OveliTHub privacy policy

Who we are

OveliTHub is a digital agency based in Dhaka, Bangladesh. This policy covers personal data we handle as a controller — that is, data we decide the purposes for — which means visitors to this website, people who make an enquiry, and people who apply for a job.

It does not cover data we process on a client’s behalf as their supplier. That is a different relationship with different rules, and it is described further down.

What this website collects, and what it does not

Unless you tell us otherwise, this site loads nothing from any other domain. No external fonts, no advertising, no social widgets, no trackers. Every request a page makes goes to this domain and nowhere else, and that is checkable in about ten seconds with any browser’s network inspector.

One thing can change that, and only you can change it. The site asks, on your first visit, whether it may load Google Analytics. If you say yes, a script is fetched from googletagmanager.com and Google is told which pages you look at on this site. If you say no — or close the question without answering — nothing is fetched, nothing is sent, and the site behaves exactly as the paragraph above describes. There is no reduced version of the site for people who decline, and nothing stops working.

The practical effect: reading this website does not hand your visit to a third party unless you have decided it may, and either way there is no advertising profile being built from it.

The free tools published here compute everything in your browser. Figures you type into a calculator are not transmitted anywhere and are not stored. The one exception is documented on the page that uses it — the on-page checker can fetch a web address you give it, because a browser is not permitted to fetch another site itself. That request keeps only a counter, and the counter is keyed to a salted hash rather than to your address.

What we collect when you contact us

When you send an enquiry we receive what you put in the form — normally your name, your email address, your company, and what you have told us about the problem — together with the page you were on when you sent it. We use it to answer you and, if it becomes a project, to run the project.

The lawful basis is our legitimate interest in responding to a business enquiry, and, once work begins, the performance of a contract with you.

We do not sell it, rent it, or add it to a marketing list you did not ask to be on.

Cookies

This site sets no advertising cookies at all, and it asks before setting an analytics one — before, rather than telling you afterwards that it already has.

Set either way. One cookie that records your answer to that question, so you are not asked again on every page. It holds a single word, granted or denied, it is readable only by this domain, and it lasts six months, after which the question is asked again. WordPress sets a small number of functional cookies for people who sign in to the administration, and Contact Form 7 may set a short-lived cookie to stop a form being submitted twice. None of these is used to profile anyone.

Set only if you accept analytics. Google Analytics 4 sets a cookie named _ga and a second one beginning _ga_, which tell one browser apart from another so that a returning visit is not counted as a new person. They last up to two years unless you clear them. Google receives the pages you view on this site and is the recipient of that data; what Google then does with it is governed by Google’s own privacy policy rather than by this one.

Changing your mind. The Cookie settings link in the footer of every page reopens the question. Declining there clears the analytics cookies this site is able to reach and stops anything further being sent. You do not have to email us to withdraw, and there is no form to fill in.

How long we keep things

Enquiries that do not become projects are kept for 12 months and then deleted. Twelve months is long enough to pick a conversation back up where a project was postponed rather than declined, and short enough that we are not sitting on contact details we have no use for.

Records relating to actual engagements — contracts, invoices, correspondence about the work — are kept for as long as we are legally required to keep them for tax and accounting purposes, and then deleted.

Job applications are kept for the duration of the recruitment process and, unless you ask us to keep them on file, deleted afterwards.

Who else sees it

A short list, and it is short on purpose: our email and hosting providers, our accounting software, and the payment provider that issues an invoice. Each is a processor acting on our instructions under a contract, not a party we share data with for their own purposes.

We will disclose personal data where the law requires it. If that ever happens and we are permitted to tell you, we will.

When we handle data for a client

A support desk or a back-office desk exists to work on somebody else’s records. In that arrangement the client is the controller and we are their processor: we act on their documented instructions and nothing else, and the terms are set by a signed data processing agreement rather than by this page.

The agreement is signed before any data moves. It names what is being handled, who may see it, where it is held, the security measures, every sub-processor, and what happens to the data when the engagement ends. Access is granted per person and revoked when they leave the desk.

If you are a customer of one of our clients and want to know what is held about you, the client is the right place to ask. We will always help them answer you.

Where data is held

Our team works in Bangladesh, so data reaching us is accessed from there. Where a client is in a jurisdiction that restricts transfers — the UK and the EU most commonly — the transfer mechanism is named in the data processing agreement rather than assumed, and it is agreed before work starts rather than discovered during it.

Keeping it safe

Access is granted on the basis of who needs it to do the work, and removed when they no longer do. Client systems are accessed through accounts issued to named individuals rather than shared logins. This website is served over HTTPS and carries a content security policy, and the administration area is protected against automated login attempts.

No system is perfectly secure and anybody who tells you otherwise is selling something. If a breach affecting your data occurs, we will tell you and the relevant authority within the time the law allows.

Your rights

You can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, ask us to restrict what we do with it, ask for a copy in a portable form, and object to processing we are doing on the basis of legitimate interest. Where you have given consent you can withdraw it at any time.

Ask by emailing the address below. We will answer within thirty days and we will not charge you for it. If you are not satisfied with our answer you are entitled to complain to the data protection authority in your country.

Contact

Email support@ovelit.com and mark it for the attention of the data protection contact. A person reads it.

Changes to this policy

If this policy changes materially we will say so on this page rather than updating it quietly.