Privacy notice

Who I am

I'm Mohammad Fayez, and I'm the data controller for the personal data described in this notice. A data controller is the person who decides why and how personal data is used. I run a one-person consulting practice providing digital marketing to UK private dental practices, described on the work I do for practices.

Because I'm based outside the UK and offer services to UK businesses, UK data protection law applies to how I handle personal data about people in the UK.

What I collect and where from

WhatsApp. My WhatsApp username is @imfayez1, and messages to it reach my own WhatsApp account. WhatsApp is provided by Meta, so a message you send there is also processed by WhatsApp under its own terms and privacy policy. I treat a WhatsApp message as an email enquiry: the same lawful basis and the same retention period apply.

Prospecting. I contact practice owners by email only where the practice is a limited company. Under the Privacy and Electronic Communications Regulations (PECR), companies are "corporate subscribers" and can be emailed without prior consent, as long as the sender is identified and gives a valid address for opting out.¹ Sole traders and many partnerships are treated as individuals under PECR and are not emailed without consent.² I check which applies on Companies House before any email is sent.

If I hold your details from these sources, you're told about it, with a link to this notice, in my first message to you. Data protection law requires this information to be given no later than the first communication where the data was not collected from you directly.³

Client patient data. Where client work involves a practice's patient data, for example matching booked treatments back to ad clicks, the practice is the controller and I act as its processor under a written agreement. That processing is governed by that agreement, not by this notice.

Where your information is processed

I work remotely from Bangladesh, as set out above, so information you send me is processed there. Bangladesh is not covered by UK adequacy regulations, so I treat everything I hold to the UK standard described in this notice. These providers process data for me:

• Google (Google Workspace): email, documents and file storage, in Google's data centres, including the US. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework, and uses standard contractual clauses where that does not apply.⁴
• Cloudflare: hosting this site, protecting it from attack, and counting visits, on Cloudflare's global network, including the US. Cloudflare is certified under the UK Extension to the EU-US Data Privacy Framework.⁵
• WhatsApp (Meta): messages you choose to send me on WhatsApp, on Meta's servers, including the US, under WhatsApp's own terms.

Email me if you want a copy of any safeguard listed here.

Why (lawful basis)

Data protection law requires a lawful basis for each use of personal data.⁶

Legitimate interests means I have a genuine business reason, the use is necessary for it, and it doesn't override your rights. For prospecting, I keep the data to business contact details, use it only for a small number of relevant messages, and stop immediately if you object.

How long I keep it

Your rights

You have the right to ask for a copy of your personal data, to have it corrected, to have it erased, to restrict or object to its use, and to receive data you gave me in a portable format. Email [email protected] to use any of these, or use the contact page. I will respond within one month, as the law requires,⁸ and I will not charge for a reasonable request.

No automated decision-making

I don't make decisions about you by automated means alone, including profiling, that have a legal or similarly significant effect on you. Automation helps me research and draft, but any decision about you, such as whether to contact you, is made by me.

Complaints

If you're unhappy with how I've handled your data, complain to me first by email at [email protected], and I'll try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at any time: ico.org.uk/make-a-complaint.

Opting out

You can stop all contact from me at any time. Reply "no thanks" to any email, or email [email protected] with "opt out".

Your right to object to direct marketing is absolute: once you object, your data isn't used for marketing again.⁹ I honour it straight away. Rather than deleting you entirely, I add you to a suppression list, which keeps only enough information to make sure you're not contacted again. The ICO describes suppression as the preferable approach for exactly this reason.¹⁰

Analytics

This site uses Cloudflare Web Analytics to count visits. Cloudflare states that it "does not use any client-side state, such as cookies or localStorage" to collect usage metrics, and that it doesn't fingerprint visitors by IP address or browser details.⁷ I use the figures only to see which pages are read and to improve the site, and they are not shared for any other purpose. If you would rather not be counted, use the analytics opt-out at the end of this page; your choice is kept in your own browser. There are no advertising cookies, tracking pixels or cross-site trackers on this site, so there's no cookie banner.

The site is hosted on Cloudflare, which processes technical connection data to serve pages and protect the site from attack.

Changes

If I change how I handle personal data, I will update this notice and the date at the top. Significant changes affecting people I'm already in contact with will be told to them directly.