Privacy Policy

This Privacy Policy explains how Usman Khurshid (“I,” “me,” “my,” or “we”) collects, uses, shares, and protects personal information when you visit https://usman.one (the “Site”) or engage with any of the services offered through it.

I take your privacy seriously. This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA). If you have questions about anything below, email hello@usman.one and I’ll get back to you.

1. Who is the Data Controller?

The person responsible for the information collected through this Site is:

Usman Khurshid Email: hello@usman.one Website: https://usman.one

For the purposes of the GDPR, I act as the data controller of your personal information. Under the CCPA, I act as a “business” that collects personal information from California consumers.

2. Information I Collect

I collect personal information in three ways: information you give me directly, information collected automatically when you visit the Site, and information received from third parties.

2.1 Information You Provide Directly

  • Contact and inquiry forms — When you fill out a contact form, I collect your name, email address, any phone number you provide, and the contents of your message. If you’re enquiring about a project, I may also collect details you share about your business, website, budget, and timeline.
  • Email newsletter subscription — If you subscribe to my newsletter, I collect your email address and, optionally, your name. Subscription is double opt-in, which means you’ll receive a confirmation email and must click the link inside to confirm.
  • Blog comments — When you leave a comment on a blog post, I collect your name, email address (not displayed publicly), website URL (optional), and the comment content. Your IP address and browser user-agent are also recorded by WordPress as a spam-prevention measure.
  • Direct correspondence — If you email me, send a message on a social platform, or schedule a call, I keep records of that communication.

2.2 Information Collected Automatically

When you visit the Site, certain information is collected automatically:

  • Log data — My hosting provider records standard server logs including your IP address, browser type and version, operating system, referring URL, pages visited, date and time of access, and time spent on each page.
  • Analytics data — I use Google Analytics 4 (GA4) to understand how visitors interact with the Site. GA4 collects information such as your approximate location (country/city level, derived from IP), device and browser details, pages viewed, session duration, scroll depth, outbound link clicks, and similar engagement signals. IP addresses are anonymised by Google before being stored.
  • Cookies and similar technologies — The Site uses cookies and comparable technologies to remember your preferences, measure traffic, and keep the Site secure. See Section 8 for details.

2.3 Information from Third Parties

  • Gravatar — If you leave a comment and have a Gravatar account linked to your email, your public Gravatar profile image is displayed next to your comment. Gravatar is operated by Automattic Inc. Your email address (hashed) is sent to Gravatar to retrieve the image. You can review Gravatar’s privacy practices at https://automattic.com/privacy/.
  • Social platforms — If you interact with me on LinkedIn, X (Twitter), Upwork, or similar platforms, I may receive information those platforms make available under your privacy settings.

3. Why I Collect Your Information (Purposes of Processing)

I use the information described above for the following purposes:

  • To respond to your enquiries and provide quotes, proposals, and related consulting communications.
  • To deliver services you have engaged me for, including project management communications, invoicing, and support.
  • To send my newsletter with articles, guides, and occasional service updates — only if you have subscribed.
  • To moderate and display comments on blog posts.
  • To improve the Site by analysing how visitors navigate and which content is useful, via Google Analytics.
  • To protect the Site from spam, abuse, and security threats.
  • To comply with legal obligations such as tax records, responding to lawful requests, and enforcing my terms.

4. Legal Bases for Processing (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, I process your personal data only when I have a lawful basis to do so. The bases I rely on are:

  • Consent — for sending marketing emails (newsletter) and for non-essential cookies (analytics). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
  • Performance of a contract — when you engage me for a service, processing is necessary to deliver that service and manage our engagement.
  • Legitimate interests — to respond to your enquiries, moderate comments, secure the Site against abuse, and measure aggregate Site performance. I have assessed that these interests do not override your fundamental rights.
  • Legal obligation — to retain records for tax, accounting, and compliance purposes.

5. Who I Share Your Information With

I do not sell your personal information. I share it only with the following categories of recipients, and only to the extent necessary:

  • Hosting provider — the company that hosts this Site processes data on my behalf in order to deliver web pages to you and maintain server infrastructure.
  • Email service provider — I use a third-party email marketing platform (such as Mailchimp, ConvertKit, or MailerLite) to send my newsletter. Your email address is stored with that provider under a data processing agreement.
  • Google (Google Analytics 4) — analytics data is processed by Google LLC and its affiliates. Google’s privacy policy is at https://policies.google.com/privacy. You can opt out of GA4 tracking via the Google Analytics Opt-Out Browser Add-on.
  • Automattic / Gravatar — as described in Section 2.3, if you leave a comment with a Gravatar-linked email.
  • Professional advisors — accountants, lawyers, or auditors, where necessary to run the business and to the extent they need the information.
  • Law enforcement and legal authorities — where I am legally compelled to share information, such as in response to a subpoena or court order.
  • Successor entities — if the business is acquired, merged, or restructured, personal information may transfer to the new owner, subject to the same protections described here.

