Privacy Policy

1. Who is responsible for your data

This website is operated by:

• Issa, trading as UXBYISSA
• Operating as an independent practice (sole trader), not a registered company. No business registration or VAT number currently applies.
• Working remotely with international clients
• Contact for privacy matters: me@uxbyissa.com

For the purposes of GDPR, I ("UXBYISSA", "I", "me") am the data controller for the personal data described in this policy. This applies regardless of where I'm based, because the site offers services to clients located in the EU/EEA — GDPR applies to anyone processing the personal data of people in the EU, not just to EU-based businesses (Art. 3(2) GDPR).

2. What data I collect

I only collect what's needed to evaluate and deliver the project.

3. Legal basis for processing

• Booking form & project communication: performance of a contract (or steps taken at your request before entering one) — Art. 6(1)(b) GDPR.
• Payment processing: performance of a contract, and legal obligation for invoicing/tax records — Art. 6(1)(b) and (c) GDPR.
• Marketing emails (only if you opt in separately): consent — Art. 6(1)(a) GDPR. You can withdraw this at any time.
• Basic website analytics: legitimate interest in understanding site usage — Art. 6(1)(f) GDPR, or consent where required by local cookie rules.

4. Who your data is shared with

I don't sell or rent personal data. Data is shared only with the service providers needed to run this business:

• Payment processor — to process deposits and final payments
• Calendly — to manage intro calls
• Google Workspace — to send and store project communication
• Figma, Google Drive — to deliver design files

None of them are permitted to use your data for their own purposes. Where tools are based outside the EU/EEA, transfers rely on Standard Contractual Clauses or the provider's own compliance mechanism.

5. How long data is kept

• Applications that don't proceed to a booking: deleted or anonymised after 12 months, unless you ask for earlier deletion.
• Active and completed projects: kept for the duration of the working relationship plus 6 years, to meet standard invoicing/tax retention requirements.
• Marketing consent: kept until you unsubscribe or withdraw consent.

6. Your rights

Under GDPR, you have the right to:

• Access the personal data I hold about you
• Correct inaccurate data
• Request deletion ("right to be forgotten"), where it doesn't conflict with legal retention duties
• Restrict or object to certain processing
• Request a copy of your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise any of these, email me@uxbyissa.com. I'll respond within 30 days.

7. Cookies

This site uses Google Analytics and Microsoft Clarity to understand site usage. You can opt out via the cookie banner or adjust your browser settings at any time.

8. Data security

Personal data is stored using the built-in security of the tools listed in Section 4. Payment details are never stored directly by me — they're handled entirely by the payment processor agreed with the client.

9. Changes to this policy

This policy may be updated occasionally to reflect changes in how the business operates. The "last updated" date at the top will always reflect the latest version. Material changes will be communicated to active clients by email.

10. Contact

Questions about this policy or your data: me@uxbyissa.com