Privacy Policy

01Who this policy covers

This policy applies to moazarshad.com and nothing else. The site is operated by Moaz Arshad, an independent consultant working with clients remotely. I am the data controller for anything you send through this website.

If we work together on a project, the data I handle inside your own systems, such as your CRM, ad accounts or website, is covered by the agreement signed for that engagement, not by this page. In those cases you are usually the controller and I act as a processor on your instructions.

Questions about anything here go to contact@moazarshad.com.

02What is collected

One thing: what you type into the contact form. There is no other collection point on this site.

Full name

Required. So I know who I am replying to.

Email address

Required. This is where the reply goes.

Phone number

Optional. Only used if you ask to be called.

Business or company

Required. Context for the enquiry.

Industry

Optional. Helps me judge whether the work is a fit.

Primary challenge

Required. The problem category you select.

Message

Required. Whatever you choose to write.

Your submission is emailed to me over an encrypted SMTP connection and lands in my inbox. It is not written to a database on this website and it is not pushed into a CRM automatically.

My web host keeps standard server logs, which typically include IP address, request time, page requested and user agent. These are generated by the hosting infrastructure for security and reliability, not by anything I have added to the site, and I do not analyse them for marketing.

03What is not collected

This is stated plainly because a lot of privacy policies claim collection that is not happening, and the previous version of this page was one of them.

• No analytics. There is no Google Analytics, Google Tag Manager, Meta Pixel, Microsoft Clarity, Hotjar or any comparable tool on this site.
• No advertising or tracking pixels. Nothing here follows you to other websites or builds an advertising profile.
• No cookies set by this site. See the cookies section below.
• No account system. There is nothing to register for, so there are no usernames or passwords.
• No payments taken on this site. No card details are entered here or stored here.
• No special category data requested. Please do not send health, biometric, political or similarly sensitive information through the contact form.

04Why it is collected

To reply to your enquiry, to work out whether the project is something I can help with, and to carry out the work if we go ahead. That is the entire purpose.

Your details are not sold, rented, traded or shared for anyone else's marketing. You will not be added to a mailing list because you used the contact form. There is no newsletter on this site.

05Legal basis

Where UK GDPR or EU GDPR applies, the bases relied on are:

• Consent. You choose to fill in and submit the contact form.
• Legitimate interests. Replying to a business enquiry that you initiated, and keeping the site secure and available.
• Contract. If we go on to work together, processing needed to deliver the agreed work.

You can withdraw consent at any time by emailing me. Withdrawing it does not affect processing that already took place, and it does not remove records I am required to keep for tax or accounting reasons.

06Cookies and local storage

This site sets no cookies. It also writes nothing to localStorage or sessionStorage. There is no consent banner because there is nothing to consent to.

Two caveats worth being straight about. Your browser will cache static files such as stylesheets and images, which is ordinary browser behaviour rather than tracking. And if you click through to an external service such as Calendly or LinkedIn, that service sets its own cookies under its own policy once you are on their site.

07Third parties

Four, and only one of them receives anything automatically.

Google Fonts

Typefaces load from fonts.googleapis.com and fonts.gstatic.com. Your browser requests them directly from Google, which means Google receives your IP address and user agent as part of that request. This is the only third party contacted automatically when you open a page.

Web hosting

The site is hosted on Hostinger, which stores the files and generates the server logs described above.

Email delivery

Contact form submissions are sent over SMTP to my email provider, which stores the resulting message in my mailbox.

Calendly

Only if you click a booking link. Anything you enter to book a call is collected by Calendly under their privacy policy, not by this site.

Links to LinkedIn, Facebook and Instagram are ordinary links. No social widgets, embeds or share scripts run on this site, so those platforms receive nothing unless you click through.

08How long it is kept

• Enquiries that do not lead to work. Kept while there is an active conversation, then deleted once it is clear nothing is proceeding. In practice this means the message is removed from my inbox.
• Enquiries that become projects. Kept for the length of the engagement and afterwards where needed for accounting, tax and legal records.
• Server logs. Retained by the host on their own schedule for security and diagnostics.

You can ask me to delete your enquiry sooner and I will, unless I am required to keep a specific record.

09Your rights

Depending on where you live you may have the right to:

• Ask what personal data I hold about you and get a copy
• Have inaccurate details corrected
• Have your data deleted
• Object to or restrict processing
• Receive your data in a portable format
• Withdraw consent you previously gave

Email contact@moazarshad.com and I will respond within 30 days. There is no charge, and I may ask you to confirm your identity before acting on a request so that I am not disclosing someone else's information.

10Security

• The whole site is served over HTTPS, and requests to the insecure address are redirected.
• Form submissions are sent to my email over an authenticated, encrypted SMTP connection.
• Form input is validated and sanitised on the server before the message is built.
• Mail credentials live in a server side configuration file that is outside version control and is never sent to the browser.
• A hidden honeypot field filters automated spam without a captcha, so no third party challenge service sees your visit.

No system is perfectly secure. If you have something genuinely confidential to send, arrange a more suitable channel with me before sending it through a web form.

11Children

This site offers business services and is not directed at children. I do not knowingly collect personal data from anyone under 16. If you believe a child has submitted information through the form, email me and I will delete it.

12International visitors

The site is available worldwide and I work with clients internationally. Depending on where the hosting and email infrastructure sits, information you send may be processed in a country other than your own, including outside the UK and the European Economic Area.

Where that happens, the transfer is limited to what is needed to reply to you and deliver work you have asked for.

13Changes to this policy

If this policy changes, the updated version is published on this page and the date at the top of the page changes with it. There is no separate notification, so check back if this matters to you.

This version corrects earlier text that described analytics and cookies which are not actually present on the site.

14How to contact me

For any privacy question, request or complaint, or to exercise any of the rights above: