Scope and our role
This Policy applies to personal information we process as a controller — that is, where we decide why and how the information is used. This covers visitors to ninjazgroup.com, prospective and current client contacts, portal users, event attendees, suppliers and job applicants.
When we deliver the Services, our clients load, route or expose data from their own systems — for example dealer management systems (DMS), CRM, finance, service, website and messaging platforms. For that client data we act as a processor (or “service provider” under U.S. state law). We process it only on our client’s documented instructions under our Master Services Agreement and Data Processing Addendum, and our client’s own privacy notice governs it. If you are a customer of one of our clients, please direct privacy requests to that business.
Information that has been de-identified or aggregated so that it can no longer reasonably be linked to an individual (“Anonymized Data”) is not personal information. We may use Anonymized Data to operate and improve the Services.
Our principles
- We collect only what we need to run the relationship, deliver the Services, and keep them secure.
- Client data stays our client’s data. We do not sell it, mine it for our own marketing, or use it to train general-purpose AI models.
- Access is limited to the people who need it to do the work, under confidentiality obligations.
- We tell you plainly what we do, and we give you real controls over it.
Information we collect
Depending on how you interact with us, we may collect the following categories of personal information:
| Category | Examples | Source |
|---|---|---|
| Contact data | Name, business email, phone number, company, job title, office location | You, your colleagues, or business-contact data providers |
| Engagement data | What you tell us about your systems, operation and goals; Blueprint workshop notes; proposals and statements of work | You and your organisation |
| Portal account data | Name, email, role, hashed password, permissions, activity and audit logs | You or your administrator |
| Chat and support data | Messages sent to our chat assistant or support team, attachments, and the page you were on | You |
| Billing data | Billing contact, invoicing address, tax identifiers, payment records | You or your finance team |
| Device and usage data | IP address, browser type, device, pages viewed, referring URL, timestamps | Automatically, via cookies and server logs |
| Recruitment data | CV, employment history, qualifications, interview notes | You, referees and recruiters |
We do not intentionally collect sensitive personal information (such as health, biometric or government identification data) through our websites. If client data processed through the Services includes such information, it is handled strictly under that client’s instructions and our contract with them.
How we use personal information
- Delivering the Services — scoping, designing, building, integrating, monitoring and operating client systems, and providing support across business hours.
- Running the client portal — authenticating users, enforcing permissions, keeping audit trails and showing engagement status.
- Responding to you — answering enquiries, booking consultations and following up on requests sent through our forms or chat assistant.
- Commercial administration — proposals, contracts, invoicing, collections and supplier management.
- Security and integrity — detecting, investigating and preventing fraud, abuse, unauthorised access and incidents.
- Improving what we do — understanding how our site is used, in aggregate, so we can make it clearer and faster.
- Marketing — sending relevant insights and event invitations to business contacts, subject to your preferences. You can unsubscribe at any time.
- Recruitment — assessing applications and managing the hiring process.
- Legal compliance — meeting tax, accounting, regulatory and legal-process obligations, and establishing or defending legal claims.
Legal bases for processing
Where the EU or UK General Data Protection Regulation (GDPR), or a similar law, applies, we rely on the following legal bases:
- Contract — to enter into and perform our agreements with clients and suppliers, and to provide portal accounts.
- Legitimate interests — to run and secure our business, communicate with business contacts, and improve our Services, where those interests are not overridden by your rights.
- Legal obligation — to comply with laws that apply to us.
- Consent — for non-essential cookies and certain marketing. You may withdraw consent at any time without affecting prior processing.
AI features and automated processing
Our website chat assistant uses large language models to answer questions about Ninjaz using our published content. Conversations are stored so we can follow up, resolve issues and improve answers. Please do not share sensitive personal information in the chat.
Where the Services include AI-assisted workflows for clients (for example routing, summarisation or forecasting), those workflows run on client data under the client’s instructions. We use model providers under contractual terms that prohibit them from using that data to train their models. We do not make decisions that produce legal or similarly significant effects on individuals solely through automated processing.
International transfers
We operate across time zones by design: strategy and account leadership work in the client’s region while engineering, AI development and support run from our delivery operation in India. As a result, personal information may be transferred to, stored in, and accessed from countries other than your own, including the United States and India.
Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), together with supplementary technical and organisational measures. Transfers from other jurisdictions follow the requirements of local law.
Retention
We keep personal information only for as long as needed for the purposes described here. In practice:
- Client contact and engagement records — for the life of the relationship plus up to seven years for contractual, tax and legal purposes.
- Portal accounts — while the account is active, then deleted or anonymised within 90 days of deactivation, except audit logs retained for security.
- Client data processed through the Services — returned or deleted at the end of the engagement in line with the Data Processing Addendum.
- Chat conversations — up to 24 months, unless they form part of an active engagement.
- Marketing preferences — until you unsubscribe, after which we keep a suppression record so we honour that choice.
- Unsuccessful job applications — up to 12 months, unless you ask us to delete them sooner.
Security
We protect personal information with administrative, technical and physical safeguards appropriate to the risk, including encryption in transit and at rest, role-based access with least privilege, hashed credentials, audit logging, environment separation, vendor due diligence and staff confidentiality and security training. More detail is available in our Security overview.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.
Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and receive a copy in a portable format.
- Correct inaccurate or incomplete information.
- Delete your information, subject to legal exceptions.
- Object to, or ask us to restrict, certain processing — including processing based on legitimate interests and direct marketing.
- Withdraw consent where we rely on it.
- Opt out of the sale or sharing of personal information and of targeted advertising. We do neither.
- Not be subject to a decision based solely on automated processing that significantly affects you.
- Appeal our decision on your request, and lodge a complaint with your data protection authority.
To exercise any of these rights, email privacy@ninjazgroup.com. We will verify your request before acting on it and respond within the time required by law — generally within 30 days under GDPR and 45 days under U.S. state laws. Authorised agents may submit requests on your behalf with proof of authority. We will not discriminate against you for exercising your rights.
If we decline your request, you may appeal by replying to our decision. We will respond to appeals in writing within 60 days.
Regional disclosures
United States. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws have the rights described above. Over the past 12 months we have collected the categories listed in “Information we collect” for the business purposes listed in “How we use personal information”, and disclosed them to the recipients listed in “How we share”. We have not sold or shared personal information, and we do not knowingly process the personal information of consumers under 16.
European Economic Area, United Kingdom and Switzerland. The legal bases, transfer mechanisms and rights described above apply. You may contact your local supervisory authority.
India. We process personal information in accordance with the Digital Personal Data Protection Act, 2023, and you may contact our privacy team as your point of contact for grievances.
Singapore, Saudi Arabia and the United Arab Emirates. We process personal information in accordance with the Personal Data Protection Act 2012 (Singapore), the Personal Data Protection Law (Saudi Arabia), and Federal Decree-Law No. 45 of 2021 (UAE), as applicable.
Children
Our websites and Services are designed for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this Policy
We may update this Policy as our Services or the law change. We will post the revised version here with a new “Last updated” date and, where changes are material, notify clients and portal users by email or in the portal before they take effect.
Contact us
Questions, requests or complaints about privacy can be sent to privacy@ninjazgroup.com. Please include enough detail for us to identify you and understand your request.