This is how I handle personal data, written to be read rather than skimmed past. If anything here is unclear, ask me.
Who I am
Xheia is a data consultancy run by Hoda. I'm responsible for any personal data collected through this site or in the course of my work (the "controller," in data protection terms).
Contact for anything privacy-related: contact@xheia.co
What I collect
- Enquiries: your name, email, company (if you give it) and message when you use the contact form or email me.
- Bookings: your name, email and anything you add to the booking when you schedule a call.
- Prospects: business contact details (name, job title, work email, company) of people at organisations that might need my services, gathered from public sources such as company websites and LinkedIn.
This site has no analytics or tracking cookies. It stores one thing in your browser - your light/dark theme choice - and that never leaves your device.
Why I use it
- To reply to your enquiry, hold the call you booked, and prepare a proposal if you ask for one.
- To contact businesses that may need my services, with a relevant, individual message - not bulk mailing lists.
The legal basis for both is legitimate interests: running and growing my business, in ways you'd reasonably expect. If we go on to work together, the basis for data needed to deliver that work becomes our contract. I don't sell personal data, and I don't use it for automated decision-making.
Who else handles it
I use a small number of services that process data on my behalf:
- Netlify - hosts this site and receives contact form submissions.
- Google Workspace - email, and Google Calendar for booked calls.
Nobody else gets your data unless the law requires it.
Where it goes
I work remotely, and some of the services above store data in the US. That means your data may be accessed or stored outside the UK. Where it is, I rely on the safeguards those providers put in place for international transfers, such as the UK's approved data transfer agreements and addendums.
How long I keep it
- Enquiries and bookings: two years from our last contact, then deleted.
- Prospects: deleted when the conversation closes or as soon as you opt out. After an opt-out I keep only your email address on a suppression list, so I never contact you again by mistake.
- Clients: as long as the law requires for business and tax records.
Your rights
You can ask me, at any time and free of charge, to:
- give you a copy of the data I hold about you
- correct anything that's wrong
- delete it
- stop using it, or object to how I'm using it
- stop contacting you - one reply saying so is enough
Email contact@xheia.co and I'll respond within one month.
If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint (opens in a new tab). I'd appreciate the chance to fix it first.