Privacy Policy

Kody Media Private Limited

Effective Date: 22-10-2026

Last Updated: 22-10-2026

1. Introduction and Scope

Kody Media Private Limited (“Kody Media”, “we”, “us”, “our”) is a programmatic Digital Out-of-Home (“DOOH”) advertising company. We help brands plan, buy, schedule, deliver and measure automated outdoor advertising, including through the Odigo platform and participating robots, screens and venues.

This Privacy Policy explains how we collect, use, share, store and protect Personal Data when you:

visit https://kodymedia.com/ or contact us (“Website Users”);
enquire about, book or manage advertising services as a brand, agency or authorised representative (“Clients”);
use our platform panels, including the Admin Panel, Client/Agency Panel and Store Manager Panel (“Platform Users”); or
are present near a Kody Media advertising device or participating venue (“Audience Members”).

This Policy should be read with our Terms & Conditions. By using our Website, Platform or Services, you acknowledge that you have read this Policy. Where the law requires your consent, we will ask for it separately.

2. Key Definitions

Personal Data: any information relating to an identified or identifiable individual.
Processing: any operation on data, including collection, storage, use, sharing, transfer and deletion.
Data Fiduciary / Controller: the party that decides the purposes and means of Processing.
Data Processor: a party that Processes Personal Data on behalf of a Data Fiduciary / Controller.
Data Principal / Data Subject: the individual to whom Personal Data relates.
Applicable Data Protection Law: all data protection and privacy laws that apply to our Processing, including the Digital Personal Data Protection Act, 2023 (India) (“DPDP Act”), the Information Technology Act, 2000 and its rules.
Services: the advertising, campaign management, analytics and related services we provide.

3. Our Role: Fiduciary, Controller and Processor

As Data Fiduciary / Controller, we decide how and why we Process Personal Data of Website Users, Client contacts, Platform Users and our own business contacts.
As Data Processor, we Process Personal Data on a Client’s instructions where a Client supplies data to us to run a campaign (for example, a Client’s own audience lists or first-party data). The Client remains the Data Fiduciary / Controller for that data and must have a lawful basis to share it with us.
Where our Services involve audience measurement at advertising locations, we act as set out in Section 4(e).

4. Information We Collect

(a) Contact and business information. Name, business email, phone number, job title, company, business address, and anything you submit through enquiry, demo or booking forms.

(b) Account and campaign information. Login credentials, user roles, agency or store details, advertising creatives, targeting parameters, selected placements, schedules, booking records, and activity within the Platform.

(c) Payment and billing information. Billing name and address, tax and registration details (such as GST or VAT numbers), invoices, transaction references and payment status. Payments are processed by Razorpay or another authorised payment provider. We do not store full card numbers or banking credentials.

(d) Technical information. IP address, device and browser type, operating system, log data, referring pages, session identifiers, and cookie or similar-technology data.

(e) Audience measurement and campaign analytics data. To deliver and report on programmatic DOOH campaigns, we may collect or receive:

impressions, play logs, proof-of-play, dwell and interaction counts, and time and location of ad delivery;
aggregated or de-identified audience metrics, and anonymised sensor or device signals from advertising devices; and
location and venue-level data from participating venues and technology partners.

We do not use facial recognition or other biometric identification technologies to identify individual Audience Members as part of our audience measurement activities. We do not sell Personal Data of Audience Members. Audience measurement may involve the processing of impressions, play logs, dwell and interaction counts, device signals, and venue or location-level data through our systems and technology partners.

Where audience analytics are shared with Clients, we aim to provide aggregated or de-identified information that does not reasonably identify an individual. Where any Personal Data is processed, such processing shall be carried out in accordance with this Privacy Policy and Applicable Data Protection Law.

(f) Information from third parties. Venue partners, ad-tech and data partners, payment providers, and publicly available business sources, such as professional networking profiles.

(g) Sensitive Personal Data. We do not intentionally collect sensitive data (such as health, biometric or financial-account credentials) except where strictly required for payment processing or by law. Please do not submit it to us unnecessarily.

5. How and Why We Use Information

Purpose	Examples	Legal basis (where applicable)
Provide the Services	Create accounts, confirm bookings, schedule and deliver campaigns, provide reports	Contract; consent
Payments and invoicing	Process payments, issue invoices, handle refunds and disputes	Contract; legal obligation
Support and communication	Respond to enquiries, give demos, send service notices	Contract; legitimate interests
Security and fraud prevention	Monitor misuse, troubleshoot, protect the Platform	Legitimate interests; legal obligation
Improve our business	Analytics, product development, Website performance	Legitimate interests; consent for non-essential cookies
Marketing	Newsletters, offers, event invitations	Consent or legitimate interests, as the law permits
Legal compliance	Tax, accounting, regulatory and law-enforcement requests, enforcing our rights	Legal obligation; legitimate interests

We will not use Personal Data for a materially different purpose without informing you and, where required, obtaining fresh consent.

