Privacy Policy

1. No analytics, no tracking

This site does not use analytics tools, advertising trackers, tracking pixels, or marketing cookies. It does not build profiles of visitors and does not sell or share visitor data with advertisers. Browsing this site does not require an account and does not ask you for any personal information. Because nothing is stored on your device beyond what the browser needs to display the page, there is no cookie consent banner — there is nothing to consent to.

2. Server logs

Like almost every website, the hosting infrastructure that serves this site may keep standard, short-lived server logs — including IP address, browser type, and request timestamps. An IP address is personal data, so this is processing, and we do it on the basis of our legitimate interest in keeping the site available and secure (Article 6(1)(f) GDPR). We do not use these logs to identify or track individual visitors, and we do not combine them with anything else.

3. Data you choose to send us

If you email us at arberrexha.dev@gmail.com, or contact us through a scheduling link offered on this site, we receive the information you choose to provide — typically your name, email address, company details, and the content of your message. We use this information only to:

• respond to your enquiry,
• evaluate and prepare a potential consulting engagement, and
• carry out an engagement we agree on.

We do not add you to a mailing list, and we do not send marketing email based on an enquiry.

4. Why we are permitted to process it

Under the GDPR every purpose needs a legal basis. Ours are:

• Responding to an enquiry — our legitimate interest in answering people who contact us about our services, and yours in getting a reply (Article 6(1)(f)).
• Preparing and carrying out an engagement — performance of a contract with you, or steps taken at your request before entering one (Article 6(1)(b)).
• Invoicing and business records — compliance with a legal obligation, principally tax and accounting retention rules (Article 6(1)(c)).
• Keeping the site available and secure — our legitimate interest in operating infrastructure that is not abused (Article 6(1)(f)).

We do not rely on consent for anything, because we do not do anything that requires it. No marketing, no tracking, no profiling.

5. Third-party processors

Our email is provided by Google (Gmail), so correspondence you send us is processed on Google's infrastructure under Google's own terms and security practices. This site is hosted by Vercel. If you book a call through a third-party scheduling tool linked from this site, the information you enter there is also processed by that tool's provider under its own privacy policy. We do not pass your data to any other third party unless you ask us to or the law requires it, and we never sell it.

6. Transfers outside the EEA

Google and Vercel are US companies, so correspondence and server logs may be processed outside the European Economic Area. Those transfers rely on the EU–US Data Privacy Framework, under which both providers are certified, and on the European Commission's Standard Contractual Clauses where the Framework does not apply. If you would like to see the specific mechanism a given provider relies on, ask and we will point you at it.

7. Retention

We keep correspondence for as long as it is relevant to an ongoing or potential engagement, plus any period required for legitimate business records — invoicing and tax obligations typically fix that at several years, and the exact figure is set by the tax law that applies to us rather than by us. We delete enquiries that clearly lead nowhere.

8. Your rights

You can ask us at any time to give you a copy of the personal data we hold about you (access), correct it (rectification), delete it (erasure), limit what we do with it (restriction), or hand it to you or another provider in a machine-readable form (portability). Where we rely on legitimate interests, you can also object to the processing, and we will stop unless we have compelling grounds that override your objection.

Email arberrexha.dev@gmail.com and we will act on the request within one month, unless a legal obligation requires us to retain something — in which case we will tell you which one.

You also have the right to lodge a complaint with the data protection supervisory authority in the EU or EEA country where you live or work, or where you believe the issue occurred. You do not have to raise it with us first, though we would rather you did.

9. No automated decision-making

We do not make decisions about you by automated means, and we do not profile you. We build AI systems for clients; we do not point them at the people who email us. Enquiries are read by a person.

10. Children

This site is a professional services site and is not directed at children. We do not knowingly collect data from anyone under 16.

11. Changes

If this policy changes — for example, if analytics are ever added — the updated version will be posted on this page with a new effective date.

12. Contact

Questions about this policy, or any request under section 8: arberrexha.dev@gmail.com.