Privacy Policy

1 Introduction & Scope

Bookgoals ("we", "us", "our", "the Company") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy applies to our main website BookGoals.in, our Dubai real-estate advertising landing domain dubai-real-estate.bookgoals.in, and any related landing pages, forms, advertisements, and communication channels operated by us (together, the "Services").

By accessing or using our Services, submitting a form, or booking a call, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services or submit your information.

This Policy is designed to align with widely recognised data-protection frameworks, including the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA, the India Digital Personal Data Protection Act, 2023 (DPDP Act), and the advertising and data policies of Google, Meta, and our hosting provider Hostinger.

2 Who We Are (Data Controller)

For the purposes of applicable data-protection laws, the data controller responsible for your personal information is:

For any privacy-related question, request or complaint, please contact the Agency Owner using the details above. We aim to respond to all verified requests within 30 days.

3 Information We Collect

3.1 Information you provide voluntarily

• Full name and business/company name
• Email address
• Phone number / WhatsApp number
• Country, city or market you operate in
• Details you share about your real estate business, offers, projects and goals
• Budget, ad-spend range or service preferences (if you choose to share them)
• Any message, note or information you type into a form or share on a call

3.2 Information collected automatically

• IP address and approximate geographic location (city/country level)
• Browser type, version, language and operating system
• Device type and screen size
• Pages viewed, time on page, scroll behaviour and referring URL
• Date and time of your visit and general session activity
• Cookie identifiers and similar technical identifiers

3.3 Information received from advertising platforms

• Lead information you submit through Meta Lead Ads, Facebook/Instagram Instant Forms or Google Ads lead forms
• Campaign, ad set and creative identifiers associated with your enquiry
• Aggregated or anonymised performance and conversion data

3.4 Information we do NOT collect

We do not intentionally collect credit or debit card numbers, bank account details, government identification numbers, biometric data, health data, or any other "special category" or sensitive personal data through this website. Please do not submit such information to us through forms, email or messaging channels.

4 How We Collect Information

• Website forms — when you request a consultation, audit or callback.
• Booking tools — when you schedule a call through our third-party scheduler (Cal.com).
• Advertising platforms — when you interact with or submit a lead form on Google or Meta.
• Analytics & cookies — when your browser loads our pages and permitted tags fire.
• Direct communication — email, phone or WhatsApp conversations initiated by you.
• Referrals — when a partner or existing client shares your business contact details with your consent.

5 Cookies, Pixels & Tracking Technologies

We use cookies and similar technologies (pixels, tags, local storage, SDKs) to operate the site, measure performance and understand which campaigns generate genuine business enquiries.

Types of cookies we may use

• Strictly necessary — required for the website and forms to function securely.
• Analytics — help us understand traffic and page performance in aggregate.
• Advertising / measurement — help measure conversions and improve ad relevance.
• Preference — remember basic display or consent choices.

Third-party technologies

• Meta Pixel & Conversions API — used to measure ad performance and understand lead quality. Data may be hashed before transmission as required by Meta.
• Google Analytics 4 & Google Ads tags — used for aggregated traffic and conversion measurement, with IP anonymisation where available.
• Google Consent Mode — where implemented, non-essential tags are limited until consent is given.

You can control or delete cookies through your browser settings at any time. Blocking some cookies may affect how parts of the website function. You can also manage personalised advertising through your Google Ads Settings and Meta Ad Preferences.

6 How We Use Your Information

• To respond to your enquiry and arrange a discovery or strategy call
• To understand your business, market, offer and growth goals
• To deliver, manage and improve our marketing and lead-generation services
• To communicate with you about your enquiry, project or account
• To measure and optimise advertising performance across Google and Meta
• To send relevant updates, insights or offers where permitted (you can opt out at any time)
• To detect, prevent and address fraud, abuse, spam or security incidents
• To comply with applicable legal, tax, accounting and regulatory obligations
• To enforce our terms and protect our legal rights

We do not use your personal information to make automated decisions that produce legal or similarly significant effects on you.

7 Legal Bases for Processing

Where GDPR or similar laws apply, we rely on the following legal bases:

• Consent — when you submit a form, request a call, or accept non-essential cookies.
• Contract — when processing is necessary to deliver services you have engaged us for.
• Legitimate interests — to run and improve our business, prevent fraud, and market relevant services responsibly.
• Legal obligation — to comply with applicable laws and lawful requests.

Where consent is the basis, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8 Advertising Platform Compliance (Google & Meta)

We are committed to complying with the advertising and data policies of the platforms we use. Specifically:

• We do not sell or share personal information with Meta or Google for monetary or other valuable consideration.
• We do not use sensitive or special-category data for ad targeting or audience creation.
• We do not upload customer lists to advertising platforms without an appropriate lawful basis and required consent, and any uploaded data is hashed before transmission.
• We do not target advertising to users below the minimum permitted age.
• We do not make misleading claims, use prohibited ad content, or engage in deceptive lead-generation practices.
• We honour opt-out and data-deletion requests in line with platform and legal requirements.
• We maintain records of consent and lead source where required.

