Privacy policy
What I collect, why, how long I keep it and how you stay in control. Short version: only what the forms ask for, stored on my own server, never sold, no advertising trackers.
Last updated 20 October 2026 · version 2026-10
Who is responsible
The controller of personal data collected through fajjeri.com is Ichraf Fajjeri, trading as Ignis Forge, Tunis, Tunisia. Contact: ichraf@fajjeri.com. For legal or contractual identification enquiries, write to ichraf@fajjeri.com.
I process personal data under the Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data (supervised by the INPDP, Instance Nationale de Protection des Données Personnelles) and, for visitors in the European Economic Area and the United Kingdom, the GDPR and UK GDPR.
What I collect, and why
I collect only what a form asks for, plus a small amount of technical information needed to keep the site safe. Nothing is bought, scraped or combined with data from other sources.
| Where | What you give me | Why | Legal basis |
|---|---|---|---|
| Intro call request (Contact) | Name, work email, company, role, website, goals you tick, what is stuck, target market, timeline, pipeline context, preferred times | To reply, prepare and hold the call | Steps at your request before a contract (and your consent given by ticking the box) |
| Project brief (Pricing) | Name, email, company, role, website, country, industry, company size, needs, markets, current tools, goals, timeline, preferred engagement shape, how you heard of me | To scope and quote the work | Steps at your request before a contract; consent |
| Data request (Your data) | Name, email, request type, details | To handle your rights request | Legal obligation |
| Every form submission | A reference number, the page you sent it from, the referrer and UTM campaign tags if present, the exact consent wording you agreed to and the policy version, a one-way hash of your IP address (not the address itself), and your browser’s user-agent text | To prove consent, prevent spam and understand which content leads to enquiries | Legitimate interest (security, record-keeping); consent |
| Cookie choices | A random identifier stored in your browser, your choices, the consent version, an IP hash and the user-agent | To keep proof of your consent, as the law requires | Legal obligation; legitimate interest |
| Anonymous analytics (only if you accept) | Page path, referring website’s hostname, device type (mobile, tablet, desktop), date | To see which pages are useful | Consent |
I do not collect payment details, sensitive categories of data, or data from children. The site is for business visitors aged 18 and over. Please do not put confidential client information or personal data of third parties in the free-text fields.
IP addresses
Your IP address is never written to the database. When you send a form or save cookie choices, the server turns it into a one-way, salted hash (HMAC-SHA-256 with a secret key) that I can compare but not reverse. The analytics beacon stores no IP address and no hash at all.
As with any web server, your IP address passes through my hosting provider’s network and may appear briefly in their system logs (see “Processors” below).
How I use your data
- To answer you, personally, usually within one to two working days.
- To prepare a proposal or a call, and to keep a record of our correspondence.
- To send you an automatic confirmation email with your reference number, when email is configured.
- To protect the site against spam and abuse.
- To produce aggregate, anonymous statistics if you accepted analytics.
I do not sell your data, share it for advertising, or use it for automated decision-making or profiling. I do not add you to a newsletter unless you ask for one separately.
Processors and transfers
Your data is stored in a database on the server that hosts this site. I use these service providers to run it:
| Provider | Role | Location |
|---|---|---|
| Hosting provider: OXAHOST SARL | Runs the server and database; keeps standard connection logs | Tunisia |
| Email provider: Oxahost authenticated SMTP (notifications@fajjeri.com) | Delivers the notification to me and the confirmation to you | Tunisia |
| Domain registrar (oxaHost) | Domain name and DNS only; receives no form data | Tunisia |
If a provider is outside Tunisia or the EEA, the transfer relies on the safeguards the law allows, such as standard contractual clauses or the INPDP authorisation where required. If I use a CRM or an outbound webhook to follow up on enquiries, it will be added to this list before it is switched on.
How long I keep it
| Data | Kept for | Then |
|---|---|---|
| Form submissions you did not follow up on (status “new”, “closed”, “lost” or “spam”) | 24 months from receipt | Deleted automatically |
| Submissions that became a conversation or a client engagement (“contacted”, “qualified”, “won”) | For as long as the relationship lasts, then as long as accounting and legal obligations require | Deleted or anonymised on request, unless the law requires me to keep them |
| Cookie consent records | 36 months | Deleted automatically |
| Anonymous analytics events | 13 months | Deleted automatically |
| Administrator activity log (my own actions on your data) | 24 months | Deleted automatically |
| Backups | Up to 30 daily copies | Older copies overwritten |
A scheduled job runs every day and removes records past these limits.
Your rights
You can, at any time and free of charge:
- access the data I hold about you and receive a copy, including in a portable format;
- correct anything inaccurate;
- erase your data;
- object to, or ask me to restrict, a particular use;
- withdraw consent (for cookies, use ; withdrawing does not affect earlier processing);
- complain to the INPDP in Tunisia or to the data protection authority where you live.
Use the data request form or write to ichraf@fajjeri.com. I will confirm your identity (usually by replying to the email address you gave) and answer within one month. I may ask for proof of identity before releasing data, so that it does not reach the wrong person.
Security
The site is served only over HTTPS. Form data is validated on the server, stored in a private database that is not reachable from the web, protected by rate limiting and anti-spam checks. The administration area is behind a passphrase stored only as a salted scrypt hash, uses a protected session cookie and records my actions. Daily database backups are kept privately on the server, with up to 30 copies retained. A protected copy is also downloaded to the site administrator’s computer when it is available. Backup copies expire separately from the live database. No system is perfectly secure; if a breach affecting you occurs, I will notify you and the authority as the law requires.
Other websites
The site links to LinkedIn and to your email program. Those services have their own privacy policies. The site loads no third-party scripts, fonts, trackers, maps or embedded videos; fonts are served from this site.
Changes
If I change this policy materially I will update the date and version above. Earlier versions are available on request. The version in force when you sent a form is stored with your submission.