Privacy Policy

Important: This Privacy Policy explains how House of Jahan Ltd (“we”, “us”, “our”) collects and uses personal data when you use houseofjahan.co.uk or otherwise deal with us. It is written to meet UK data protection law, including the UK GDPR, the Data Protection Act 2018, and (where relevant) the Privacy and Electronic Communications Regulations (PECR). It is not a substitute for independent legal advice.

1. Who we are (data controller)

The data controller responsible for personal data processed through this website and related business enquiries is:

• House of Jahan Ltd
• A private limited company registered in England and Wales (Company No. 17337011)
• Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
• Email: hello@houseofjahan.co.uk
• Website: https://houseofjahan.co.uk

The registered office is shown because UK company law requires it on our website. It is not a public visiting address. Please contact us by email for all enquiries.

Humera Jahan is the Director and founder of House of Jahan Ltd. Where she handles personal data in connection with the company (for example reading enquiry emails, responding to clients, or administering this website), she does so on behalf of House of Jahan Ltd as controller — not as a separate data controller for those activities. Her personal LinkedIn profile and other purely personal online activity are outside the scope of this policy unless we expressly use that channel for company business.

If you have questions about this policy or wish to exercise your data protection rights, contact us at the email above. Please mark the subject line “Data protection”.

2. Whose data we process

We may process personal data about:

• Website visitors
• People who submit our contact form or email us
• People who subscribe to our insights / newsletter list
• Prospective, current, and former clients and their staff (in a business context)
• Suppliers and professional contacts

This website is aimed at business audiences. We do not knowingly collect personal data from children under 18. If you believe a child has provided data to us, please contact us and we will delete it where required.

3. What personal data we collect

3.1 Data you give us

• Contact form: name, work email address, service interest (optional), and message content.
• Newsletter signup: email address.
• Email or other direct contact: whatever identity and contact details and information you choose to send us (for example job title, organisation, phone number, or project details).
• Client engagement (if you instruct us): information needed to deliver services under a separate contract — which may include business contact details, stakeholder names, and project information you provide. Client contracts and statements of work govern that relationship in more detail.
• Invoices: client name, email, address, and related billing details you provide so we can issue and deliver invoices and payment receipts.

3.2 Data collected automatically

• Technical and usage data typically logged by our hosting environment and WordPress (for example IP address, browser type, device information, pages viewed, date/time, and referring URL), to the extent enabled by our host and platform.
• When you open a secure invoice link we email you, we may record that the link was opened (approximate date/time and open count) so we know delivery succeeded. Obvious automated scanners are ignored where we can detect them. Invoice links are unguessable and not listed publicly.
• Cookies and similar technologies — see section 8.

3.3 Data from other sources

Occasionally we may receive business contact details from a colleague of yours, a mutual introduction, publicly available professional sources (for example a company website or LinkedIn company/profile information you have made public), or from you via a third-party scheduling or messaging tool you choose to use. Where required, we will provide privacy information within a reasonable time.

We do not intentionally collect special category data (such as health, political opinions, or religious beliefs) via this website. Please do not include sensitive personal data in form fields or newsletter signups unless we have expressly asked for it under a separate arrangement.

4. Why we use personal data and our lawful bases

Under the UK GDPR we must have a lawful basis for each purpose. We rely on the following:

Purpose	Examples	Lawful basis
Respond to enquiries	Contact form, email replies, discovery calls	Legitimate interests (Art. 6(1)(f)) — to operate and grow our consultancy and respond to people who contact us; and/or steps prior to a contract (Art. 6(1)(b)) where you are seeking our services
Provide services	Delivery of project management, PMO, transformation, AI coaching, or commercial enablement work	Contract (Art. 6(1)(b)); legitimate interests for related administration
Insights / newsletter	Occasional emails about delivery, consulting, and practical AI	Consent (Art. 6(1)(a)) and PECR consent for electronic marketing — collected via double opt-in (subscribe form, then email confirmation link); you may withdraw consent at any time
Website security and operation	Hosting, spam prevention (including honeypot fields), abuse detection, backups	Legitimate interests (Art. 6(1)(f)) — keeping the site secure and usable
Business records and legal compliance	Invoices, tax, accounting, defending legal claims	Legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f))
Invoice delivery	Emailing invoice/receipt links or PDFs; recording that a secure invoice link was opened	Contract / steps prior to payment (Art. 6(1)(b)); legitimate interests for delivery confirmation (Art. 6(1)(f))
Public website content	Publishing the founder biography, professional credentials, and LinkedIn link for Humera Jahan; anonymised case studies	Legitimate interests (Art. 6(1)(f)) — presenting the business and the director’s professional background; Humera Jahan’s information is published with her knowledge in her capacity as Director

Where we rely on legitimate interests, we consider and balance any potential impact on you. You may object to processing based on legitimate interests (see section 10).

