Privacy Policy

1. Data controller

Tannaz Homayounfar, an independent venture designer and brand leadership consultant, is the controller of personal data processed through this website. Contact for all matters relating to this policy: t@tannazhomayounfar.com.

2. Summary

3. Personal data collected

3.1 Enquiries and correspondence

Where a visitor contacts the controller by email, or uses one of the forms on this website, the controller receives the information the visitor chooses to provide. In the project brief this is typically name, email address, company, role, a description of the project, an indicative timeline and, where the visitor chooses to give one, a budget range.

The forms transmit what has been written to a server function operated for this website, which composes two messages and sends them over an encrypted connection to the controller's email provider: a notice to the controller, and a short acknowledgement to the address the visitor gave, so that the visitor has a record of what was sent. Nothing is written to a database, and the entries are not used for any purpose other than answering the enquiry.

To keep the forms from being used by automated senders, the function briefly holds the requesting IP address in memory to count submissions within the hour, together with the time the form was opened. This is discarded when the server instance is recycled, is never written to storage, and is not linked to the content of any message.

3.2 Booking a call

Scheduling is provided by Calendly. Where a visitor books a call, Calendly collects name, email address, time zone and any information added to the booking, and transmits it to the controller so that the meeting can take place. Calendly acts as a processor for this purpose and processes the data under its own terms, available at calendly.com/privacy.

3.3 Newsletter subscription

Where a visitor subscribes to The Inside Out, the controller retains first name and email address for the sole purpose of sending that newsletter. Each issue contains an unsubscribe link. On unsubscribing, the record is removed.

3.4 Website visits and server logs

The website is hosted by Vercel. As with any web host, its servers record technical request logs including IP address, browser and device type, the resource requested and the timestamp. These logs exist for delivery, security and abuse prevention. They are not used for profiling and are not combined with other data.

4. Lawful basis for processing

Under Articles 6(1)(a), 6(1)(b) and 6(1)(f) of the General Data Protection Regulation, the following bases apply. Enquiries and bookings are processed on the basis of steps taken at the request of the data subject prior to entering into a contract, and the controller's legitimate interest in responding to business enquiries. The newsletter is processed on the basis of consent, which may be withdrawn at any time. Server logs are processed on the basis of the controller's legitimate interest in the security and availability of the website. Any cookie that is not strictly necessary is set only on the basis of consent.

5. Recipients and processors

Personal data is disclosed only to the service providers required to operate this website, and only for that purpose: Vercel Inc. (hosting, content delivery and the server function that carries the forms), Hostinger International Ltd (transmission and storage of the controller's email), and Calendly LLC (scheduling). Each acts as a processor on the controller's instructions. Personal data is otherwise disclosed only where required by law.

6. International transfers

Certain processors are established in the United States, and personal data may therefore be processed outside the European Economic Area. Such transfers rely on the safeguards implemented by those providers, including the European Commission's Standard Contractual Clauses. Details of the safeguards applying to a specific provider are available on request.

7. Retention

Correspondence is retained for as long as the matter to which it relates remains relevant, and is then deleted. Where an engagement follows, records are retained for the period required by the engagement and by applicable record-keeping obligations, and no longer. Newsletter records are retained until the subscriber unsubscribes. Server logs are retained by the host for a short period and then rotated. Earlier erasure may be requested at any time.

8. Rights of the data subject

Where the General Data Protection Regulation applies, the data subject has the right of access to their personal data and to a copy of it; to rectification of inaccurate data; to erasure; to restriction of processing; to data portability; and to object to processing carried out on the basis of legitimate interest. Where processing is based on consent, that consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests should be sent to t@tannazhomayounfar.com. No fee is charged and a response will be provided within one month. The data subject also has the right to lodge a complaint with the supervisory authority of their country of residence or place of work.

9. Cookies

This website sets a minimal number of cookies and obtains consent before setting any that are not strictly necessary. Full details are set out in the Cookie Policy.

10. Children

This website is directed at founders, leaders and organisations. It is not directed at children, and the controller does not knowingly collect personal data from any person under the age of sixteen. Where the controller becomes aware that such data has been provided, it is deleted.

11. Changes to this policy

This policy is updated where the services or the processing described in it change. The effective date at the head of this page indicates the current version. Material changes will be identified as such.

12. Contact

All enquiries, requests and complaints concerning this policy: t@tannazhomayounfar.com.