Privacy Policy
Effective date: 15 October 2026 | Last updated: 19 October 2026
Summary
- We collect what you send us (forms, emails, WhatsApp) and standard analytics and advertising data when you browse.
- We use it to answer you, deliver and improve our services, measure our marketing and keep the site secure.
- We do not sell your personal data for money. Advertising tools such as the Meta Pixel and Google tags may count as “sharing” for advertising in some laws; you can opt out at any time (see Advertising).
- You can ask us to access, correct or delete your data by emailing ciao@themarkitmedia.com.
1. Who we are
Markit Media (“Markit Media”, “we”, “us”) is a digital marketing, website development and creative agency based in Karachi, Pakistan. We operate the website themarkitmedia.com (the “Site”) and serve businesses in the USA, Canada, UAE, UK, Australia, Saudi Arabia and elsewhere. For the personal data described in this policy, Markit Media is the controller (or “business”) and decides how and why it is used.
This policy covers the Site, our forms and email addresses, our WhatsApp and phone contact details, and our client dashboard. It does not cover third-party websites we link to, or the personal data we handle on behalf of clients when we run their campaigns, websites or accounts; for that work the client is responsible and we act as their processor under our agreement with them.
2. Information we collect
| Category | What it includes | How we get it |
|---|---|---|
| Enquiry and quote requests | Name, email, phone or WhatsApp number, company, service of interest, budget, timeline and the message you write. | You submit the contact or quote form, or email, call or message us. |
| Discovery briefs | Brand and business details you choose to share: website or social links, launch stage, markets, goals, audiences, platforms, advertising budget, notes and references. | You complete the discovery brief form. |
| Newsletter and tool sign-ups | Email address and the page or tool you signed up from. | You submit an email address on the Site. |
| Marketing source details | The page you landed on, the referring site and campaign (UTM) parameters, saved with your enquiry so we know which marketing works. | Collected automatically when you submit a form. |
| Technical and usage data | IP address, browser and device type, approximate location (country or city), pages viewed, clicks, form starts and other events, and cookie or device identifiers. | Collected automatically by the Site and our analytics and advertising tools. |
| Account and security data | For people with dashboard accounts: name, email address, login codes, sign-in activity and IP address. | You or our team create the account; collected when you sign in. |
| Job applications | Name, email, phone or WhatsApp number, city and country, the area you are interested in, a portfolio or LinkedIn link, a short note, and the CV file you upload. | You submit the application form on our Careers page. |
| Call-back requests | The phone number you type into the call-back button on our US pages, so we can ring you, and the page you were on. | You submit it in the call-back button. |
| Communications | The content of emails, WhatsApp messages and calls (notes) between you and us. | When you contact us or we contact you. |
Enquiry and quote requests
What it includes: Name, email, phone or WhatsApp number, company, service of interest, budget, timeline and the message you write.
How we get it: You submit the contact or quote form, or email, call or message us.
Discovery briefs
What it includes: Brand and business details you choose to share: website or social links, launch stage, markets, goals, audiences, platforms, advertising budget, notes and references.
How we get it: You complete the discovery brief form.
Newsletter and tool sign-ups
What it includes: Email address and the page or tool you signed up from.
How we get it: You submit an email address on the Site.
Marketing source details
What it includes: The page you landed on, the referring site and campaign (UTM) parameters, saved with your enquiry so we know which marketing works.
How we get it: Collected automatically when you submit a form.
Technical and usage data
What it includes: IP address, browser and device type, approximate location (country or city), pages viewed, clicks, form starts and other events, and cookie or device identifiers.
How we get it: Collected automatically by the Site and our analytics and advertising tools.
Account and security data
What it includes: For people with dashboard accounts: name, email address, login codes, sign-in activity and IP address.
How we get it: You or our team create the account; collected when you sign in.
Job applications
What it includes: Name, email, phone or WhatsApp number, city and country, the area you are interested in, a portfolio or LinkedIn link, a short note, and the CV file you upload.
How we get it: You submit the application form on our Careers page.