5. How we use enquiry and newsletter data in practice

• Contact form submissions are emailed to our business mailbox and used to respond to you. We do not sell your details.
• Newsletter: we store your address as pending until you click the confirmation link we email you (double opt-in). Only confirmed addresses are treated as subscribed. We may notify our business mailbox when a subscription is confirmed. We use the list only for the insights emails you requested, confirmation/unsubscribe messages, and related list administration.
• We use a simple anti-spam honeypot field on forms. It is not intended to collect real user data.
• Invoice emails include a secure link to view the current invoice online (Print and Download PDF are available on that page). We may attach a PDF when needed. Opening the link may update a viewed timestamp on our invoice record.

6. Who we share data with

We do not sell personal data. We may share data with trusted processors or recipients only as needed to run the business, including:

• Website hosting and related infrastructure provided by Hostinger (and its hosting stack serving houseofjahan.co.uk), including servers, CDN, backups, and related platform services
• Email and domain/mail services used to send and receive business email
• Professional advisers (for example accountants or solicitors) under confidentiality obligations, where needed
• Regulators, courts, or law enforcement where required by law or to protect our legal rights
• A successor organisation if we restructure, sell, or transfer relevant business assets (you would be notified where required)

Humera Jahan, as Director, may access personal data held by the company solely to perform company duties. That access does not make her a separate seller or independent controller of website enquiry data.

7. Hosting location and international transfers

Our primary audience and operations are in the United Kingdom. This website is hosted by Hostinger. Hostinger operates data centres in multiple countries. According to Hostinger’s published support information, available locations for web and cloud hosting plans can include Europe (France, Germany, Lithuania, the Netherlands, and the United Kingdom), Asia (India, Indonesia, and Malaysia), North America (USA), and South America (Brazil), and Hostinger may also use a CDN in additional regions. The exact data centre used for a given Hostinger plan depends on the location selected (or assigned) for that plan in Hostinger’s control panel, and Hostinger may change available locations over time.

We do not control Hostinger’s global infrastructure design. As a result, personal data processed through this website (for example form submissions, newsletter signups, and server logs) may be stored or processed in the United Kingdom, elsewhere in the European Economic Area, or in other countries where Hostinger or its infrastructure partners operate. Where personal data is transferred outside the UK, we rely on UK data protection transfer tools as required — for example adequacy regulations and/or appropriate contractual safeguards such as the UK International Data Transfer Agreement / Addendum where applicable — together with Hostinger’s role as our hosting provider.

For Hostinger’s current published list of server locations, see Hostinger’s support article on where Hostinger servers are located.

8. Cookies and similar technologies

We use cookies and similar technologies as described in our detailed Cookie Policy. In short: essential cookies make the site work; non-essential cookies (such as Google Analytics) are used only if you choose “Accept all” on our cookie banner. You can change your choice anytime via “Cookie settings” in the footer.

9. How long we keep personal data

We keep personal data only as long as needed for the purposes above, including legal, accounting, and reporting requirements:

• Contact enquiries: typically up to 24 months after our last meaningful contact, unless a longer period is needed for an ongoing discussion, contract, or dispute.
• Newsletter list: until you unsubscribe or we close the list; inactive addresses may be removed periodically.
• Client and billing records: normally for at least 6 years after the end of the accounting period (or longer if law requires).
• Security / server logs: according to our host’s retention practices and our security needs, usually a shorter operational period.

10. Your rights

Under UK data protection law you may have the right to:

• be informed about how we use your data (this policy)
• access your personal data
• have inaccurate data rectified
• request erasure in certain circumstances
• restrict processing in certain circumstances
• data portability in certain circumstances
• object to processing based on legitimate interests
• withdraw consent where consent is our basis (without affecting prior lawful processing)
• not be subject to solely automated decisions producing legal or similarly significant effects — we do not carry out such decision-making on this website

To exercise these rights, email hello@houseofjahan.co.uk with enough information for us to verify your request. We will respond within one month in most cases (extendable in complex cases as permitted by law).

You also have the right to complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/ — Helpline 0303 123 1113. We would appreciate the chance to resolve concerns first.

11. How we protect personal data

We use appropriate technical and organisational measures taking into account the nature of a small consultancy website — including HTTPS, access-limited business email, WordPress security updates where we control them, and limiting access to personal data to those who need it for company purposes (including the Director). No method of transmission or storage is completely secure; if we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO and, where required, affected individuals.

12. Third-party websites and social profiles

Our site may link to third-party sites or profiles (including LinkedIn). Those services have their own privacy notices and terms. We are not responsible for their content or processing. If you follow a link to Humera Jahan’s LinkedIn profile, LinkedIn’s privacy policy applies to your use of LinkedIn.

13. Case studies and testimonials

Case studies on this website are anonymised descriptions of programme types and outcomes. They are not intended to identify individual clients or private individuals. Testimonials may be illustrative or based on role descriptions. If you believe content identifies you personally and you want it reviewed, contact us.

14. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Significant changes may also be highlighted on the website or, where appropriate, communicated to subscribers or clients.

15. Contact

For privacy requests relating to House of Jahan Ltd, contact hello@houseofjahan.co.uk. Please do not send passwords or unnecessary sensitive documents by email.