Privacy Policy

I use personal information to respond to you, arrange and deliver the service you request, keep necessary records and protect this website. This policy covers bookings and contact through sumansaha.me; separate ventures and external platforms have their own policies.

Who is responsible and how to contact me

For privacy questions or to exercise a right, contact contact@sumansaha.me and describe your request. Please do not include unnecessary identity documents. I may ask for proportionate information to verify that a request concerns your own data.

Information collected

• Enquiries: your name, email, current city/country, requested service, message and optional contact preference/WhatsApp number or package choices.
• Bookings: your name, email, location, service, duration, appointment time/time zone, optional notes, price/currency, payment method, booking reference and status.
• Service and consumer records: relevant correspondence, agreed guidance, payment confirmations, invoices where applicable, terms acceptance, any express early-start request, and withdrawal or complaint notices.
• Website operation: browser/device and connection information that hosting or security services may log. The site uses a salted, hashed connection identifier for short-term form rate limiting rather than saving a raw IP in the booking record.
• Optional activity: analytics information only after the relevant choice; comment content and commenter details only if comments are enabled and you submit a comment.

Website forms do not ask for card numbers, account passwords, passport scans or health records. Avoid putting sensitive or unnecessary family information in a message. Share another person’s details only where you have authority to do so. Family and school services are booked by an adult; this website is not intended for children to book independently.

After verified payment, you may open an external Calendly link to choose your appointment and provide scheduling information there. This site does not embed Calendly or automatically send your name, email or private booking-link key in that link. Calendly and Google Calendar/Google Meet handle scheduling and calls under their own terms and privacy information. I may record the agreed appointment, Google Meet link, booking-status history and relevant customer correspondence in the private booking record to deliver and administer the service. Private internal notes are not included in customer notifications. Account connections, calendar invitations and external calendar changes are managed separately, not automatically synced by this website.

For IT freelance reviews and QA mentoring, you may choose to share your public profile, drafts or learning goals. For a scoped QA review, product information and test evidence are limited to the agreed work. Use authorised test accounts and synthetic data where possible; do not send platform passwords, customer databases or confidential credentials through these forms. Any necessary secure access, extra providers and retention arrangements are agreed before the review begins.

Why information is used and the legal basis

• Responding and providing the service: enquiries, scheduling, confirmations, preparation and support are processed to take steps you request before a contract or to perform that contract.
• Financial and legal records: information needed for accounting, applicable legal obligations and handling consumer requests is processed where a legal obligation applies.
• Site security and disputes: limited records may be processed for legitimate interests in preventing abuse, maintaining reliable services and establishing or defending claims, balanced against your rights.
• Optional analytics or other optional uses: consent, which you can withdraw. Submitting a booking or acknowledging this policy does not consent to marketing or analytics.

The essential booking/contact fields are needed to handle your request. You can leave optional notes blank. Without necessary contact or booking details, I may be unable to arrange or deliver the service. There is no automated decision with legal or similarly significant effects about you in this site’s booking flow.

Storage, recipients and payment providers

Enquiries and bookings are stored in the site’s WordPress database with administration access. The website uses WordPress email delivery to send messages and confirmations, so necessary content also passes through the configured hosting and email services. A call platform or other service used for your session will be identified when arranging it.

For card bookings, Stripe receives the information needed for hosted checkout and payment verification, including the booking reference, amount and email. Card details are entered with Stripe, not collected by this site’s booking form. With Wise, PayPal or an optional crypto provider, the information you give that provider and its transaction rules are governed by its own notices; I receive the payment information needed to match it to your booking.

If enabled and accepted, Google Analytics (directly or through Site Kit) processes website usage information. Comments, if enabled, can be public and may be checked by the site’s configured moderation or anti-spam service; WordPress may store the commenter’s IP address and browser information, and an avatar service may receive a hashed email identifier if avatars are enabled. External links are governed by the destination site’s policy. Your booking does not automatically share your details with my separate ventures.

If a newsletter or marketing signup is provided, the identified email provider (for example, Hostinger Reach when used) processes the details you submit for that separate purpose. A subscription requires its own choice and an unsubscribe route; booking a consultation does not subscribe you. The signup notice and current provider inventory must identify any related measurement or tracking.

I do not sell your personal information. Access is limited to the operator, authorised service providers performing their relevant role, and authorities or advisers where legally required or necessary for a lawful claim. A referral involving your personal details requires an appropriate basis and will be discussed with you.

International transfers

The location of processing depends on the actual hosting, email, payment, call and analytics providers used. Some may process information outside the European Economic Area. Where a transfer is made by or on behalf of this service, it must have a valid GDPR transfer basis, such as an adequacy decision or appropriate contractual safeguards. Contact me for the current recipient locations, applicable safeguards and how to obtain information about them; this page does not assume that every provider stores data in Spain.

How long information is kept

I keep enquiry and service information only while needed to answer the request, deliver agreed work and manage necessary follow-up. Accounting/transaction and consumer records are retained for the applicable statutory periods; limited records may be retained while a relevant claim or dispute remains possible. Optional analytics retention depends on the configured property. When no longer needed, data should be deleted or anonymised, subject to necessary backup cycles and legal holds.

Cookies and security

Read the cookie policy for the privacy preference cookie, appearance storage and optional analytics. You can change the analytics choice using Cookie settings in the footer. The site’s own analytics loader stays off until opt-in.

I use access controls and appropriate technical and organisational measures for the information handled. No internet service can promise absolute security. Use a private device where possible and keep the booking confirmation link confidential: it includes information that helps you access your booking details.

Your rights

Subject to the applicable conditions, you can request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You can withdraw consent for optional processing at any time without affecting the lawfulness of earlier processing. Send requests to contact@sumansaha.me. I will normally respond within one month; if a lawful extension is needed, I will explain it within that month.

You can complain to the Spanish Data Protection Agency (AEPD) or the competent supervisory authority in your country. Some records must be kept to comply with a legal duty or manage a lawful claim, so erasure is not absolute.

Policy changes

I update this policy when the service or its data handling changes. Material changes that require new consent will be presented separately. Ask contact@sumansaha.me for details of the current configuration or a copy of the policy relevant to your booking.