If you believe an advertisement of ours has collected your data improperly, contact us at sanjit@bookgoals.com and we will investigate promptly.

9 Sharing & Disclosure

We do not sell, rent or trade your personal information. We may share it only in the limited circumstances below, and only to the extent necessary:

• Service providers / processors — including Hostinger (website hosting & infrastructure), Cal.com (call scheduling), Google (analytics & advertising), Meta (advertising & measurement), and email/CRM tools used to manage enquiries. These providers process data on our instructions and under contractual confidentiality and security obligations.
• Professional advisers — legal, accounting or compliance professionals where necessary.
• Legal requirements — where required by law, court order, or a valid request from a competent authority.
• Business transfers — in connection with a merger, acquisition, restructuring or sale of assets, where your data may transfer as part of the business, subject to this Policy.
• With your direction or consent — for any other purpose you explicitly authorise.

Hosting note: Our website is hosted on infrastructure provided by Hostinger. Hostinger acts as a data processor and may store technical logs and backups on secure servers. We do not permit Hostinger or any processor to use your personal data for their own marketing purposes.

10 Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law.

• Enquiries that do not convert — generally up to 24 months from last contact.
• Client and project records — for the duration of the engagement plus up to 6 years for legal, tax and accounting purposes.
• Marketing consent records — until consent is withdrawn, plus a reasonable suppression period.
• Analytics & cookie data — typically up to 26 months, depending on the platform configuration.
• Security and server logs — typically up to 12 months.

When data is no longer needed, we securely delete it or irreversibly anonymise it.

11 How We Protect Your Data

We take the security of your information seriously and apply appropriate technical and organisational measures, including:

• Encrypted connections (HTTPS / TLS) across all pages and forms
• Secure Hostinger hosting with firewall, malware scanning and DDoS protection
• Encryption at rest where supported by our hosting and storage providers
• Role-based access control — only authorised personnel can access personal data
• Strong password practices and two-factor authentication on business accounts
• Regular software updates, patches and security monitoring
• Limited data collection — we only collect what we genuinely need
• Confidentiality obligations for team members and contractors
• Secure backup procedures and periodic review of our security practices

While we work hard to protect your information, no method of transmission or storage over the internet is completely secure. We cannot guarantee absolute security, but we will notify affected users and relevant authorities where required by law if a breach occurs.

12 International Data Transfers

We may work with service providers located in countries outside your own, including India, the European Union, the United Kingdom and the United States. Where personal data is transferred internationally, we take reasonable steps to ensure it receives an adequate level of protection, including reliance on Standard Contractual Clauses, adequacy decisions, or equivalent safeguards offered by our processors.

13 Your Privacy Rights

Depending on your location, you may have some or all of the following rights:

• Right to know / access — request a copy of the personal data we hold about you.
• Right to correction — ask us to fix inaccurate or incomplete information.
• Right to deletion — request erasure of your personal data, subject to legal limits.
• Right to restrict processing — ask us to limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or to direct marketing.
• Right to withdraw consent — at any time, without affecting prior lawful processing.
• Right to non-discrimination — we will not deny service or charge differently because you exercised a privacy right.
• Right to opt out of sale/sharing — we do not sell or share personal information as defined under the CCPA/CPRA, but you may still submit an opt-out request.
• Right to nominate / grievance redressal — under the India DPDP Act, you may nominate a person to exercise your rights and raise a grievance with us.

To exercise any right, email sanjit@bookgoals.com or call +91 78907 46479. We may need to verify your identity before processing a request. Authorised agents may submit requests on your behalf with proof of authorisation.

14 Marketing Communications & Opt-Out

If you receive marketing emails from us, every message includes an unsubscribe option, and you may also reply with "unsubscribe" or email us directly. You can opt out of marketing calls or messages by telling us on the call or contacting us using the details in this Policy.

Please note that we may still send you essential service-related or transactional communications (for example, information about an active engagement or a response to your enquiry) even if you opt out of marketing.

15 Children's Privacy

Our Services are intended for business owners, real estate professionals and adults aged 18 years or older. We do not knowingly collect personal information from children or from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

16 Third-Party Links & Services

Our website may contain links to third-party websites, tools or platforms (for example, scheduling pages, social media profiles or client resources). We are not responsible for the privacy practices, content or security of those third parties. We encourage you to review their privacy policies before providing any personal information.

17 Do Not Track & Global Privacy Control

Some browsers offer "Do Not Track" (DNT) or Global Privacy Control (GPC) signals. Because there is no universally accepted standard for DNT, our website may not respond to DNT signals automatically. Where required by applicable law, we will honour recognised opt-out preference signals such as GPC. You may also manage tracking through your browser settings and platform ad preferences.

18 Data Breach Response

In the unlikely event of a personal data breach, we will take immediate steps to contain and investigate the incident, assess the risk to affected individuals, and notify the relevant supervisory authority and affected users where required by applicable law, without undue delay.

19 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or platform policies. The "Effective Date" and "Last Updated" fields at the top of this page will always reflect the current version. Material changes will be communicated where appropriate. Continued use of our Services after an update constitutes acceptance of the revised Policy.