Call-back requests
What it includes: The phone number you type into the call-back button on our US pages, so we can ring you, and the page you were on.
How we get it: You submit it in the call-back button.
Communications
What it includes: The content of emails, WhatsApp messages and calls (notes) between you and us.
How we get it: When you contact us or we contact you.
We do not ask for sensitive categories of personal data (for example health, financial account or government ID numbers). Please do not include them in forms or messages.
3. Cookies and tracking technologies
The Site uses cookies and similar technologies (such as local storage and tracking pixels) for analytics, advertising measurement and to remember your choices. They load automatically when you visit. You can change or withdraw your choice at any time with the Cookie settings link in the footer, with a Global Privacy Control signal (see section 10), or in your browser settings.
| Provider | Purpose | Examples | Typical lifetime |
|---|---|---|---|
| Google Analytics 4 (via Google Tag Manager, loaded through Cloudflare Zaraz) | Measures traffic and how the Site is used. Google signals are enabled on our property. | _ga, _ga_* | Up to 2 years |
| Google Ads and Tag Manager | Measures ad conversions and supports remarketing. | _gcl_au, _gcl_aw and similar | About 90 days |
| Meta Pixel (Meta Platforms) | Measures visits and ad performance on Facebook and Instagram and builds advertising audiences. | _fbp, _fbc | About 90 days |
| Cloudflare | Hosting, content delivery, security and privacy-friendly traffic statistics (Web Analytics). | Security and performance cookies set as needed | Session to a few days |
| CallHippo (call-back button, US pages only) | Provides the call-back button and places the call. It does not load if you have opted out. | A short-lived widget cookie | Short-lived |
| YouTube (Google) | Plays embedded videos. Google receives your IP address and may set cookies when you play a video. | Set by youtube.com | Varies |
| Our Site | Remembers your cookie preference. | cookie-consent, cookie-consent-source (local storage) | Until you clear your browser data |
Google Analytics 4 (via Google Tag Manager, loaded through Cloudflare Zaraz)
Purpose: Measures traffic and how the Site is used. Google signals are enabled on our property.
Examples: _ga, _ga_*
Typical lifetime: Up to 2 years
Google Ads and Tag Manager
Purpose: Measures ad conversions and supports remarketing.
Examples: _gcl_au, _gcl_aw and similar
Typical lifetime: About 90 days
Meta Pixel (Meta Platforms)
Purpose: Measures visits and ad performance on Facebook and Instagram and builds advertising audiences.
Examples: _fbp, _fbc
Typical lifetime: About 90 days
Cloudflare
Purpose: Hosting, content delivery, security and privacy-friendly traffic statistics (Web Analytics).
Examples: Security and performance cookies set as needed
Typical lifetime: Session to a few days
CallHippo (call-back button, US pages only)
Purpose: Provides the call-back button and places the call. It does not load if you have opted out.
Examples: A short-lived widget cookie
Typical lifetime: Short-lived
YouTube (Google)
Purpose: Plays embedded videos. Google receives your IP address and may set cookies when you play a video.
Examples: Set by youtube.com
Typical lifetime: Varies
Our Site
Purpose: Remembers your cookie preference.
Examples: cookie-consent, cookie-consent-source (local storage)
Typical lifetime: Until you clear your browser data
Lifetimes are the providers’ typical defaults and can change. We do not use cookies to make decisions that have legal or similarly significant effects on you.
4. How we use information
| Purpose | Examples | Legal basis (UK and EU/EEA GDPR) |
|---|---|---|
| Respond to you and provide services | Answer enquiries, prepare proposals, run projects, send invoices, support clients. | Steps at your request before a contract; performance of a contract |
| Run and secure the Site | Prevent spam and abuse, rate-limit forms, protect accounts, fix errors. | Legitimate interests (keeping the Site and our systems safe) |
| Understand and improve the Site | Analytics, testing, content and performance improvements. | Legitimate interests; consent where the law requires it |
| Market our services | Measure and improve our advertising, remarketing, send newsletters or follow-ups to people who asked for them. | Legitimate interests; consent where the law requires it. You can object or opt out at any time |
| Meet legal obligations | Tax, accounting, responding to lawful requests, enforcing our rights. | Legal obligation; legitimate interests |
Respond to you and provide services
Examples: Answer enquiries, prepare proposals, run projects, send invoices, support clients.
