Privacy Policy

Last updated:

1. Who I am

This website, ahmudulhasan.com (the “Site”), is run by Mohammad Ahmudul Hasan, a sole proprietor based in Dhaka, Bangladesh, trading as “Ahmudul Hasan” (“I”, “me”, “my”). I provide brand and commercial growth consulting, fractional leadership and training services to businesses.

I am the “controller” (in Bangladesh law, the “data fiduciary”) of the personal data described in this policy. That means I decide why and how it is used.

Contact for anything in this policy:

  • Email: hello@ahmudulhasan.com
  • Post:

I am a one-person business and do not have a separate data protection officer. Please send privacy questions and requests to the email address above.

2. What this policy covers

This policy explains how I collect and use personal data when you:

  • visit the Site;
  • send me a message through the contact form, the training enquiry form, by email or on WhatsApp;
  • book a call through Calendly;
  • sign up for the Bangladesh Market-Entry Checklist or my email newsletter;
  • become a client, or work for a client, partner or supplier.

It does not cover the separate websites or apps of third parties (such as LinkedIn, Calendly, WhatsApp, Google Meet or Zoom), which have their own privacy policies.

3. The personal data I collect

Data you give me

  • Contact form and training enquiries: name, work email, company, country, the option that describes you, the service you are interested in, team size, preferred dates, your message, and the record of your consent tick.
  • Email and WhatsApp messages: your name, email address or phone number, WhatsApp profile name and picture (as shown by WhatsApp), and whatever you choose to tell me.
  • Call bookings (Calendly): name, email, time zone, the date and time you choose, your answers to booking questions (such as company and market), and any notes you add.
  • Checklist and newsletter sign-ups: first name, work email, company, and the record of your sign-up and confirmation (date, time, IP address and the form you used).
  • Clients and business contacts: names, job titles, business contact details, communications, meeting notes, invoices and payment records.

Data collected automatically (only with your consent where consent is required)

  • Analytics (Google Analytics 4): pages viewed, how you reached the Site, approximate location (country/city derived from your IP address), device and browser type, and events such as button clicks (for example “book a call” or “WhatsApp” clicks) and form submissions. Google Analytics 4 does not store full IP addresses.
  • Session insights (Microsoft Clarity, if enabled): how pages are scrolled and clicked, recorded in a way that masks text you type into forms.
  • Security and server logs: IP address, browser, date and time of requests, and security events, used to keep the Site secure and working.

See the Cookie Policy for details of cookies and similar technologies.

Data I do not want

Please do not send me sensitive personal data (for example health, religious, political, biometric or financial account data) or confidential personal data about other people unless we have agreed how it will be handled.

4. Why I use your data and my legal bases

| Purpose | Data used | Legal basis (EU/UK GDPR) |

|—|—|—|

| Reply to your enquiry, message or booking and arrange calls | Contact, booking and message data | Steps you ask me to take before entering a contract (Art. 6(1)(b)); my legitimate interest in answering business enquiries (Art. 6(1)(f)) |

| Send you the checklist and, if you opt in, my newsletter | Sign-up data | Your consent (Art. 6(1)(a)) |

| Provide services to clients, invoice and keep business records | Client and contact data | Performance of a contract (Art. 6(1)(b)); legal obligations such as tax and accounting (Art. 6(1)(c)) |

| Understand how the Site is used and improve it | Analytics and Clarity data | Your consent, given through the cookie banner (Art. 6(1)(a)) |

| Keep the Site and my systems secure, prevent spam and abuse | Logs, form spam-check data | My legitimate interest in security (Art. 6(1)(f)) |

| Establish, exercise or defend legal claims | Relevant records | My legitimate interest (Art. 6(1)(f)) |

Bangladesh: where the Personal Data Protection Act, 2026 or other Bangladesh law requires your consent, I rely on your consent (for example the consent tick on my forms, your sign-up to the newsletter, or your choice in the cookie banner), or on another ground that the law allows. You can withdraw consent at any time; this does not affect processing that took place before you withdrew.

Where I rely on legitimate interests, I have weighed my interests against yours. You can object at any time (see section 9).

I do not use your personal data for automated decision-making that has legal or similarly significant effects on you, and I do not build marketing profiles of you.

5. Who I share your data with

I do not sell your personal data, and I do not share it for cross-context behavioural advertising. I share it only with service providers who help me run the Site and my business, under contracts that require them to protect it, and only as needed:

| Provider | What they do | Where data may be processed |

|—|—|—|

| | Website hosting | Singapore |

| Cloudflare, Inc. | Content delivery, security, spam protection (Turnstile) | Global network, including the USA |

| Google LLC / Google Ireland Ltd | Google Analytics 4;; Google Meet for calls; backups to Google Drive | USA and other countries |

| Calendly LLC | Call booking and reminders | USA |

| MailerLite (UAB MailerLite) | Checklist delivery and newsletter | EU, with sub-processors in the USA |

| WhatsApp (Meta Platforms Ireland Ltd / WhatsApp LLC) | Messaging, if you contact me on WhatsApp | Global |

| Microsoft Corporation (Clarity), if enabled | Site usage insights | USA |

| | Delivering form notification emails | |

| Zoom Video Communications, Inc., if used for a call | Video calls | USA |

| Professional advisers (accountant, lawyer), banks and payment providers | Accounting, legal advice, payments | Bangladesh and the provider’s country |

Some providers, including WhatsApp, Calendly and Google, also act as independent controllers of some data under their own terms (for example, WhatsApp account data). Please read their privacy notices.

