Privacy & your data
Effective 22 August 2026
If you got an email from me
I found your professional contact details on publicly available business sources — such as your company website or LinkedIn — and wrote to you about independent marketing support for your business. I did not buy a list, and you are not in any automated sequence.
To stop hearing from me: reply with “no thanks” — or anything close to it — and I’ll add you to my do-not-contact list the same day. No reason needed, no further emails. You can also write to Abhishek@abhirasa.com.
The rest of this page is the detail behind that, which I’m required to give you under Article 14 of the GDPR because Abhirasa is based in Germany.
Who is responsible for your data
Abhirasa
Abhishek Thakur, sole proprietor
Hünefeldstrasse 47
42285 Wuppertal
Germany
Abhishek@abhirasa.com
Abhirasa is a one-person business and is not required to appoint a Data Protection Officer under Art. 37 GDPR or § 38 BDSG. All data questions come to me directly at the address above.
Business outreach: what I hold and why
This section applies if I contacted you about your business. It covers everything Art. 14 GDPR requires me to tell you.
| What I hold | Your company name, your first name and (where published) surname, your business email address, your business phone number, your website address, your city or region, your role, and my own notes about your public online marketing. |
|---|---|
| Where it came from | Publicly available business sources: your own company website, your LinkedIn or other public professional profiles, and public business directories. I collect it manually, one business at a time. I do not buy or rent contact lists, and I do not scrape at scale. |
| Why I hold it | To contact you once, and follow up a small number of times, about independent marketing support — and to keep track of who I have already written to so I don’t contact anyone twice. |
| Legal basis | Legitimate interests, Art. 6(1)(f) GDPR. Recital 47 GDPR recognises direct marketing as a legitimate interest. My interest is in reaching businesses that plausibly benefit from this service; I’ve weighed that against your interests and concluded it does not override them, because the data is business contact data you published yourself, the message is relevant to your work, the volume is low, and you can stop it instantly. |
| How long I keep it | Until 24 months after our last contact, then I delete it. If you object or don’t reply after my final follow-up, I delete it sooner. |
| Who else sees it | Only the service providers listed in Section 4. I don’t sell, rent or share your details with any other company. |
| Automated decisions | None. No profiling, no automated decision-making under Art. 22 GDPR. I review each business and write each email myself. |
Your do-not-contact record
If you ask me to stop, I keep one thing: your email address and the date you asked. I have to — it’s the only way to guarantee I never contact you again, and it is kept for that purpose alone under Art. 17(3)(b) GDPR. Everything else about you is deleted.
If you visited abhirasa.com
Server logs
The site is hosted by Netlify, Inc. Their servers automatically record your IP address, browser type, the page requested and the time of the request, for security and to deliver the site. Legal basis: legitimate interests, Art. 6(1)(f) GDPR — running a secure website.
The contact form
If you submit the form, I receive the details you enter — typically your name, work email, company, website, role and what you’d like help with. I use them only to reply to you and to prepare what you asked for. Legal basis: Art. 6(1)(b) GDPR, taking steps at your request before entering a contract. I keep enquiries for 24 months, or for as long as our business relationship lasts.
What happens to your submission: it is delivered and stored through my website host, Netlify, and I am notified by email (Google Workspace). Each acts only as a processor on my instructions under Art. 28 GDPR — both are listed in Section 4 — and neither uses your details for its own purposes.
Cookies and analytics
This site does not use analytics, advertising cookies, tracking pixels or any non-essential cookies. Because of that, there is no consent banner — there is nothing to consent to beyond the strictly necessary technical operation of the site. If that ever changes, this page and a consent mechanism will be added before any such technology runs.
No external fonts or embedded media
This site loads no fonts, scripts or media from third-party servers, so visiting it transmits your IP address to nobody but the host.
Service providers and transfers outside the EU
I use a small set of tools to run the business. Each acts as a processor under a data processing agreement (Art. 28 GDPR) and may only handle data on my instructions:
- Netlify, Inc. — website hosting and contact-form handling
- Google Ireland Ltd. — Google Workspace (email)
- Airtable, Inc. — contact records
- Make (Celonis SE) — moving data between the tools above
- Instantly.ai — email deliverability for outreach
Several of these are based in the United States, so your data may be transferred there. Those transfers are covered by the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified, and otherwise by Standard Contractual Clauses under Art. 46(2)(c) GDPR. US law does not offer identical protection to EU law, and US authorities may in some circumstances be able to access data held there.
Your rights
Under the GDPR you can ask me to:
- Show you what I hold about you and where I got it (Art. 15)
- Correct anything wrong (Art. 16)
- Delete it (Art. 17)
- Restrict how I use it (Art. 18)
- Send it to you or another provider in a machine-readable format (Art. 20)
- Withdraw any consent you have given, at any time, without affecting what was lawful before (Art. 7(3))
Your right to object — Art. 21 GDPR
You can object at any time to my processing your data for direct marketing. This right is absolute: I have no grounds to weigh against it and no discretion to refuse. Once you object, I stop immediately and permanently. You can also object to any other processing I base on legitimate interests, on grounds relating to your particular situation.
Write to Abhishek@abhirasa.com, or simply reply to any email I’ve sent you. I’ll act on it the same day and confirm. There is no charge, and you don’t need to explain why.
Complaints
If you think I’ve handled your data badly, please tell me first — but you also have the right to complain to a supervisory authority. The one responsible for Abhirasa is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
www.ldi.nrw.de
Changes to this page
If how I handle data changes, I’ll update this page and change the effective date at the top. The version published here is always the one that applies.