Legal basis (UK and EU/EEA GDPR): Steps at your request before a contract; performance of a contract
Run and secure the Site
Examples: Prevent spam and abuse, rate-limit forms, protect accounts, fix errors.
Legal basis (UK and EU/EEA GDPR): Legitimate interests (keeping the Site and our systems safe)
Understand and improve the Site
Examples: Analytics, testing, content and performance improvements.
Legal basis (UK and EU/EEA GDPR): Legitimate interests; consent where the law requires it
Market our services
Examples: Measure and improve our advertising, remarketing, send newsletters or follow-ups to people who asked for them.
Legal basis (UK and EU/EEA GDPR): Legitimate interests; consent where the law requires it. You can object or opt out at any time
Meet legal obligations
Examples: Tax, accounting, responding to lawful requests, enforcing our rights.
Legal basis (UK and EU/EEA GDPR): Legal obligation; legitimate interests
We do not use automated decision-making that produces legal or similarly significant effects about you.
5. Who we share information with
We share personal data only as needed, with these types of recipient:
| Recipient | What for |
|---|---|
| Cloudflare | Website hosting, content delivery, security, our site database and file storage, tag loading and traffic statistics. |
| MongoDB (Atlas) | Database that stores enquiries, briefs, newsletter sign-ups and dashboard records. |
| Resend | Sending transactional email such as enquiry notifications, acknowledgements and dashboard sign-in codes. |
| Zoho | Business email and communications. |
| CallHippo | Our US phone line and call-back button: receives the number you enter and the call details so it can place the call. |
| Google (Analytics, Tag Manager, Ads, YouTube) | Analytics, advertising measurement and embedded video. |
| Meta Platforms (Meta Pixel, WhatsApp) | Advertising measurement and audiences; messaging if you contact us on WhatsApp. |
| Team messaging and project tools | Internal notifications about new enquiries so we can reply quickly. |
| Professional advisers, authorities and successors | Lawyers, accountants and insurers; public authorities where the law requires; a buyer or successor if our business changes hands. |
Cloudflare
What for: Website hosting, content delivery, security, our site database and file storage, tag loading and traffic statistics.
MongoDB (Atlas)
What for: Database that stores enquiries, briefs, newsletter sign-ups and dashboard records.
Resend
What for: Sending transactional email such as enquiry notifications, acknowledgements and dashboard sign-in codes.
Zoho
What for: Business email and communications.
CallHippo
What for: Our US phone line and call-back button: receives the number you enter and the call details so it can place the call.
Google (Analytics, Tag Manager, Ads, YouTube)
What for: Analytics, advertising measurement and embedded video.
Meta Platforms (Meta Pixel, WhatsApp)
What for: Advertising measurement and audiences; messaging if you contact us on WhatsApp.
Team messaging and project tools
What for: Internal notifications about new enquiries so we can reply quickly.
Professional advisers, authorities and successors
What for: Lawyers, accountants and insurers; public authorities where the law requires; a buyer or successor if our business changes hands.
These providers process data under their own terms and policies, and, where they act for us, under data-processing terms. We do not sell personal data for money.
6. Advertising and “sale” or “sharing”
We use Google advertising tools and the Meta Pixel to measure our own advertising and to show our ads to people who visited the Site. Under some laws (for example California’s CCPA/CPRA), disclosing identifiers and internet activity (such as cookie IDs, IP address and pages viewed) to advertising partners for this purpose can be called “sharing” for cross-context behavioural advertising. In the last 12 months we have shared those categories with Google and Meta for that purpose. We do not knowingly sell or share the personal data of anyone under 16.
To opt out: click Cookie settings in the footer and choose Dismiss, or use a browser or extension that sends a Global Privacy Control signal. You can also email ciao@themarkitmedia.com. Opting out stops the Meta Pixel and Google tracking on this device; it does not affect ads you see elsewhere.