I may also disclose personal data if the law requires it, to protect my rights or the safety of others, or to a successor if my business is ever transferred.

6. International transfers

I am based in Bangladesh, and my service providers operate in several countries. Your data will therefore be processed outside your own country, including in Bangladesh, Singapore, the EU and the USA. These countries may not have the same data protection laws as yours.

Where EU or UK law applies, I rely on appropriate safeguards for transfers to service providers, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement), or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK Extension where available. When you send your details to me directly, they are processed by me in Bangladesh so that I can deal with your request. You can ask me for more information about the safeguards I use.

7. How long I keep your data

I keep personal data only as long as I need it for the purposes above:

  • Enquiries, messages and call bookings that do not lead to work: up to 24 months after our last contact, then deleted.
  • Client and contract records, invoices and accounting records: for the length of the engagement and afterwards for as long as tax, accounting and limitation laws require (currently up to years after the engagement ends).
  • Checklist and newsletter subscribers: until you unsubscribe or withdraw consent. After that I keep your email address on a suppression list so that I do not email you again, plus the record of your original consent for as long as I may need to show it.
  • Analytics data: Google Analytics 4 data retention is set to 14 months; reports use aggregated data.
  • Security logs: usually no longer than 90 days, unless needed to investigate an incident.

8. How I protect your data

I use reasonable technical and organisational measures for a business of my size, including HTTPS encryption, two-factor authentication on my accounts, access limited to me, spam and malware protection, regular software updates and secure backups. No system is completely secure. If a personal data breach is likely to put your rights at risk, I will notify you and the relevant regulators where the law requires.

9. Your rights

Depending on where you live, you may have the right to:

  • access the personal data I hold about you and get a copy;
  • correct inaccurate or incomplete data;
  • delete your data;
  • restrict or object to my use of your data, including objecting to processing based on legitimate interests;
  • data portability (receive your data in a machine-readable format or have it sent to another provider);
  • withdraw consent at any time, for example by unsubscribing from emails (every email has a link) or changing your cookie settings (the “Cookie settings” link in the footer);
  • not be subject to decisions based solely on automated processing with significant effects (I do not make such decisions).

To use any of these rights, email hello@ahmudulhasan.com. I may need to confirm your identity before acting. I will respond within the period required by the law that applies to your request, and I will not charge you unless the law allows a fee (for example for manifestly unfounded or excessive requests).

If you are in the EU, EEA or UK, you also have the right to complain to your local data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk). I would appreciate the chance to resolve your concern first.

If you are in Bangladesh, you have rights under the Personal Data Protection Act, 2026, including access, correction, erasure, portability and objection, and you may complain to the authority established under that Act once its complaint procedure is in operation.

10. Additional information for California residents

I am a small business, and the California Consumer Privacy Act (as amended by the CPRA) may not apply to me. I still follow its principles:

  • Categories collected in the last 12 months: identifiers (name, email, phone, IP address), professional information (company, role), commercial information (services discussed or bought), internet activity (Site usage, with consent) and approximate geolocation. Sources and purposes are described in sections 3 and 4.
  • Sale and sharing: I do not sell personal information or share it for cross-context behavioural advertising, and I have not done so in the last 12 months. I do not knowingly collect personal information of anyone under 16.
  • Sensitive personal information: I do not collect it for the purpose of inferring characteristics.
  • Your rights: to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. Requests can be sent to hello@ahmudulhasan.com; you may use an authorised agent.
  • Global Privacy Control: where technically possible, the Site treats a GPC signal as a refusal of non-essential cookies.

11. Email list

The checklist and newsletter use double opt-in: you will receive an email asking you to confirm. Each email includes my contact details and a one-click unsubscribe link. I do not buy email lists and I do not add business contacts to my newsletter without their consent.

12. WhatsApp

If you message me on WhatsApp, your messages, phone number and profile information are processed by me and by WhatsApp. WhatsApp messages are end-to-end encrypted in transit, but WhatsApp (Meta) processes account and usage data under its own privacy policy. Please do not send confidential business documents or sensitive personal data on WhatsApp; email is better for that. I use WhatsApp only to reply to you and arrange our conversations, and I will not add you to broadcast lists or groups without your agreement.

13. Children

The Site and my services are for businesses and professionals. They are not directed at children, and I do not knowingly collect personal data from anyone under 18. If you think a child has given me personal data, please contact me and I will delete it.

14. Links to other sites

The Site links to other websites (such as LinkedIn and Calendly). I am not responsible for their privacy practices.

15. Changes to this policy

I may update this policy from time to time. The “Last updated” date at the top shows when it last changed. If I make significant changes, I will highlight them on the Site or tell subscribers by email.

Scroll to Top