Privacy Policy

This policy is a starting template drafted for an Indian coworking operator that advertises on Google and Meta. Have it reviewed by your own legal counsel, and keep it accurate as you add or remove tools.

1. Who we are

Mark Space ("we", "us", "our") operates coworking centres, virtual offices and mail handling services in Bangalore, India, and runs this website. We are the data fiduciary for the personal data described in this policy under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

Contact for privacy matters: markspacesblr@gmail.com.

2. What we collect

Information you give us

• Enquiry details — your name, email address, phone number, company name, team size, preferred location, move-in date and the message you write.
• Membership and KYC details — for members and virtual office clients: identity documents, entity registration documents, billing details and emergency contacts, as required by law and by our building operators.
• Correspondence — emails, WhatsApp messages and call notes relating to your enquiry or membership.

Information collected automatically

• Device and usage data — IP address, browser and device type, pages viewed, referring URL and time on site.
• Advertising identifiers — click identifiers passed by advertising platforms in the URL, such as Google's gclid, gbraid and wbraid, Meta's fbclid, and Microsoft's msclkid, together with campaign parameters (utm_source, utm_medium, utm_campaign and similar).
• Cookie identifiers — including Google Analytics identifiers (_ga) and Meta Pixel identifiers (_fbp, _fbc).

We do not knowingly collect data from children, and our Services are not directed at anyone under 18.

3. Why we use it

Purpose	Data used
Responding to your enquiry and arranging a tour	Contact details, enquiry details
Providing and administering your membership	Contact, KYC, billing details
Complying with legal and regulatory obligations (GST, company law, lawful requests)	KYC and billing records
Measuring which advertising and marketing actually produces enquiries	Click and campaign identifiers, hashed contact details
Improving the website and our Services	Usage and device data
Sending service updates and, where you have opted in, marketing emails	Email address, name
Preventing spam, fraud and abuse of our forms	IP address, submission timestamps

We rely on your consent for marketing and advertising measurement, and on the necessity of performing our contract with you, and on our legal obligations, for the rest.

4. Advertising measurement and the Conversions APIs

We advertise on Google and Meta. To understand which campaigns produce genuine enquiries, we use both browser-side tags and server-side conversion measurement. This is the part of our processing most people want explained plainly, so here it is:

• Browser tags. The Meta Pixel, Google tag (gtag.js) and, where configured, Google Tag Manager, Microsoft UET and the LinkedIn Insight Tag run on this site. They set cookies and report events such as page views and form submissions.
• Server-side conversions. When you submit a form, our server also sends a conversion event directly to Meta's Conversions API and to Google Analytics 4. The event carries the click identifier associated with your visit and hashed versions of your email address and phone number — irreversibly converted using the SHA-256 algorithm before transmission, as those platforms require. We do not send the platforms your message, your company name or any plain-text contact detail.
• Offline conversion import. If an enquiry later becomes a paying member, we may upload the original Google click identifier, the date and the contract value back to Google Ads so that our bidding reflects real business value rather than raw form fills.
• Consent. Advertising and analytics storage are set to "denied" by default through Google Consent Mode v2 until you choose otherwise on our cookie banner. If you decline, we do not set advertising cookies, and conversion events we send server-side are flagged as not consented to for personalisation.

Google and Meta act as independent controllers for the data they receive. Their own policies apply: Google Privacy Policy and Meta Privacy Policy.

5. Who we share it with

We do not sell your personal data. We share it only with:

• Service providers who host our website, send our email, and store our records, under contract and only for those purposes.
• Advertising and analytics platforms as described in section 4.
• Building operators and security at the centre you visit, for access control and visitor management.
• Professional advisers (accountants, lawyers, auditors) where necessary.
• Government authorities where we are legally required to disclose — for example a GST or ROC verification of a registered address, or a lawful order.

Some of these providers process data outside India. Where that happens, we rely on the transfer mechanisms permitted under applicable law and require appropriate contractual protections.

6. How long we keep it

• Enquiries that do not convert — up to 24 months from the last contact, then deleted or anonymised.
• Member and billing records — 8 years after the membership ends, as required by Indian tax and company law.
• KYC records for virtual offices — for the statutory retention period applicable to the registration concerned.
• Website analytics and event logs — up to 26 months.
• Marketing consent records — for as long as you remain subscribed, plus 3 years.

7. Your rights

Under the DPDP Act you may:

• Ask for a summary of the personal data we hold about you and how we process it.
• Ask us to correct or complete inaccurate data.
• Ask us to erase data we no longer need for the purpose it was collected, subject to our legal retention obligations.
• Withdraw consent at any time — for marketing, by using the unsubscribe link in any email; for advertising cookies, through our cookie banner or your browser settings.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied with our response.

Write to markspacesblr@gmail.com to exercise any of these. We respond within 30 days and may ask you to verify your identity first.

8. Security

We use HTTPS across the site, restrict administrative access to named accounts with individual passwords, store passwords only as salted hashes, hash advertising identifiers before transmission, and log administrative activity. No system is perfectly secure, but we take reasonable technical and organisational measures proportionate to the sensitivity of the data, and we will notify you and the Data Protection Board of a reportable breach as the law requires.

9. Cookies

Details of the specific cookies we set, and how to control them, are in our Cookie Policy.

10. Changes

We update this policy when our processing changes. The "last updated" date at the top of this page shows when. Material changes are notified by email to current members.

11. Grievance officer

Grievance Officer, Mark Space, Bangalore, Karnataka, India. Email: markspacesblr@gmail.com. We acknowledge grievances within 48 hours and resolve them within 30 days.