Privacy Policy

1. Introduction

This Privacy Policy describes how Abdullah Mahmud (“we”, “us” or “our”) collects, uses and protects personal information when you visit abdullahmahmud.com (the “Website”). Abdullah Mahmud is an independent SEO consultant based in Southampton, United Kingdom, and is the data controller for personal information collected through the Website.

By using the Website you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Website.

2. Information We Collect

2.1 Information you provide to us

Contact form: when you submit the form on our contact page, we collect the details you enter, such as your name, email address, website and the content of your message.
Consultation bookings: when you book a call, we collect your name, email address, the appointment time you select and any notes you add.
Correspondence: any information you send us by email, including attachments such as analytics reports or website access details you choose to share for an SEO audit.

2.2 Information collected automatically

Usage data: pages viewed, time on page, referring website, approximate location (city or country level), device category and browser type, collected through Google Analytics 4 (see section 5).
Technical and security data: IP address, server log entries and security events recorded by our hosting provider and the Wordfence security plugin in order to keep the Website running and protect it from malicious traffic.

2.3 Information we do not collect

We do not collect or store payment card details through the Website. We do not knowingly collect special category data (such as health, religious or political information) and ask that you do not include such information in any communication with us.

3. How We Use Your Information

We use the information we collect for the following purposes:

To respond to your enquiries and discuss potential SEO services.
To schedule, confirm and follow up on consultation calls.
To provide, manage and invoice services where we enter into an engagement with you.
To analyse how the Website is used so that we can improve its content and performance.
To maintain the security of the Website and detect, prevent and investigate abuse or technical issues.
To comply with legal, accounting and regulatory obligations.

We do not sell your personal information, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal Basis for Processing

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The lawful bases we rely on are:

Processing activity	Lawful basis
Responding to enquiries and consultation bookings	Steps taken at your request prior to entering into a contract (Article 6(1)(b)) and our legitimate interest in operating a consulting business (Article 6(1)(f))
Delivering services, contracts and invoicing	Performance of a contract (Article 6(1)(b)) and compliance with a legal obligation (Article 6(1)(c))
Google Analytics cookies	Your consent (Article 6(1)(a)), which you may withdraw at any time as described in section 5
Security logs and strictly necessary cookies	Our legitimate interest in keeping the Website secure and available (Article 6(1)(f))

5. Cookies and Analytics

Cookies are small text files stored on your device when you visit a website. The Website uses the following categories of cookies:

Strictly necessary cookies: set by WordPress and the Wordfence security plugin to allow the Website to function and to protect it from automated attacks. These cookies do not require consent.
Analytics cookies: set by Google Analytics 4, a service provided by Google Ireland Limited. These cookies allow us to measure traffic and understand how visitors use the Website. Google Analytics 4 does not log or store IP addresses, and we do not associate analytics data with your name or email address.

You can control cookies through your browser settings, including blocking or deleting them, although some parts of the Website may not function correctly as a result. You can also prevent Google Analytics from collecting data on any website by installing the Google Analytics opt-out browser add-on. For more information on how Google processes data, see Google’s Privacy Policy.

6. Third-Party Service Providers

We use a limited number of third-party providers to operate the Website. Each processes personal information on our behalf and under its own privacy policy:

Web hosting ({hosting provider}): stores the Website’s files and serves pages to visitors, which involves processing IP addresses in server logs.
Google Analytics 4 (Google Ireland Limited): website analytics, as described in section 5.
Wordfence (Defiant Inc.): website security and firewall services, which process visitor IP addresses to identify and block malicious traffic.
Call scheduling tool ({booking tool}): manages consultation bookings and sends calendar invitations and reminders.

7. Disclosure of Your Information

We may disclose personal information in the following circumstances:

To the service providers listed in section 6, solely for the purpose of providing their services to us.
To our professional advisers, such as accountants or lawyers, where necessary for accounting, tax or legal purposes.
Where required by law, court order or a regulatory authority, or where necessary to protect our rights, property or safety or those of others.
In connection with a sale, merger or transfer of our business, in which case the recipient will be bound by the terms of this Privacy Policy.

Website data, analytics reports and access credentials shared with us for the purpose of an SEO audit are treated as confidential, are not shared with any other party and are deleted when the engagement ends unless otherwise agreed in writing.

8. International Data Transfers

Some of our service providers, including Google and Wordfence, process data outside the United Kingdom, including in the United States and the European Economic Area. Where personal information is transferred outside the UK, we ensure that appropriate safeguards are in place as required by UK data protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You may request further information about these safeguards using the contact details in section 14.

9. Data Retention

We retain personal information only for as long as is necessary for the purposes described in this Privacy Policy:

Enquiries that do not lead to an engagement: up to 12 months after our last communication.
Client records, contracts and invoices: 6 years after the end of the engagement, in line with UK accounting and tax requirements.
Google Analytics data: retained for {14 months}, after which only aggregated reporting remains.
Server and security logs: retained for {30} days.

10. Data Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss or misuse. The Website is served over HTTPS so that information you submit is encrypted in transit. Access to the Website’s administration area is protected by strong passwords, and the Wordfence firewall monitors traffic, blocks brute-force login attempts and scans the Website for malware. Credentials provided for audits are retained only for as long as the work requires and are removed on completion.

No method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the Information Commissioner’s Office as required by law.

11. Your Rights

Under UK data protection law you have the following rights in relation to your personal information:

Right of access: to request a copy of the personal information we hold about you.
Right to rectification: to have inaccurate or incomplete information corrected.
Right to erasure: to request deletion of your personal information in certain circumstances.
Right to restriction: to request that we limit how we use your information in certain circumstances.
Right to object: to object to processing based on legitimate interests, including direct marketing.
Right to data portability: to receive the information you provided to us in a structured, machine-readable format.
Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details in section 14. We will respond within one month. We will not charge a fee unless a request is manifestly unfounded or excessive, and we may ask you to verify your identity before responding.

12. Children’s Privacy

The Website is intended for business owners, marketing professionals and other adults. We do not knowingly collect personal information from anyone under the age of 16. If you believe that a child has provided us with personal information, please contact us and we will delete it promptly.

13. Third-Party Websites

The Website contains links to third-party websites, including client websites featured in case studies and tools referenced in articles. We are not responsible for the privacy practices or content of those websites, and this Privacy Policy does not apply to them. We encourage you to review the privacy policy of any website you visit.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us at:

Abdullah Mahmud
Email: hello@abdullahmahmud.com

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Website, the services we use or applicable law. Where a change materially affects how we use your personal information, we will provide a prominent notice on the Website. We encourage you to review this page periodically.