7. International transfers
We are based in Pakistan and our providers operate globally, so your information may be processed in Pakistan, the United States, the European Union and other countries. Where the law requires, we rely on safeguards such as standard contractual clauses offered by our providers, or other lawful transfer mechanisms.
8. How long we keep information
| Data | How long |
|---|---|
| Enquiries, briefs and project correspondence | For as long as needed to deal with your enquiry, deliver services and keep our business and legal records, then deleted or anonymised. You can ask us to delete it sooner. |
| Newsletter sign-ups | Until you unsubscribe or ask us to delete your address. |
| Job applications and CVs | Until we delete them. You can ask us at any time to delete your application and CV, and we will. |
| Google Analytics data | 14 months (the retention period configured on our Google Analytics property). |
| Security and anti-spam counters (IP-based) | Short-lived: from about one minute up to 24 hours. |
| Dashboard account and activity records | While the account is active and for a reasonable period afterwards for security and audit purposes. |
| Cookie preference | Stored on your device until you clear your browser data. |
Enquiries, briefs and project correspondence
How long: For as long as needed to deal with your enquiry, deliver services and keep our business and legal records, then deleted or anonymised. You can ask us to delete it sooner.
Newsletter sign-ups
How long: Until you unsubscribe or ask us to delete your address.
Job applications and CVs
How long: Until we delete them. You can ask us at any time to delete your application and CV, and we will.
Google Analytics data
How long: 14 months (the retention period configured on our Google Analytics property).
Security and anti-spam counters (IP-based)
How long: Short-lived: from about one minute up to 24 hours.
Dashboard account and activity records
How long: While the account is active and for a reasonable period afterwards for security and audit purposes.
Cookie preference
How long: Stored on your device until you clear your browser data.
We may keep information longer where the law requires it or where it is needed to establish, exercise or defend legal claims.
9. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- delete your data (“erasure”);
- restrict or object to certain processing, including direct marketing and profiling for advertising;
- receive your data in a portable format;
- withdraw consent at any time where we rely on consent (this does not affect earlier processing);
- opt out of the “sale” or “sharing” of personal data, and not be discriminated against for exercising your rights (California and similar laws); and
- lodge a complaint with your data-protection authority (for example the ICO in the UK, your national authority in the EU/EEA, the Office of the Privacy Commissioner of Canada, or the OAIC in Australia).
These rights come from laws such as the UK GDPR and EU GDPR, the California Consumer Privacy Act (as amended), Canada’s PIPEDA and Quebec’s Law 25, the Australian Privacy Act, and the personal data protection laws of the UAE and Saudi Arabia.
How to exercise them: email ciao@themarkitmedia.com with “Privacy request” in the subject and tell us what you want. We may need to verify your identity, and an authorised agent can act for you with your written permission. We respond within the time the law allows (generally one month in the UK and EU, and 45 days in California). You can unsubscribe from newsletters at any time using the link in the email.
10. Global Privacy Control and Do Not Track
We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of advertising and analytics tracking on this device, unless you have chosen otherwise using Cookie settings. We do not respond to the older “Do Not Track” header because there is no agreed standard for it.
11. Security
We use measures that include encrypted connections (HTTPS), access controls, two-step sign-in (password plus an emailed code) for the dashboard, and rate limiting against abuse. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your data we will notify you and the relevant authorities as the law requires.
12. Children
The Site and our services are for businesses and are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has given us data, email ciao@themarkitmedia.com and we will delete it.
13. Third-party links and embeds
The Site links to and embeds third-party services such as YouTube, WhatsApp and social networks. Their privacy practices are their own; please read their policies before you use them.
14. Changes to this policy
We may update this policy to reflect changes to the Site, our tools or the law. The effective date at the top shows the latest version. If a change is significant we will make it clear on the Site.
15. Contact us
Markit Media, Karachi, Pakistan
Email: ciao@themarkitmedia.com
Phone / WhatsApp: +92 300 2086081
US phone: +1 (606) 517-7561