Privacy Policy

1. Who is responsible for your data

The data controllers are Amad Mohammed Zulfiqar and Syed Daniyal Ali, trading as Kovion Holdings, an unincorporated business (see our legal status). For anything privacy-related, email hello@kovionholdings.com.

2. What we collect and why

When you contact us

The contact form asks for your name, email address, a subject and your message. We use these to reply and, if it goes further, to prepare a proposal. To stop spam we also store a one-way hash of your IP address (not the address itself) and run a Cloudflare Turnstile check.

Legal basis: our legitimate interest in answering enquiries, or taking steps at your request before entering into a contract.

When you request a quote

The quote form asks what you need (project type, features, a description, your type of business, an existing website if you have one, and timeline) and how to reach you (name, email address, optional business name and phone or WhatsApp number, country, preferred language and preferred contact method). We also record the page you sent it from and, if the link you followed carried campaign tags (for example utm_source=tiktok), those tags. We use this to reply, prepare a written quote and, if you become a client, to run the project. A one-way hash of your IP address helps us block spam and repeat submissions.

Only the founders can see enquiries, in a private admin area. A short notice that a new enquiry has arrived may be sent to our own team chat (Discord) or our own inbox; the team-chat notice contains the type of project and country but not your name or contact details. If we have switched on automatic confirmations, we email you a one-off acknowledgement with your reference number.

Legal basis: taking steps at your request before entering into a contract, and our legitimate interest in answering enquiries. Ticking the separate, optional box for news and offers is your consent to occasional marketing emails, which you can withdraw at any time; leaving it unticked has no effect on your enquiry.

When you message us on WhatsApp

WhatsApp buttons open a chat with our WhatsApp Business account. Messages you send there are handled by WhatsApp (Meta) under its own privacy policy, and by us to reply. Nothing is sent to WhatsApp until you choose to send a message.

Legal basis: taking steps at your request, and our legitimate interest in answering you.

Your language and country

If you choose a language or country, we remember it in a cookie so you see the right language, currency and contact options next time. Our network provider (Cloudflare) tells our server which country a connection comes from; we use that only as a first guess for prices and contact options, never to decide your language, and you can change it at any time. We never ask for your precise location.

When you report a bug

The bug-report form stores your description, the priority you choose, the page address and your browser's user-agent string. It doesn't ask for your name or email.

Legal basis: our legitimate interest in keeping the site working.

Analytics, only if you agree

If you allow analytics in the cookie banner, we record which pages you view, clicks on project links and WhatsApp buttons, when a quote form is started and sent, and your browser's user-agent string. This is stored in our own database. These records never include your name, email, phone number or what you typed. If we have switched on Google Analytics, it also loads only after you allow analytics. If you reject analytics, nothing is recorded.

Legal basis: your consent, which you can withdraw at any time from “Cookie preferences” in the footer.

Advertising measurement, only if you agree

When we advertise (for example on TikTok, Google or Meta), we may use those platforms' tags to measure whether our adverts lead to enquiries. These tags are off by default and load only if you allow “Advertising” in Cookie preferences. When they run, the platform receives your device and browsing information and the fact that an enquiry was sent or a WhatsApp button was tapped, never the contents of your form. The current list is in our Cookie Policy.

Legal basis: your consent, which you can withdraw at any time.

When you become a client

We keep the contact details, correspondence, contracts and invoices needed to run the project and meet our legal and tax obligations.

Legal basis: performing our contract with you, and legal obligation.

3. What we don't do

• We don't sell or rent your personal data.
• We don't load advertising cookies or tracking pixels unless you allow advertising.
• We don't put personal information in analytics events or in web addresses.
• We don't make automated decisions about you that have legal or similar effects.

4. Who else handles your data

We use a small number of service providers who process data on our behalf:

• Our own server, running the open-source Supabase database software, which stores enquiries, quote requests, bug reports and analytics events.
• Cloudflare, which delivers the site, reports a visitor's country and runs the Turnstile anti-spam check.
• Resend for sending and receiving email.
• Discord for internal notices about new enquiries and bug reports (no contact details in enquiry notices).
• WhatsApp (Meta), only if you choose to message us there.
• Google, TikTok or Meta, only if we have switched on their analytics or advertising tags and you have allowed them.

Some of these providers process data outside the UK and EEA. Where they do, we rely on the safeguards they provide, such as standard contractual clauses. We may also disclose information if the law requires it.

5. How long we keep it

• Enquiries and quote requests that don't lead to a project: deleted or anonymised within 24 months.
• Marketing preferences: until you unsubscribe, after which we keep only a note not to contact you.
• Client records: kept for as long as tax and accounting rules require, typically six years after the project ends.
• Bug reports and analytics events: deleted within 24 months.

6. Your rights

Depending on where you live, including under UK and EU data protection law, you have the right to:

• access the personal data we hold about you
• have it corrected or deleted
• object to or restrict how we use it
• receive a copy in a portable format
• withdraw consent at any time, where we rely on consent

Email hello@kovionholdings.com and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to your local data protection authority. In the UK that's the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to put it right first.

7. Children

This website isn't aimed at children under 13, and we don't knowingly collect their data.

8. Changes

If we change this policy, we'll update the date at the top. If a change materially affects how we use data you've already given us, we'll tell you directly where we can.