Privacy policy

Who we are

Ghalib Ashrafi, a digital marketing agency working since 2014, with its office at Hyderi, Block G, North Nazimabad Town, Karachi 74700, Pakistan. We serve clients in the United Kingdom, United States, Pakistan, Australia and the United Arab Emirates.

For anything on this page, write to info@ghalibashrafi.com. A person reads that mailbox.

What the contact form takes

Your name	Required. So we know who we are replying to.
Your email	Required. It is where the reply goes.
Phone number	Optional. Only used if you ask us to call, or if email bounces.
Website address	Optional. So we can look at the site you are asking about.
Budget range	Optional, and a range rather than a figure. It decides whether we are the right fit before either of us spends an hour finding out.
What it is about	The reason you picked from the list — an audit, a project, a referral, a role.
Your message	Whatever you wrote.

And four things recorded automatically

A one-way hash of your IP address

Not your IP address. It is put through SHA-256 together with a secret key and cut to 16 characters before anything is written down, and that cannot be turned back into an address. It exists so the form can tell that thirty submissions in a minute came from one place, and nothing else.

Your browser's user-agent string

The line every browser sends identifying itself. Used to recognise bots.

Which page you sent the form from

So we know what you were reading when you decided to write.

The date and time

So enquiries can be answered in order.

What we do not collect

• No cookies set by us. Our own code sets none — not for sessions, not for preferences, not for anything. Google Tag Manager and whatever it loads are a separate matter and are described below.
• No advertising or profiling by us. Nothing you send us is used to target you, anywhere.
• Nothing is sold or rented. Not to data brokers, not to partners, not to anyone.
• No account, no password, no payment details. There is nothing to sign up for on this site.

Cookies

Our own code sets no cookies. What does is Google Tag Manager, which runs on every page and loads our measurement tags — those can store cookies in your browser to tell one visit from another.

Nothing loads until you say so. Tag Manager is not on the page when you arrive. The first time you visit you are asked, and the container is only fetched if you accept — so declining is not a setting applied after the fact, it means the script was never run at all. Under UK and EU rules analytics cookies are not “strictly necessary” and have to wait for agreement, and waiting is what this does.

Declining costs you nothing: every page works identically either way, and you will not be asked again on the same browser. To change your mind, clear this site’s data in your browser and you will be asked afresh.

If you browse with JavaScript disabled, no analytics run at all — there is no fallback that measures you without asking, because there would be no way to ask.

Why we are allowed to hold it

You sent us a message asking us to reply, so the lawful basis is taking steps at your request before entering into a contract, and where that does not apply, our legitimate interest in answering people who contact our business. Both are grounds under UK and EU GDPR.

We do not use it for anything else. If we ever wanted to — a newsletter, a case study with your name on it — we would ask you first, separately, and a no would cost you nothing.

Where it goes

Two places, and no others. It is written to a file on our own server, and it is emailed to info@ghalibashrafi.com. You also get an automatic acknowledgement, which says it is automatic.

Our office is in Pakistan and our server is with Hostinger, so if you are writing from the UK or the EU your message leaves that area. We rely on your consent in sending it, and on the necessity of the transfer to answer you. If that matters to your organisation, say so and we will work to whatever your policy requires.

Who else can see it

Who	What for
Google Tag ManagerMeasurement, on every page	A Google container that loads our measurement tags. It runs on every page, so Google receives your IP address and browser details on each visit, and it and the tags inside it can set cookies in your browser. We use it to understand which pages get read and where people give up — not to build a profile of you, and not for advertising.
HostingerHosting and email	The site and its mailbox run on Hostinger's servers, so enquiries physically sit there. They act on our instructions and do not use the content for their own purposes.
GoogleThe map on the contact page	The map on /contact/ is embedded from Google Maps and loads with the page. That means opening that page tells Google your IP address and browser details, whether or not you look at the map. No other page on this site contacts Google.
Meta (Facebook)A review widget	One page embeds a Facebook widget, and Facebook’s script is not loaded until you accept — the same choice that governs Tag Manager. Decline, or simply ignore the banner, and Facebook is never contacted at all. If you do accept, Facebook can see that you visited that page.

Being straight about the map. It would be better if the map on the contact page waited for you to click before loading, and at the moment it does not. Until that changes, opening /contact/ tells Google you were there. We would rather write that down than let you assume otherwise.

How long we keep it

Enquiries are kept for 24 months from your last contact with us, then deleted. That is long enough to pick up a conversation that went quiet and to answer a question about work we did, and no longer.

If you want it gone before then, ask. It does not need a reason and we will not try to talk you out of it.

How it is protected

• The whole site is served over HTTPS, so what you type is encrypted in transit.
• Your IP address is hashed before it is stored, so the file does not contain it.
• The folder holding enquiries is blocked from the web at the server level and is not readable through the site.
• Access to the mailbox and the server is limited to people who need it.
• No system is beyond failing. If yours is caught in a breach that puts you at risk, we will tell you and the regulator within 72 hours of finding out.

Your rights

If you are in the UK or the EU these are legal rights. If you are anywhere else we will honour them anyway, because there is no good argument for two standards.

See what we hold

Ask, and we will send you everything filed under your email address.

Have it corrected

If something is wrong, tell us and we will fix it.

Have it deleted

Ask and it goes, unless we are required to keep it — and we will say so if that ever applies.

Object, or restrict it

You can tell us to stop using it while a question is settled.

Take it with you

We will send it in a machine-readable file.

Complain

In the UK, to the Information Commissioner's Office at ico.org.uk. In the EU, to your national supervisory authority. You do not have to raise it with us first, though we would rather you did.

Email info@ghalibashrafi.com. We will reply within 30 days, usually far sooner, and we will not charge you.

Children

This site sells services to businesses and is not aimed at children. We do not knowingly collect anything from anyone under 16. If you think we have, tell us and it will be deleted.

Changes

If this page changes, the date at the top changes with it. If a change actually affects how we treat information already sent to us, we will email the people it affects rather than quietly editing the page.