Who we are
ZAYR is a trading name of Md Zubier Ahmed, a sole trader based in Smethwick, West Midlands (“ZAYR”, “we”, “us”). We are the controller for the personal data described in this notice.
- Email: contact@zayr.org
- ICO registration (data protection fee): pending. We’ll add the registration number here once it’s issued.
If you have a question about this notice or your data, email us. We don’t have a Data Protection Officer; the owner handles data protection directly.
What we collect and why
| What | When | Why we use it | Lawful basis (UK GDPR Art. 6) |
|---|---|---|---|
| Your name, email, the service you’re asking about and your message. Optionally: business name, current website, phone, rough timing and how you heard about us | You send an enquiry through our contact form, or email us | To reply and discuss what you need | Legitimate interests (replying to people who contact us); steps before a contract at your request |
| The above, plus the call topic, chosen time and any notes | You book a call (once online booking is open) | To hold the time, contact you and prepare for the call | Steps before a contract at your request; legitimate interests |
| Contact, billing and project details | You become a client | To deliver the service, invoice and keep records | Contract; legal obligation (tax and accounting records) |
| Technical data: a one-way hash of your IP address and the time you submitted | You submit a form | To stop spam and abuse and to limit repeated submissions | Legitimate interests (security) |
Where you came from: the page on our site you were on before the form, the address (not the full link) of any website that sent you, and campaign tags in the link such as utm_source |
You submit a form. Read only at that moment; nothing is stored on your device | To understand which pages and channels bring enquiries | Legitimate interests |
| The result of a spam check (Cloudflare Turnstile) | You submit a form | To tell people apart from automated spam | Legitimate interests (security) |
We don’t currently run analytics on this website. If we switch on Cloudflare Web Analytics, which counts page views without cookies and without identifying you, we’ll update this notice and the cookie notice first.
We ask you to tick a box agreeing to us using your details to reply. We also rely on the lawful bases above, so withdrawing that agreement means we’ll stop contacting you, but we may keep a record that you asked us to.
We don’t collect special category data (such as health information) through this website, and we ask you not to include it in messages.
Marketing
We don’t add enquiries to a marketing list. If we ever send marketing emails, we’ll do so only where UK law (PECR) allows it, such as with your consent or to existing clients about similar services, and every message will let you opt out.
Who we share it with
We use a small number of service providers (“processors”) who handle data on our instructions:
- Cloudflare: website hosting, form handling, storage of enquiries in a Cloudflare D1 database, and spam protection (Turnstile).
- Email provider: to receive and reply to email, and to notify us of new enquiries. Until our notification emails are switched on, a copy of each notification is kept in the same database instead of being sent.
- Calendar provider: only once online booking is open, to create the calendar invite.
- Our accountant: for tax and accounting, if you become a client.
We don’t sell personal data. We share it with others only if the law requires it, or to protect our rights.
International transfers
Some providers (for example Cloudflare) may process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (such as the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or the UK International Data Transfer Addendum with a transfer risk assessment.
How long we keep it
These periods may change when this notice is finalised. Deletion of website form data runs automatically every day.
- Enquiries sent through the website: 24 months after you sent them, then deleted. If you become a client, we keep what we need under client records instead.
- Call bookings: 12 months after the call, then deleted.
- Copies of notification emails about your enquiry: 30 days.
- Rate-limit records (hashed IP addresses): 1 day. The hashed IP stored with an enquiry is deleted with that enquiry.
- Client records, contracts and invoices: as long as HMRC requires (currently at least 5 years after the 31 January submission deadline for the relevant tax year), then deleted.
- Emails you send us directly: kept in our mailbox for as long as needed to deal with your enquiry, and no longer than 24 months unless you become a client.
You can ask us to delete your enquiry sooner at any time.
Our AI receptionist service (for callers to our clients)
This section explains how callers’ data is handled when a client uses our AI receptionist.
When we run an AI receptionist for a client, the client is the controller of their callers’ data and ZAYR acts as their processor under a written data processing agreement. The receptionist tells callers it’s an AI and that the call may be recorded or transcribed, and points them to the client’s own privacy notice. Our sub-processors for that service (for example the voice platform, telephony provider and language model provider) are listed in the agreement with each client. Recordings and transcripts are kept for a short period set by the client (we suggest 30–90 days), and vendor model training is switched off. If you called one of our clients and have a question about your data, please contact that business first; we’ll help them respond.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data (access);
- ask us to correct it;
- ask us to delete it;
- ask us to restrict how we use it;
- object to us using it on the basis of legitimate interests, and to any direct marketing;
- ask for data you gave us in a portable format;
- withdraw consent at any time where we rely on it.
Email contact@zayr.org. We’ll reply within one month. There is normally no charge.
If you’re unhappy with how we’ve handled your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Security
Data sent through our forms is encrypted in transit (HTTPS) and stored with access limited to the people who need it. We hash IP addresses rather than storing them in full. No system is perfectly secure, so if we ever have a breach that risks your rights, we’ll tell you and the ICO where the law requires.
Changes to this notice
We’ll update this page when how we use data changes, and change the date at the top.