Privacy Policy

This site is shahedparvej.com, run by Shahed Parvej, a local SEO, AEO and GEO consultant based at 9 New Change, London EC4M 9AG, United Kingdom.

For anything in this policy, including a request to see or delete your data, email sales@shahedparvej.com or call +44 7476 609950. You are dealing with me directly, not a support desk.

For the purposes of UK data protection law I am the data controller for the personal data described below. That means I decide what is collected and why, and I am the person accountable for it.

Two things, and nothing else.

1. What you send me through the contact form

The form asks for your first name, surname, business name, telephone number, email address, and optionally your website, the service you are interested in, the main area you serve, and a description of your problem. All of it is information you choose to type and send.

2. Standard server records

Like any website, the server that delivers these pages records ordinary technical information such as the IP address a request came from, the time, and which page was requested. This is how the internet works rather than a decision I made, and I do not use it to build a profile of you. It is also used to rate-limit the contact form so it cannot be flooded.

This section exists because most privacy policies bury it. I would rather state it plainly, and it is checkable by opening your browser's developer tools on any page here.

• No cookies. This site sets none. There is no cookie banner because there is nothing to consent to.
• No analytics. No Google Analytics, no tag manager, no Hotjar, no Clarity, nothing measuring your behaviour.
• No advertising pixels. No Meta pixel, no LinkedIn insight tag, no remarketing of any kind.
• No browser storage. Nothing is written to localStorage or sessionStorage.
• No font tracking. The fonts are served from this domain rather than from Google Fonts, so loading a page makes no request to Google.
• No selling or sharing for marketing. Your details are never sold, rented, or passed to anyone for their own marketing.

UK GDPR requires a lawful basis for every use of personal data. Mine are these.

• To reply to your enquiry and prepare your audit. Lawful basis: legitimate interests, specifically responding to somebody who has asked me to get in touch. If we go on to work together, the basis becomes performance of a contract.
• To keep a record of the work and of our correspondence. Lawful basis: legitimate interests in running a business properly, and legal obligation where tax and accounting records are concerned.
• To keep the form secure and usable. Lawful basis: legitimate interests in preventing spam and abuse.

I do not send marketing emails or newsletters from this site, and there is no mailing list to be added to. If that changes I will ask for your consent first rather than assume it.

A small number of suppliers process data on my behalf, under contract, and only to provide their service to me. They are not free to use your data for their own purposes.

• Vercel, which hosts this website and delivers its pages.
• My customer relationship system, currently GoHighLevel, which receives contact form submissions so enquiries are not lost.
• My email provider, which delivers and stores our correspondence.

Beyond that, I will only disclose personal data if the law requires it, for example a court order or a lawful request from a regulator.

Two page elements are loaded from somebody else's servers, both of them Google maps. The first is the Google Maps embed showing my office location. The second is a travel times map on the Local SEO Consultant London page, served from Google Cloud Storage and drawing on the Google Maps API. When either loads, Google receives a request from your browser and may set its own cookies or collect data under its own terms. I have no control over and no access to that.

Both are placed below the fold and loaded lazily, so neither loads at all unless you scroll to it. If you would rather they never loaded, blocking third-party content for google.com and googleapis.com in your browser will prevent them without breaking anything else on the page. Google's own handling is covered by the Google Privacy Policy.

If the contact form is ever replaced with an embedded form from my customer relationship system, that form is served by the provider and its own privacy terms apply to what you type into it. This page will be updated to say so before that happens.

Some of the suppliers above are based outside the United Kingdom, principally in the United States. Where personal data is transferred outside the UK, it is done on the safeguards UK data protection law allows, which in practice means standard contractual clauses or an adequacy decision covering that country.

• Enquiries that do not become work: kept for up to 24 months, then deleted. Local search is a slow decision and people frequently come back a year later, which is the only reason it is not shorter.
• Client records: kept for the duration of the engagement and then for six years, because tax and accounting rules require it.
• Server records: kept only as long as the hosting provider retains them in the ordinary course, which is a matter of weeks rather than years.

If you ask me to delete your data sooner, I will, unless I am legally required to keep a specific record.

Under UK GDPR you can ask me to do any of the following, free of charge.

• See what I hold about you, and get a copy of it.
• Correct anything that is wrong or incomplete.
• Delete it, where there is no overriding reason for me to keep it.
• Restrict what I do with it while a question about it is resolved.
• Receive it in a portable format, or have it sent to somebody else.
• Object to my processing it on the basis of legitimate interests.
• Withdraw consent, where consent was the basis, without affecting anything done before you withdrew it.

Email sales@shahedparvej.com and I will respond within one month, which is the statutory deadline. In practice it will be considerably faster, because there is not much to look through.

Tell me first and I will try to put it right. If you are still not satisfied, you have the right to complain to the UK regulator, the Information Commissioner's Office.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk. You do not need my permission to contact them and you do not have to come to me first.

This site is served over HTTPS, the contact form validates and limits what it accepts, and access to the systems holding enquiry data is protected by strong, unique credentials and two-factor authentication where the provider supports it.

No system is perfectly secure and I am not going to claim otherwise. What I can say is that the amount of personal data involved here is deliberately small, which is the most effective security measure available.

This is a business-to-business service and it is not directed at children. I do not knowingly collect data from anyone under 18. If you believe a child has sent me personal data, tell me and I will delete it.

If what this site does changes, this page changes with it, and the date at the top is updated. Material changes affecting people whose data I already hold will be communicated directly rather than left for you to notice.