Privacy Policy

Who We Are

GTMOne is a GTM operating intelligence business based in Hyderabad, India. This policy explains how we handle personal information associated with our website, business enquiries, and services.

For privacy questions, requests, or complaints, contact hello@withgtmone.com, addressed to the Privacy Contact.

Information We Handle

Enquiries and Business Relationships. When you contact us, we collect the information you provide, such as your name, work email, company, role, website, GTM environment, and description of your enquiry. We also keep relevant correspondence and engagement records.

Website Operation. Our website and hosting services may process technical information such as IP address, browser type, requested pages, timestamps, and security logs to deliver and protect the website. Cookie choices are described below.

Client-authorized Information. During an engagement, we may access agreed CRM records, ownership and lifecycle information, timestamps, workflow definitions, reports, controlled exports, and stakeholder input. This can include personal information about a client’s business contacts, prospects, customers, or personnel. The actual categories and access are defined in the engagement agreement.

Please do not send passwords, access tokens, sensitive personal information, or unnecessary customer records through our public enquiry form.

Why We Use Information

We use information to respond to enquiries, evaluate service fit, administer engagements, deliver agreed services, communicate with clients, protect our systems, maintain necessary business records, and meet applicable legal obligations.

Where applicable law requires a legal basis, we rely on the basis appropriate to the activity, such as consent, steps toward or performance of a contract with you, legal obligations, or permitted legitimate interests in business communications and security. We do not treat permission for one activity as blanket permission for unrelated uses.

We do not sell personal information or use client CRM data for advertising.

Client Data and Instructions

For information processed on a client’s behalf, the client determines the purposes of processing and provides documented instructions. GTMOne uses that information only to deliver the agreed services or as legally required. The client’s own privacy notice may also apply.

We request only information relevant to the agreed work. Read-only access is the default for assessments. Any system changes require separate authorization. A website enquiry does not authorize CRM access.

If your information is held within a client’s CRM, please contact that organization about your rights. If you contact us, we will assist or refer the request appropriately, subject to applicable law and our contractual obligations.

Providers, Disclosure, and AI Tools

We may use providers for website hosting, business email, secure storage, and agreed service delivery. Providers receive only the information needed for their function and are subject to appropriate access restrictions and contractual terms. Client-data providers and relevant processing locations are documented as part of the engagement arrangements.

We do not put identifiable client CRM data or confidential client material into general-purpose AI tools by default. Any use of AI involving such material requires the client’s prior written authorization and review of the provider, purpose, data scope, retention, and training settings. We do not use client information to train general-purpose AI models.

We may disclose information where legally required, to protect lawful rights, or to professional advisers under appropriate confidentiality duties.

Location of Processing

GTMOne operates from India. Depending on the agreed providers, information may also be processed in other countries. Where cross-border processing is involved, we assess applicable requirements and use the necessary contractual or other safeguards. Any client-specific location restrictions must be recorded before access begins. We do not promise India-only storage.

Security

Our operating requirements include restricted access, multifactor authentication where available, protected devices, approved storage, and secure transfer methods. Access is limited to people who need it for the agreed purpose. We do not claim any security certification unless expressly identified and verifiable.

No system can be guaranteed completely secure. Suspected incidents are investigated, and affected clients, individuals, or authorities are notified as required by applicable law and contractual commitments.

Retention and Deletion

Enquiry records are normally deleted or anonymized within 12 months after the last meaningful interaction unless an ongoing relationship or a documented legal need justifies retention.

For client working data, we agree return or deletion arrangements in writing. Our default is to return or delete active working copies within 30 days after the engagement ends, unless the client requests an earlier action or a different lawful period is agreed. Access is revoked when no longer needed. Backup expiry and any legally required exceptions are documented separately; deletion from active storage does not necessarily mean immediate deletion from backups.

Contracts, invoices, and limited business records may be retained for applicable legal, accounting, or dispute-resolution needs. This does not justify retaining entire CRM exports. Deliverables containing personal information remain subject to the agreed retention arrangements.

Cookies

We use cookies needed to operate the website and remember privacy choices. Any optional analytics or marketing cookies require the relevant consent before activation. You can manage available categories through the website’s cookie controls and withdraw optional consent there. Browser settings provide additional controls.

The cookie controls must describe the optional technologies actually used. If none are enabled, we do not use consent to imply that they are. External sites linked from this website have their own privacy practices.

Your Choices and Requests

Depending on applicable law, you may request access, correction, deletion, or other rights concerning your personal information. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may also opt out of marketing communications, if any.

Send requests or complaints to hello@withgtmone.com. We may reasonably verify your identity and will respond within the applicable legal timeframe. Some requests may be limited by legal retention obligations or by our role as a service provider to a client. You may also contact the relevant data-protection authority where applicable.

Children and Updates

Our website and services are intended for business users, not children. If you believe a child has provided personal information, contact us so we can assess and address it.

We may update this policy to reflect changes in our practices or applicable requirements. The published version will show its effective date, with additional notice where required.

For more details, please check out Data and Security page.