Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

We collect the following categories of personal data:

• Contact data: Name, email address, and phone number when you submit the contact form or book a service.
• Booking data: Service selection, package details, and payment confirmation when you book through our platform.
• Lead magnet data: Email address when you request a free downloadable resource.
• Analytics data: Browser type, pages visited, session duration, and device type via Google Analytics.
• Payment data: Payment is processed by Stripe. We do not store card details.

3. Legal Basis for Processing

We process your data based on the following legal grounds under GDPR Article 6:

• Contract performance: Processing bookings and delivering services you have purchased.
• Legitimate interest: Responding to enquiries and improving our website.
• Consent: Analytics tracking and marketing emails (you may withdraw consent at any time).

4. How We Use Your Data

• To process and manage bookings and payments
• To respond to enquiries submitted via the contact form
• To send you the free resource you requested
• To analyse website performance and improve user experience
• To comply with legal and regulatory obligations

5. Third-Party Services

We use the following third-party processors, each with their own privacy policies:

6. Cookies

We use Google Analytics cookies to track website usage. These are analytics cookies that help us understand how visitors interact with our site. You may disable cookies in your browser settings or opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy. Booking records are retained for up to 7 years for accounting and legal compliance. Analytics data is retained for 26 months as per Google Analytics default settings. Lead and contact data is retained for up to 2 years.

8. Your Rights Under GDPR

Under the GDPR, you have the following rights:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data (“right to be forgotten”).
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for marketing purposes.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at info@alimahdi.net. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data is stored securely using Supabase with Row Level Security policies and all data in transit is encrypted via HTTPS/TLS.

10. International Data Transfers

Our service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place such as Standard Contractual Clauses (SCCs) as required by GDPR.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this policy periodically.

12. Contact & Complaints

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at info@alimahdi.net. You also have the right to lodge a complaint with your local data protection authority.