Privacy Policy

1. Introduction & Who We Are

This policy explains how Ahmad Berahman (“Berahman,” “we,” “us,” or “our”) collects and processes personal data. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and Spanish data-protection law, the data controller is:

• Controller: Ahmad Berahman (sole trader / autónomo)
• Address: Barcelona, Spain
• Contact: hello@berahman.me

2. Information We Collect

Depending on how you interact with us, we may process the following categories of personal data:

• Contact & enquiry data — such as your name, email address, company, and the content of messages you send us (for example, when you email hello@berahman.me).
• Technical & usage data — such as IP address, browser type, and standard server logs generated automatically when you visit the website. Our website is hosted on Vercel, whose infrastructure generates these logs on our behalf to operate and secure the service.
• Client & project data — information provided in the course of an engagement, which may include data about your business, systems, and, where applicable, personal data contained within materials you share with us.
• Billing & transaction data — where you purchase services, our payment provider (Stripe) processes your payment, and we receive limited billing and confirmation details necessary for our accounting and tax records.

3. How & Why We Use Your Data (Legal Bases)

We process personal data for the following purposes and rely on the corresponding GDPR legal bases:

• To respond to enquiries and communicate with you — based on our legitimate interests (Art. 6(1)(f)) in answering prospective and existing clients, or steps taken at your request prior to a contract (Art. 6(1)(b)).
• To provide our services and perform our contracts with clients — based on performance of a contract (Art. 6(1)(b)).
• To operate and secure our website — based on our legitimate interests (Art. 6(1)(f)) in maintaining a safe, functioning service.
• To comply with legal obligations, such as accounting and tax record-keeping — based on legal obligation (Art. 6(1)(c)).

4. Cookies & Analytics

This website is intentionally lightweight. It does not set first-party tracking or advertising cookies, and we have not added third-party analytics to this site. The website loads a small number of third-party assets to function — the Tailwind CSS CDN, the Lucide icon library (unpkg.com), and Google Fonts — and your browser contacts those providers to retrieve them, which necessarily discloses your IP address and request metadata to them.

Should we introduce analytics, a contact form, or cookies in the future, we will update this policy and, where the law requires it, request your consent before doing so.

5. Data Sharing & Sub-processors

We do not sell your personal data. We may share it with trusted service providers who process data on our behalf, under appropriate agreements, including:

• Hosting & infrastructure providers — our website is hosted on Vercel (Vercel Inc.), which also provides content delivery and DNS for this site.
• Email & communication providers — we use Google Workspace (Google Ireland Ltd.) to receive and respond to your messages.
• Payment processing — we use Stripe (Stripe Payments Europe, Ltd.) to process payments securely; Stripe handles your payment details directly, and we do not store your full card numbers.
• Professional advisers and authorities where required by law or to establish, exercise, or defend legal claims.

6. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on an appropriate transfer mechanism under the GDPR, such as an adequacy decision of the European Commission or Standard Contractual Clauses, together with any additional safeguards required. For example, transfers to providers in the United States (such as Vercel and Stripe) are made under the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Enquiry correspondence is retained for 24 months, and client and financial records are retained for the periods required by applicable Spanish and EU law. When data is no longer needed, it is deleted or anonymized.

8. Your Rights Under the GDPR

Subject to the conditions in the GDPR, you have the right to:

• Access — obtain confirmation of, and a copy of, the personal data we hold about you;
• Rectification — have inaccurate or incomplete data corrected;
• Erasure — request deletion of your data (the “right to be forgotten”);
• Restriction — request that we limit our processing of your data;
• Portability — receive your data in a structured, commonly used, machine-readable format;
• Objection — object to processing based on our legitimate interests; and
• Withdraw consent at any time, where processing is based on consent, without affecting prior lawful processing.

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).

You also have the right to lodge a complaint with a supervisory authority. In Spain, this is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, “AEPD”) — www.aepd.es.

9. How to Exercise Your Rights

To exercise any of the rights above, contact us at hello@berahman.me. We may need to verify your identity before acting on a request. We will respond within the timeframe required by the GDPR — generally within one month — and will let you know if we need an extension for complex requests.

10. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure, taking into account the state of the art, the costs of implementation, and the nature of the data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children’s Privacy

Our services are directed at businesses and are not intended for children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be posted on this page with the “Last updated” date above. Material changes will be indicated by updating that date and, where appropriate, by additional notice.

13. Contact

For any questions about this Privacy Policy or our data practices, contact:

• Berahman — Ahmad Berahman (sole trader / autónomo)
• Email: hello@berahman.me
• Address: Barcelona, Spain