Advertising, remarketing & analytics

We use third-party advertising and analytics services to promote our work and measure results. These providers may set and read cookies or use device identifiers to collect information about your activity on our Site and elsewhere over time. Depending on the tools currently deployed, these may include:

• Google Analytics & Google Ads (including remarketing and conversion tracking). Google uses cookies (such as advertising and analytics cookies) to serve, personalise, and measure ads. We and third-party vendors, including Google, use first-party and third-party cookies together to inform, optimise, and serve ads based on your past visits to our Site. You can opt out of Google’s use of cookies for personalised advertising by visiting Google Ads Settings, and learn more at policies.google.com/technologies/partner-sites. You can install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
• Meta Pixel (Facebook/Instagram). We use the Meta Pixel to measure ad performance and show relevant ads. You can manage your ad preferences in your Facebook and Instagram settings and via facebook.com/about/ads.
• LinkedIn Insight Tag. We use it to measure campaigns and enable ad targeting. You can manage preferences in your LinkedIn account settings.

These platforms act as independent controllers of the data they collect through their technologies; their handling of your data is governed by their own privacy policies. We only deploy advertising cookies where permitted and, where required, with your consent.

7. Legal bases for processing

Where the Digital Personal Data Protection Act, 2023 (India) applies, we process personal data based on your consent or for other lawful/legitimate uses permitted under the Act. Where the EU/UK GDPR applies to visitors in those regions, we rely on one or more of the following legal bases:

• Consent — for non-essential cookies, marketing, and where otherwise required.
• Legitimate interests — to operate and improve our Site, respond to enquiries, and market our services in a proportionate way.
• Contract — to take steps at your request before entering into, or to perform, a contract.
• Legal obligation — to comply with applicable law.

8. How we share information

We do not sell your personal data. We share it only as follows:

• Service providers / processors — hosting, analytics, advertising, email, CRM, and scheduling providers who process data on our behalf under appropriate contractual safeguards.
• Advertising & analytics platforms — as described in Section 6.
• Professional advisers — lawyers, accountants, and auditors where necessary.
• Legal & safety — where required by law, regulation, legal process, or to protect our rights, users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

9. International data transfers

We are based in India and work with clients and vendors globally, including in Singapore, the UAE, the UK, the EU, and the US. Your personal data may therefore be processed outside your country of residence, including in countries whose data protection laws differ from your own. Where such transfers occur, we take steps to ensure an appropriate level of protection consistent with applicable law (for example, contractual safeguards with our providers).

10. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, including to provide services, maintain business records, comply with legal obligations, resolve disputes, and enforce agreements. When data is no longer needed, we delete or anonymise it. Marketing data is retained until you opt out or request deletion, subject to any legal retention requirements.

11. Your rights & choices

Depending on your location and applicable law, you may have some or all of the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Erasure / deletion — request deletion of your data in certain circumstances.
• Withdraw consent — withdraw consent where processing is based on consent (this does not affect prior processing).
• Object / restrict — object to or restrict certain processing, including direct marketing.
• Portability — request your data in a portable format (where applicable).
• Grievance redressal — under India’s DPDP Act, raise a grievance with our contact below and, if unsatisfied, approach the Data Protection Board of India.
• Opt out of sale/sharing — for California (CCPA/CPRA) residents; note we do not sell personal data.
• Complain to a supervisory authority — EU/UK residents may lodge a complaint with their local data protection authority.

To exercise any right, contact us at info@yammlabs.com. We may need to verify your identity before acting on a request and will respond within the timeframe required by applicable law.

12. Children’s privacy

Our Site and services are intended for business professionals and are not directed to children. We do not knowingly collect personal data from children as defined under applicable law (including under India’s DPDP Act, 2023). If you believe a child has provided us personal data, please contact us and we will take appropriate steps to delete it.

13. Third-party links

Our Site may contain links to third-party websites, tools, or resources. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing any personal data.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated version on this page with a revised “Last updated” date. Where changes are material, we will take additional steps to notify you as required by law.

15. Contact & grievance officer

If you have questions, requests, or complaints about this policy or our handling of your personal data, please contact:

Data Protection / Grievance Contact
Devesh Bajpayee
Yamm Labs
G1/14C, DLF GARDEN CITY, PHASE 1-A, SECTOR-92, GURUGRAM, HARYANA, 122505
Email: info@yammlabs.com

For residents of India, if your grievance is not satisfactorily resolved, you may escalate to the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023.