Privacy Policy

1. Who is responsible?

Khaldoon Esmail, based in Spijkenisse (the Netherlands), is the data controller for the processing carried out on this website.

Questions about privacy? Email spark@khaldoonesmail.nl.

2. What data do I collect?

I only collect data needed for the purpose you provide it for:

• Contact and enquiry forms: name, email address, optionally your organisation, and the content of your message.
• Quick scan and academy requests: the answers you submit, plus your contact details.
• Direct contact by email or WhatsApp: the information you share in the conversation.
• Automatically, with your consent: anonymised visit statistics via Google Analytics (see the Cookie Policy).

3. Why, and on what legal basis?

• Responding to your enquiry or quote request — performance of (pre-)contractual steps.
• Improving the website through statistics — only with your consent.
• Advertising measurement (Google) — only with your consent.
• Website security and abuse prevention — legitimate interest.

4. Cookies and measurement

This site uses cookies for statistics and advertising measurement, only after you make a choice in the cookie banner. Everything is off by default (Google Consent Mode v2). Details and lifetimes are in the Cookie Policy, where you can also change your choice at any time.

5. Where is data stored?

I work with a small number of carefully chosen processors:

• Supabase — storage of form submissions (database, EU region).
• Vercel — website hosting.
• Google (Analytics, AdSense) — statistics and advertising, only with consent.
• Meta (WhatsApp) — when you choose to contact me via WhatsApp.

6. Transfers outside the EU

Some providers (such as Google) process data outside the European Economic Area. Where that happens, it is based on the European Commission's Standard Contractual Clauses or an adequacy decision (such as the EU–US Data Privacy Framework).

7. How long do I keep data?

• Contact and enquiry data: as long as needed to handle your request, at most 2 years after the last contact.
• Data required for accounting: 7 years (statutory tax retention obligation).
• Analytics data: at most 14 months (Google Analytics setting).
• Your cookie choice: 12 months.

8. Your rights

Under the GDPR you have the right to:

• Access your personal data
• Rectify incorrect data
• Erasure (the right to be forgotten)
• Restriction of processing
• Data portability
• Object to processing
• Withdraw previously given consent, at any time

9. Filing a complaint

To exercise any of your rights, email spark@khaldoonesmail.nl; I respond within 30 days. If you are not satisfied with how your request is handled, you can lodge a complaint with the Dutch Data Protection Authority, Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your own EU member state.

10. Security

I take appropriate technical and organisational measures: encrypted connections (HTTPS), restricted database access, and data minimisation — I collect no more than necessary.

11. Minors

This website is not directed at persons under 16. I do not knowingly collect data from minors.

12. Changes

This policy may be updated, for example when functionality or regulations change. The date at the top always shows the most recent version.