This policy explains what personal data we collect when you visit khatibdesigns.com or contact us, why we use it, who we share it with, and the rights you have.
1. Who is responsible
Khatib Designs Ltd (Хатиб Дизайнс ООД), registered in Sofia, Bulgaria, is the controller of the personal data described here. Privacy contact: studio@khatibdesigns.com.
Our software products have their own privacy notices: MODAX and Marj3. When we build or run systems for a client under contract, we process the client’s data on the client’s instructions as their processor, under the data-processing terms in that contract.
2. What we collect and why
- Contact and enquiry details — name, email, phone or WhatsApp number, company, budget and your message, when you use the contact form, email us, message us on WhatsApp or book a call. We use them to reply and to prepare a proposal. Legal basis: steps you ask us to take before a contract, and our legitimate interest in answering business enquiries.
- Call bookings — the name, email, time and notes you enter in our Calendly booking page, to schedule and hold the call. Legal basis: steps before a contract.
- Client and contract records — contact people, contracts, invoices and correspondence, to deliver the work, bill for it and meet accounting and tax duties. Legal basis: contract and legal obligation.
- Usage analytics — pages viewed, referring site, approximate location (country or city), device and browser type, and events such as “contact form sent” or “booking made”, collected with Google Analytics 4 with IP anonymisation turned on. We use it to understand which pages help people and to improve the site. Legal basis: legitimate interest, or your consent where the law requires it.
- Technical logs — IP address, browser and request details kept briefly by our hosting and network providers for security and to keep the site working. Legal basis: legitimate interest.
We do not sell personal data, and we do not use it for automated decisions that have legal or similar effects on you.
3. Cookies and similar technologies
This site uses Google Analytics cookies (named _ga and _ga_*, kept for up to 2 years) to count visits and measure what works. It sets no advertising cookies. The booking page loads Calendly, which may set its own cookies needed to run the calendar. You can block or delete cookies in your browser settings, or install Google’s Analytics opt-out add-on; the site still works without them.
Visitors in the EU, UK and Switzerland are asked first; analytics stays off there until they accept. You can change your choice here at any time.
4. Who we share it with
We share personal data only with service providers that help us run the business, under contracts that require them to protect it:
- GitHub (website hosting) and Cloudflare (DNS, network and security).
- Google (Google Analytics; Google Fonts, which receives your IP address when fonts load; Google Workspace for email).
- FormSubmit (delivers contact-form messages to our inbox).
- Calendly (call booking) and WhatsApp / Meta (if you choose to message us there).
- Paddle (Paddle.com Market Ltd and its affiliates), our merchant of record, when you buy a KHD software product. Paddle receives your payment and billing details directly and acts as an independent controller for them under its own privacy policy.
- Our professional advisers (accountants, lawyers), and public authorities when the law requires it.
5. International transfers
Some of these providers process data outside the European Economic Area and outside your country, including in the United States. Where that happens we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified providers) or the European Commission’s Standard Contractual Clauses, and on the equivalent transfer safeguards required by Saudi, UAE and Kuwaiti law.
6. How long we keep it
- Enquiries that do not become a project: up to 24 months after our last contact, then deleted.
- Client contracts, invoices and accounting records: as long as tax and accounting law requires (in Bulgaria, generally up to 10 years).
- Analytics data: for the retention period set in Google Analytics, no longer than 14 months.
- Technical logs: kept by our providers for short periods, typically days to weeks.
7. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data (access) and, where applicable, in a portable format;
- correct it if it is wrong, or complete it;
- delete it, or restrict how we use it;
- stop using it for a purpose based on our legitimate interests (objection), or for direct marketing at any time;
- withdraw consent you have given, without affecting earlier use.
Email studio@khatibdesigns.com. We will answer within one month (we may extend this by up to two more months for complex requests, and will tell you if we do). We may need to confirm your identity first.
These rights come from the EU General Data Protection Regulation (GDPR), the Saudi Personal Data Protection Law (PDPL), the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and Kuwait’s Data Privacy Protection Regulation issued by CITRA. You can also complain to a data-protection authority: in Bulgaria, the Commission for Personal Data Protection (cpdp.bg); or the authority in your own country, such as SDAIA in Saudi Arabia, the UAE Data Office, or CITRA in Kuwait. We would appreciate the chance to fix things first.
8. Security
We protect personal data with encrypted connections (HTTPS), access limited to the people who need it, and providers that meet recognised security standards. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authority as the law requires.
9. Children
Our site and services are for businesses and adults. We do not knowingly collect data from children under 16.
10. Changes
We will update this policy when our practices change. The date at the top shows the current version.