Legal · Privacy
Privacy Notice
Last updated: 11 June 2026. This notice explains what personal data Tamazia collects when you engage with the firm, what we do with it, who has access to it, and what rights you have under UK GDPR, EU GDPR, UAE PDPL, and equivalent regimes.
1. Who we are
Tamazia is an international SEO and regulatory-compliance content firm operated by Aman Pareek. For data-protection purposes Tamazia acts as the data controller for personal data collected through tamazia.co.uk. Contact for privacy matters: dpo@tamazia.co.uk.
2. The personal data we collect
| Source | Data | Purpose |
|---|---|---|
| Quick Audit form (homepage) | Domain or keyword, work email, sector | To deliver the requested compliance and SEO audit and follow-up |
| Briefing request form (Contact section) | Name, work email, company, role, sector, primary outcome | To respond to the briefing request and assess fit |
| Footer briefings signup | To send the regulatory briefings (opt-in marketing under PECR / CAN-SPAM) | |
| Server logs (Cloudflare Pages) | IP address, user agent, request URL, timestamp | Security and abuse prevention; aggregated for performance review |
3. Lawful basis
- Consent (Article 6(1)(a) UK/EU GDPR; Article 5 UAE PDPL): briefing signup, audit form, contact form.
- Legitimate interests (Article 6(1)(f) UK/EU GDPR): server logs for security; consent banner storage.
- Legal obligation (Article 6(1)(c) UK/EU GDPR): retention of records where required by accounting, AML, or sectoral regulation.
4. Who we share data with
Personal data is shared only with the processors required to deliver the service:
- Cloudflare, Inc. · hosting, CDN, DDoS protection, Email Routing, Workers KV (US/EU). Data Processing Addendum in place. Privacy policy at cloudflare.com/privacypolicy.
- Resend, Inc. · transactional email delivery for audit, briefing, contact and booking follow-ups (US). DPA in place. Privacy policy at resend.com/legal/privacy-policy.
- Cal.com, Inc. · meeting booking infrastructure for the strategy-call page (US). DPA in place. Privacy policy at cal.com/privacy. Personal data shared: name, email, optional notes you provide on booking.
- Google Ireland Limited · Google Analytics 4 measurement, with onward processing by Google LLC in the United States. Data anonymised, IP truncation enabled. Loaded only after analytics consent, and everything it stored is deleted when you withdraw that consent. Privacy policy at policies.google.com/privacy.
- PostHog, Inc. · product analytics (EU region hosting). Records page views and interaction events. Loaded only after analytics consent, and told to opt out and forget when you withdraw it. Privacy policy at posthog.com/privacy.
- Stripe Payments Europe, Ltd. · subscription checkout, card processing and invoicing for Compliance Radar (Ireland, with onward processing in the US). Card details are entered on Stripe's own pages and never reach this site. DPA in place. Privacy policy at stripe.com/privacy.
- Neon, Inc. · managed Postgres holding the structured lead and enquiry records synchronised from the forms (US/EU). DPA in place. Privacy policy at neon.tech/privacy-policy.
- Microsoft Corporation · Bing Webmaster Tools (US). Used for search-console verification only, no personal data shared.
- Google LLC · Search Console + Postmaster Tools (US). Used for search-console verification and email-deliverability monitoring, no personal data shared.
Tamazia does not sell or share personal data for advertising or any third-party purpose. We do not disclose data to law enforcement except where compelled by a valid legal order.
Two entries were removed from this list on 20 September 2026, and saying which is part of the point. Microsoft Clarity and Sentry were named here as processors that received data after analytics consent. Neither has ever been configured on this site: the build-time keys they need are bound on no environment, so no request has ever been made to either of them and neither has ever received anything. A processor list that names a company which has never received your data is as wrong as one that omits a company which has, and it is the easier of the two mistakes to make, because it looks thorough. The complete current list, with country of processing and the transfer instrument relied on for each, is the sub-processor list.
5. International transfers
Tamazia operates internationally. Personal data may be transferred to the United States and processed there: Cloudflare for delivery and storage, Resend for transactional mail, Neon for the lead database, Cal.com for bookings, and Google for analytics onward from Google Ireland. Stripe contracts through Stripe Payments Europe in Ireland with onward processing in the US. PostHog analytics is processed in the EU. Transfers are protected by the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, and equivalent UAE PDPL safeguards. Standard Contractual Clauses apply where required.
6. Retention
Audit and briefing submissions are retained for 24 months from last contact, or longer where required by law or where you remain an active client. Server logs are retained for 30 days. The consent state stored in your browser persists until you clear it.
7. Your rights
Under UK GDPR, EU GDPR, and UAE PDPL you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased (subject to legal-retention exceptions).
- Restrict or object to processing.
- Receive your data in a portable format.
- Withdraw consent at any time without affecting prior lawful processing.
- Lodge a complaint with the UK ICO (ico.org.uk) or the UAE TDRA / equivalent supervisory authority in your jurisdiction.
To exercise any of the above, email dpo@tamazia.co.uk with the subject line "Privacy request". We respond within 30 days.
8. Security
tamazia.co.uk is served over HTTPS with HSTS, strict CSP, and modern security headers. Backend functions run on Cloudflare's isolated workers runtime. Submission payloads are sanitised before dispatch. Personal data at rest is held only inside Resend (transactional email log) and Cloudflare logs (request metadata).
9. Cookies
See the cookie policy for the complete list of storage we use.
10. Changes
Material changes to this notice are versioned by the "Last updated" date at the top. If a change materially affects how your data is processed, we will notify you by email where you have given us a contact address.