I require all third-party processors to implement appropriate security measures and to process personal information only for the purposes I specify.

6. International Data Transfers

I operate from Pakistan, and some of the third-party services I use (Google, Automattic, email providers, hosting) are based in the United States or other countries outside the EEA and UK. Where personal data is transferred internationally, I rely on one of the following safeguards:

  • Standard Contractual Clauses (SCCs) approved by the European Commission and/or the UK Information Commissioner’s Office.
  • Adequacy decisions where the European Commission has determined a country provides adequate data protection.
  • Your explicit consent, where applicable.

You can request a copy of the relevant safeguards by emailing hello@usman.one.

7. How Long I Keep Your Information

I retain personal data only for as long as necessary for the purposes it was collected:

  • Contact form enquiries — up to 24 months after the last communication, then deleted or anonymised.
  • Client project records — for the duration of the engagement and up to 7 years afterwards, as required by tax and accounting rules.
  • Newsletter subscriber data — until you unsubscribe, after which your email is removed from the active list within 30 days.
  • Blog comments — retained indefinitely unless you request deletion. Spam comments are deleted automatically after 30 days.
  • Analytics data — GA4 data retention is set to the default (14 months for event data). Aggregate reports may be kept longer.
  • Server logs — up to 12 months for security purposes.

When retention periods expire, data is deleted or irreversibly anonymised.

8. Cookies and Tracking Technologies

The Site uses the following categories of cookies:

  • Strictly necessary cookies — required for the Site to function, such as session cookies, security cookies, and cookies that remember your cookie consent choice. These cannot be disabled.
  • Analytics cookies — set by Google Analytics 4 to measure traffic and user behaviour. These are loaded only after you consent.
  • Functionality cookies — remember preferences such as whether you have already subscribed to the newsletter popup.

You can control cookies through your browser settings or through the cookie consent banner displayed on your first visit. Blocking all cookies may break some Site functionality.

9. Your Rights

Depending on where you live, you have some or all of the following rights regarding your personal information:

9.1 Rights Under GDPR / UK GDPR

  • Right of access — request a copy of the personal data I hold about you.
  • Right to rectification — ask me to correct inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”) — ask me to delete your personal data, subject to certain exceptions.
  • Right to restrict processing — ask me to pause processing your data in specific circumstances.
  • Right to data portability — receive your data in a structured, machine-readable format.
  • Right to object — object to processing based on legitimate interests, including direct marketing.
  • Right to withdraw consent — where processing is based on consent, withdraw it at any time.
  • Right to lodge a complaint — with your local data protection authority. For EU residents, find yours at https://edpb.europa.eu/about-edpb/about-edpb/members_en. For UK residents, the ICO is at https://ico.org.uk/.

9.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the right to:

  • Know what categories and specific pieces of personal information I collect, use, disclose, or sell about you.
  • Delete personal information I have collected from you, subject to certain exceptions.
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of your personal information. I do not sell personal information and do not share it for cross-context behavioural advertising.
  • Limit the use of sensitive personal information. I do not collect sensitive personal information as defined by CCPA.
  • Non-discrimination — I will not discriminate against you for exercising any of these rights.

You may exercise these rights yourself or through an authorised agent.

9.3 How to Exercise Your Rights

Email hello@usman.one with your request and, where needed, proof of identity (such as confirmation from the email address associated with your account). I will respond within 30 days for GDPR requests and within 45 days for CCPA requests (extendable by another 45 days where reasonably necessary). There is no charge for exercising your rights.

10. Security

I take reasonable administrative, technical, and physical safeguards to protect your information, including TLS encryption for all Site traffic, access controls, regular software updates, and secure backups. No method of transmission over the internet is 100% secure, but I follow industry best practice to minimise risk. If a data breach occurs that is likely to result in a high risk to your rights, I will notify affected users and the relevant supervisory authority within 72 hours, as required by GDPR.

11. Children’s Privacy

The Site is not directed at children under 16, and I do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information, email hello@usman.one and I will delete it promptly.

12. Third-Party Links

The Site may contain links to third-party websites, including portfolio items, social media profiles, and referenced tools. I am not responsible for the privacy practices of those websites. Review their privacy policies before submitting personal information.

13. Automated Decision-Making

I do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

14. Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in law, services, or business practices. When I make material changes, I will update the “Last Updated” date at the top and, for significant changes, notify you by email (if you are a subscriber) or through a prominent notice on the Site. Your continued use of the Site after changes take effect indicates your acceptance of the updated policy.

15. Contact Me

If you have any questions about this Privacy Policy or how your personal information is handled, please contact:

Usman Khurshid Email: hello@usman.one Website: https://usman.one

I aim to respond to all privacy-related enquiries within five working days.