6. Consent and Withdrawal

Where we rely on consent, it will be free, specific, informed and unambiguous, and you may withdraw it at any time by emailing us or using the unsubscribe link. Withdrawal does not affect Processing carried out before withdrawal, and may mean we can no longer provide certain Services.

7. Cookies and Similar Technologies

We use cookies for essential functions (sessions, security), preferences, and analytics. Non-essential cookies are used only with your consent where the law requires it. You can manage cookies through your browser or our cookie banner. Blocking some cookies may affect Website features.

8. Sharing and Disclosure

We share Personal Data only as needed and only with:

Payment providers (e.g., Razorpay) to process transactions and refunds;
Service providers for hosting, software, analytics, communications, security and support, under written confidentiality and data protection obligations;
Venue partners and advertising deployment partners, to the extent necessary to run a campaign;
Professional advisers, auditors, insurers and lawyers;
Authorities, where required by law, court order or to protect rights, safety and property;
Successors, in a merger, acquisition, restructuring or sale of assets, subject to this Policy; and
Others, with your consent or at your direction.

We do not sell Personal Data. We do not “share” Personal Data for cross-context behavioural advertising as defined under US state laws.

9. International Data Transfers

We serve national and international Clients, so Personal Data may be Processed in countries other than where it was collected, including India. Where we transfer data across borders, we do so in line with Applicable Data Protection Law, using safeguards such as Standard Contractual Clauses, adequacy decisions, data processing agreements or other lawful mechanisms. We will not transfer Personal Data to any country restricted by the Government of India under the DPDP Act.

10. Data Retention

We keep Personal Data only as long as needed for the purposes in this Policy, or as the law requires. Indicative periods:

Account and campaign records: duration of the relationship plus [x] years
Financial and tax records: as required by Indian law (generally at least 8 years)
Website and technical logs: [x] months
Marketing contact data: until you opt out

When data is no longer needed, we delete or irreversibly anonymise it.

11. Data Security and Breach Notification

We use reasonable technical and organisational safeguards, including access controls, encryption in transit, role-based permissions, logging and staff confidentiality obligations. No system is fully secure, and you must protect your login credentials and report suspected unauthorised access immediately.

If a Personal Data breach occurs, we will notify affected individuals, Clients and regulators as required by Applicable Data Protection Law, including the Data Protection Board of India and CERT-In within the prescribed timelines.

12. Your Rights

Subject to Applicable Data Protection Law, you may have the right to:

Access a summary of the Personal Data we hold and how we Process it;
Correct or update inaccurate or incomplete data;
Erase data that is no longer necessary or where consent is withdrawn;
Withdraw consent at any time;
Grievance redressal for any Processing concern;
Nominate another person to exercise your rights in the event of death or incapacity (India);
Port your data, restrict or object to Processing, and not be subject to solely automated decisions with legal effect (EU/UK);
Know, delete and opt out of sale or sharing and not face discrimination for exercising rights (US state laws).

To exercise any right, email the contact in Section 17. We may verify your identity first and will respond within the period required by law (generally within 30 days). Some data must be retained for legal, tax or dispute-resolution reasons. If you are unsatisfied, you may complain to the relevant authority, such as the Data Protection Board of India or your local supervisory authority.

13. Children’s Data

Our Website and Services are primarily intended for business users and are not directed at children under 18. We do not knowingly seek to collect Personal Data of children through our business-facing services. Our advertising devices may operate in public spaces where children may be present. We do not intentionally target or profile children through our audience measurement activities. Any Processing of children’s Personal Data, if applicable, shall be handled in accordance with Applicable Data Protection Law.

14. Third-Party Websites and Services

Our Website or Platform may link to third-party sites. We do not control their privacy practices and are not responsible for them. Please review their policies.

15. Client Responsibilities

If you supply Personal Data to us for a campaign, you confirm that you have the lawful basis, notices and consents needed to do so, and that your instructions comply with Applicable Data Protection Law. Where required, the parties will sign a Data Processing Agreement before Processing begins.

16. Changes to This Policy

We may update this Policy to reflect legal, technical or business changes. The latest version will be posted on our Website with a revised “Last Updated” date. For material changes, we will give reasonable notice, such as by email or Website notice.

17. Contact and Grievance Officer

Kody Media Private Limited

Registered Office: 2nd Floor, J Block, Mondeal Retail Park, Beside Iscon Mall, Iscon Cross Road, Sarkhej–Gandhinagar Highway, Ahmedabad, Gujarat 380015, India

To, The Grievance Officer, Kody Media Private Limited

Email: [email protected]

Phone: +91 63576 98103

Website: https://kodymedia.com/

We will acknowledge grievances within [48 hours] and aim to resolve them within [30 days].