Privacy policy
What this site collects, why, who else sees it, how long it is kept, and how to make me delete it. Short version: nothing optional runs without your consent, and I never sell data.
Last updated ·
Who is responsible
The data controller is Akram Bakhouche, freelance software engineer, operating bak-dev.com. For anything about your data, write to me@bak-dev.com.
What I collect and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Contact form: name, email, message and the answers you pick (project type, budget, timeline, engagement, how you heard of me) | Replying to your enquiry and preparing a proposal | Steps taken at your request before a contract (Art. 6(1)(b)) | 3 years after our last exchange, unless we sign a contract (then as long as accounting law requires) |
| IP address and time of a form submission | Rate limiting and spam protection; written to the server log with your email | Legitimate interest in keeping the form usable (Art. 6(1)(f)) | 12 months |
| Audience measurement (Google Analytics, Microsoft Clarity): pages viewed, clicks on buttons, form steps, device and approximate location | Understanding which pages bring in clients and where visitors drop off | Your consent (Art. 6(1)(a)) | Cookies: 13 months. Reports in Google Analytics: 14 months |
| Advertising (Google Ads, Meta): the pages you visit and whether you sent an enquiry | Measuring whether ads lead to enquiries, and showing ads to past visitors | Your consent (Art. 6(1)(a)) | 90 days in the cookies; the platforms apply their own retention |
| If you accepted advertising cookies and send the contact form: a one-way hash of your email, your IP address and browser type, sent from my server to Meta | Counting the enquiry as an ad conversion even when a browser blocks the Meta tag | Your consent (Art. 6(1)(a)) | Meta's own retention; I keep no copy beyond the enquiry itself |
The contact form's qualifying questions are optional in the sense that nothing breaks without them. There is no automated decision-making and no profiling that has legal or similar effects on you.
Who else receives data
- Google Ireland Ltd — Google Tag Manager, Google Analytics, Google Ads (privacy policy)
- Microsoft Ireland Operations Ltd — Microsoft Clarity (privacy statement)
- Meta Platforms Ireland Ltd — Meta Pixel and Conversions API (privacy policy)
- Calendly LLC and Zoom Communications — only if you book a call: the booking page and the video call run on their services, under their own policies (Calendly, Zoom)
Enquiries are delivered to my own mailbox on the same server that hosts the site; no third-party form or email service sees them. I do not sell, rent or share your data with anyone else.
Transfers outside the EU
Google, Microsoft and Meta may process data in the United States. Each is certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing adequate protection, and also relies on the Commission's standard contractual clauses.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, or to receive it in a portable format. Where processing relies on consent, you can withdraw it at any time without affecting what happened before.
Write to me@bak-dev.com. I answer within one month. If you are not satisfied, you can complain to your data protection authority — in France, the CNIL.
Changes
When this policy changes, the date at the top changes with it. If the change adds a new kind of tracking, the cookie banner asks you again.