This policy explains what personal data is collected through arfahfarooq.com, the purposes for which it is used, the legal basis for each use, who it is shared with, how long it is retained, and the rights available to you under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data controller
The data controller for the personal data described in this policy is Arfah Farooq, operating as a sole trader in the United Kingdom.
Enquiries relating to this policy, and requests to exercise any of the rights set out in section 9, should be sent to hello@arfahfarooq.com.
2. Personal data collected
2.1 Data you provide directly
- Waitlist and enquiry forms: your name, email address, and any additional information requested by the relevant form, such as your current role, area of interest, or the difficulty you are seeking help with.
- Free guide downloads: your email address.
- Purchases of paid programmes: your name, email address, stated experience level, stated objectives, and social media handle where provided. Card and payment details are collected and processed directly by Stripe Payments Europe Ltd and are neither transmitted to nor stored by this website.
- Correspondence: the contents of any email or message you send, together with your email address and any information contained within that correspondence.
2.2 Data collected automatically
- Server logs: this website is hosted by Netlify, which records standard access log data including IP address, browser type, referring page, and pages requested. These logs are used for security, diagnostics, and service availability only.
- Analytics data: where you have given consent, Google Analytics 4 collects information about your visit, including pages viewed, approximate geographic location derived from an anonymised IP address, referral source, device type, and browser. This is described further in section 3.
No special category data as defined in Article 9 UK GDPR is intentionally collected through this website.
3. Cookies and similar technologies
Cookies are small files placed on your device by a website. This website uses cookies for analytics purposes only. No advertising, profiling, retargeting, heatmapping, or session recording technologies are used.
3.1 Consent
Analytics cookies are not classified as strictly necessary and are therefore set only with your prior consent, as required by the Privacy and Electronic Communications Regulations 2003 (PECR). When you first visit the site you are presented with a banner offering the options Accept and Reject, given equal prominence.
If you select Reject, no analytics script is loaded, no analytics cookie is set, and no request is made to Google. If you select Accept, the cookies listed below are set. Consent is recorded for a period of twelve months, after which you will be asked again.
3.2 Cookies used
- _ga — set by Google. Assigns a randomly generated identifier to your browser to distinguish unique visitors. Expires after two years.
- _ga_9EYYLW4LX7 — set by Google. Maintains session state so that multiple page views within a single visit are recorded as one session. Expires after two years.
Neither cookie contains your name, email address, or any other directly identifying information, and neither is used to identify you as an individual. IP anonymisation is applied and Google Signals is disabled, so visits are not associated with signed-in Google accounts and no demographic or cross-device profiling is carried out. The site further instructs Google to redact advertising identifiers, and withholds consent for advertising storage, advertising personalisation, and the use of your data by advertisers, so this data is not used for advertising purposes or to build an advertising profile of you.
3.3 Record of your choice
Your response to the banner is stored in your browser's local storage under the key af_cookie_consent. This record is strictly necessary for the purpose of honouring your choice and preventing the banner from reappearing on every page. It is not transmitted to any third party and is retained within your browser only.
3.4 Withdrawing or changing consent
You may change your decision at any time by selecting Cookie settings, which is also available in the footer of every page. You may additionally delete or block cookies through your browser settings. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
3.5 Third party content
- Google Fonts: typefaces are served by Google, which receives your IP address when a page loads. No cookies are set by this service.
- Embedded YouTube videos: videos on the press, speaking, and Inclusive Tech World pages are embedded using YouTube's privacy-enhanced mode. YouTube does not set cookies or record viewing data unless you initiate playback, at which point YouTube's own privacy policy applies.
External links to third party platforms are ordinary hyperlinks. Once you follow such a link, the privacy policy of the destination site governs any processing of your data.
4. Purposes of processing and legal bases
- Responding to enquiries and correspondence. Legal basis: legitimate interests, namely responding to persons who contact me.
- Adding you to a mailing list and sending the communications you requested. Legal basis: consent, given at the point of submission.
- Delivering free guides and resources. Legal basis: consent.
- Supplying, administering, and supporting paid programmes. Legal basis: performance of a contract to which you are a party.
- Following up on an abandoned checkout, on one occasion. Legal basis: legitimate interests, namely recovering incomplete transactions.
- Maintaining records required for tax and accounting purposes. Legal basis: compliance with a legal obligation.
- Measuring website usage and improving content. Legal basis: consent.
- Maintaining the security and availability of the website. Legal basis: legitimate interests.
Where processing is based on legitimate interests, an assessment has been carried out to confirm that those interests are not overridden by your interests, rights, and freedoms. You may object to such processing under section 9.
5. Artificial intelligence tools
Certain business operations, including the drafting and review of written material and the organisation of records, are supported by third party artificial intelligence and automation services. Where personal data is processed using such services, those providers act as processors on documented instructions and are engaged under terms that prohibit the use of that data to train their models.
No decision producing legal effects concerning you, or similarly significantly affecting you, is taken solely by automated means within the meaning of Article 22 UK GDPR. No profiling of website visitors is carried out.
Legal basis: legitimate interests, namely the efficient administration of the business.
6. Recipients and processors
Personal data is disclosed only to the following categories of recipient, each of which processes data on documented instructions and is prohibited from using it for its own purposes:
- Netlify — website hosting and form handling
- Airtable — storage of waitlist and enquiry submissions
- MailerLite — mailing list management and email delivery
- Stripe — payment processing
- Google — font delivery and, subject to consent, website analytics
- YouTube — video hosting, subject to playback being initiated
- Artificial intelligence and automation service providers — as described in section 5
Personal data is not sold, rented, traded, or disclosed to advertisers or data brokers. Disclosure may additionally be made where required by law, court order, or a regulatory authority.
7. International transfers
Certain recipients listed in section 6 are established in, or store data in, the United States or other countries outside the United Kingdom. Where personal data is transferred outside the UK, the transfer is made subject to appropriate safeguards under Article 46 UK GDPR, namely the International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it.
8. Retention
- Mailing list records: until you unsubscribe, or until a period of two years of inactivity has elapsed and the list is cleansed.
- Transaction and purchase records: six years from the end of the relevant accounting period, in accordance with HMRC requirements.
- Correspondence: up to two years following the final exchange.
- Server logs: as retained by Netlify, typically thirty days.
- Analytics data: fourteen months, after which it is deleted automatically by Google.
- Record of cookie consent: twelve months, stored within your browser.
9. Your rights
Subject to the conditions and exemptions set out in the UK GDPR, you have the right to request access to your personal data; to request rectification of inaccurate data; to request erasure; to request restriction of processing; to data portability; to object to processing carried out on the basis of legitimate interests; and to withdraw consent at any time where processing is based on consent.
Consent to marketing email may be withdrawn using the unsubscribe link contained in every message. Consent to analytics cookies may be withdrawn using the Cookie settings link in the footer of any page.
Requests should be sent to hello@arfahfarooq.com and will be responded to within one month of receipt. No fee is payable, save where a request is manifestly unfounded or excessive.
You have the right to lodge a complaint with the Information Commissioner's Office, the supervisory authority for data protection in the United Kingdom, at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113. You are invited, though not required, to raise the matter directly first so that it may be resolved.
10. Children
This website and the services offered through it are intended for adults. Personal data relating to children under the age of 13 is not knowingly collected. Where it comes to my attention that such data has been collected, it will be deleted without undue delay.
11. Changes to this policy
This policy will be updated where there is a material change to the personal data collected, the purposes of processing, or the recipients of that data. The date of the current version is stated at the top of this page. This version is dated 14 September 2026.