Privacy & Cookie Policy

1. Who We Are

Turtle Pharma Private Limited ("Turtle Pharma", "we", "us") is a company incorporated in India, with its registered office at:

A505, Knox Plaza, MindSpace, Malad West
Mumbai 400064, Maharashtra, India
info@turtlepharma.com · +91 98509 98504

We operate the website turtlepharma.com (the "Site"). We are the data controller for personal data collected through the Site. Where we act on behalf of third parties (e.g. Google), those third parties act as independent data controllers or processors as described below.

2. Our Honest Position

We will not pretend we collect nothing — that would be dishonest. To keep turtlepharma.com free, we use the following third-party services:

• Google Analytics — aggregate, anonymised usage statistics to understand how visitors use the Site. This helps us improve content and navigation.
• Google AdSense — ads that support the cost of running the Site.

Both services run in consent-denied mode by default. This means:

• No analytics or advertising cookies are set until you explicitly click Accept all or toggle them on in Manage preferences.
• Google may set a single functional cookie (__Secure-ENID or similar) prior to your consent solely for fraud prevention and abuse detection. This cookie cannot be used to profile you, track you across sites for advertising, or identify you personally. It is strictly necessary for security under GDPR Article 6(1)(f) and equivalent laws.
• We use Google Consent Mode v2, which passes your consent signal to Google's tag infrastructure so your choice is respected end-to-end.

You can withdraw your consent at any time by clicking Privacy choices, opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on, and manage ad personalisation at Google Ad Settings.

3. What Data We Collect

3.1 Data you give us directly

When you fill in our contact/enquiry form, we collect: your name, company name, email address, phone/WhatsApp number, product of interest, and any message you include. This information is transmitted via WhatsApp Web or email — we do not operate a server-side form submission backend.

3.2 Data collected automatically

3.3 Data we do NOT collect

We do not collect: special category / sensitive personal data, payment card details, government ID numbers, health records, or information about children under 18.

4. Cookies & Similar Technologies

4.1 What is a cookie?

A cookie is a small text file stored on your device by your browser. Cookies are used to remember preferences, measure site usage, and deliver advertising.

4.2 Cookie inventory

Because we use Google Consent Mode v2, when consent is denied for analytics or advertising, the relevant Google tags still load but operate in a cookieless/modelled mode that does not write measurement or ad cookies to your device.

4.3 Managing cookies

• Our banner: Click Privacy choices at any time.
• Your browser: Most browsers let you delete or block cookies via Settings → Privacy. Note that blocking strictly necessary cookies may break site functionality.
• Google Analytics opt-out: tools.google.com/dlpage/gaoptout
• Google ad personalisation: myadcenter.google.com
• IAB opt-out (US): optout.aboutads.info

5. Google Analytics

We use Google Analytics 4, provided by Google LLC (or Google Ireland Limited in the EEA/UK). When you accept analytics cookies, Google Analytics collects anonymised data about your visit, such as pages viewed, time on site, traffic source, and device type. IP addresses are truncated before storage (anonymize_ip: true).

We have enabled IP anonymisation and data retention limited to 14 months in our GA4 property. We do not use Google Signals for cross-device tracking, and we do not share this data with any third party for advertising purposes.

Google's privacy policy: policies.google.com/privacy
Google Analytics opt-out: tools.google.com/dlpage/gaoptout

6. Google AdSense

We use Google AdSense to serve advertisements. Google AdSense is provided by Google LLC. When you accept advertising cookies, Google AdSense may use cookies to serve ads based on your prior visits to this and other websites.

By default (consent denied), AdSense operates in non-personalised ad mode: ads may still be shown but are contextual only, based on the page content rather than your browsing history.

You may opt out of personalised advertising at: myadcenter.google.com. For residents of the EU/EEA/UK, Google participates in the IAB TCF 2.2 framework.

Google's ad privacy policy: policies.google.com/technologies/ads

7. Lawful Basis for Processing (GDPR / UK GDPR)

Where we rely on consent, you may withdraw it at any time with no detriment — withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

8. Sharing & Third-Party Processors

We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes. We share data only with:

• Google LLC — analytics (subject to your consent) and advertising (subject to your consent), as described in sections 5 and 6.
• Hosting / CDN providers — to serve the Site. These providers process server log data strictly as data processors on our behalf.
• Legal authorities — if required by law, court order, or to protect the rights and safety of Turtle Pharma or others.

9. International Data Transfers

The Site is hosted and operated from India. If you access the Site from the EEA, UK, or other jurisdictions, your data may be transferred to and processed in India and/or the United States (by Google).

For transfers from the EEA / UK to Google's US operations, Google relies on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK ICO. Details: Google GDPR Data Processing Terms.

India's DPDP Act 2023 and cross-border transfer rules apply to personal data of Indian data principals. We process such data only to the extent permitted under applicable Indian law.

10. Data Retention

• Enquiry / contact data — retained as long as necessary for the business relationship, or up to 3 years after the last interaction, unless you request deletion sooner.
• Google Analytics data — 14 months (configured in our GA4 property).
• Server logs — typically 30–90 days, depending on hosting provider.
• Consent records (tp_consent_v2) — stored in your browser's localStorage; expires in 1 year or when you clear your browser data.

11. Your Rights

11.1 EU / EEA (GDPR)

You have the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object. You also have the right to lodge a complaint with your national supervisory authority (e.g. your country's Data Protection Authority).

11.2 United Kingdom (UK GDPR / PECR)

Same rights as above. Supervisory authority: Information Commissioner's Office (ICO).

11.3 United States — California (CCPA / CPRA)

California residents have the right to: know what personal information is collected, delete personal information, opt out of the "sale" or "sharing" of personal information, correct inaccurate personal information, and non-discrimination for exercising privacy rights. We do not "sell" or "share" personal information as defined under CCPA/CPRA. To exercise your rights, email info@turtlepharma.com with the subject line "CCPA Request".

11.4 India (DPDP Act 2023)

Indian data principals have the right to: access information about personal data processed, correction and erasure of personal data, grievance redressal, and nomination. To exercise your rights, contact our Grievance Officer at info@turtlepharma.com.

11.5 How to exercise your rights

Email us at info@turtlepharma.com with the subject line "Privacy Request – [Right]". We will respond within 30 days (or the legally required period in your jurisdiction). We may request identity verification before processing your request.

12. Children's Privacy

This Site is intended for business-to-business audiences — pharmaceutical manufacturers, research organisations, and trade professionals. It is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure, or destruction. These include HTTPS/TLS encryption for all data in transit, access controls, and periodic security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

14. Changes to This Policy

We may update this policy from time to time to reflect changes in law, our practices, or third-party services. The "Last updated" date at the top of this page will reflect any changes. For material changes, we will display a notice on the Site. We encourage you to review this page periodically.

15. Contact & Complaints

For any privacy-related questions, requests, or complaints:

Data Controller & Grievance Officer
Turtle Pharma Private Limited
A505, Knox Plaza, MindSpace, Malad West
Mumbai 400064, Maharashtra, India
info@turtlepharma.com

EU/UK residents may also lodge a complaint with their local supervisory authority if they believe their rights have not been respected.