← Back to Iman Sharif
Transparent Terms
Privacy Notice & Terms of Engagement
1. Privacy Notice (UK GDPR & Data Protection)
This notice outlines how personal data is handled when you visit imansharif.com, book a call, or work with my practice.
Who I Am & Contact Details
The data controller for website visitors, enquiry correspondence, and direct business communications is Iman Sharif, operating as an independent commercial and operations consultant in Scotland, UK. Contact: [email protected].
Summary of Data Processing
| What | Why | Lawful Basis | Retention |
|---|---|---|---|
| Name, email & message | Responding to incoming business enquiries and triage requests. | Legitimate interests / pre-contractual steps (Art. 6(1)(b)/(f)) | Up to 12 months from last contact, then securely deleted. |
| Client contact details | Managing an active engagement, invoicing, and contract delivery. | Contractual necessity (Art. 6(1)(b)) | Duration of engagement + statutory limitation period. |
| Project & supplier records | Performing spend audits, price benchmarking, or workflow automation. | Contract / Client documented instructions (Processor) | Deleted within 30 days of completion unless agreed otherwise. |
| Accounting & tax records | Statutory financial reporting, invoicing, and tax accounting. | Legal obligation under UK law (Art. 6(1)(c)) | 6 years in compliance with HMRC statutory requirements. |
| Technical server logs | Transient security, rate limiting, and attack mitigation. | Legitimate interests (Art. 6(1)(f)) | 30 to 90 days rolling security cycle. |
Important Distinction: Controller vs. Processor
My practice operates in two distinct data protection capacities:
- When I act as Controller: For your business contact details, billing information, and email correspondence, I determine the purpose of processing and act as the data controller.
- When I act as Processor (Client Project Data): When you provide supplier invoices, trade accounts, employee names on purchase orders, or operational spreadsheets so I can run a cost audit or build an automation tool, you remain the data controller. I process that data solely on your documented instructions as your data processor under UK GDPR Article 28. Such processing is governed strictly by the confidentiality and data protection provisions in our written agreement.
Software Automation & AI Tools
I use modern software tools, custom scripts, and AI-assisted automation to deliver rapid results. Client documentation and confidential data are processed only within secure environments with appropriate contractual safeguards. I do not use client records, confidential trade prices, or enquiry details to train public AI foundation models, and I do not make solely automated decisions that produce legal or similarly significant effects.
Cookies & Tracking Technologies
This website does not use tracking pixels, advertising cookies, or behavioral surveillance. It uses only strictly necessary technical tokens (such as saving your preferred Light/Dark theme setting in your browser) and transient server-side security checks. In accordance with the Privacy and Electronic Communications Regulations (PECR) and the Data (Use and Access) Act, non-tracking functional technologies do not require intrusive cookie consent banners.
Your Right to Object (UK GDPR Article 21)
Where your data is processed under legitimate interests, you have the right to object to that processing at any time. You also have an absolute, unconditional right to object to the use of your contact information for direct marketing. I do not run unsolicited marketing lists.
Your Statutory Rights & How to Complain
Under UK GDPR, you have the right to request access to, correction of, or deletion of your personal data, as well as the right to restrict processing or request data portability.
If you have questions or wish to exercise any right, contact me directly at [email protected] so I can resolve it promptly. You also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk.
2. Terms of Engagement & Professional Boundaries
These terms outline the operating standards of my commercial practice. All work is conducted on a transparent, Business-to-Business (B2B) basis for commercial entities, subcontractors, and sole proprietors.
Professional Scope & Non-Legal Notice: Services are provided strictly as independent operational management, supplier benchmarking, and commercial workflow consultancy under Scots law. I am not a practising solicitor or regulated law practice. Spend audits, subcontractor contract reviews, and dispute negotiation support are management advisory reviews and do not constitute formal legal advice or carry legal professional privilege under the Legal Services (Scotland) Act 2010. Formal court proceedings, litigation, or conveyancing require an independent practising Scottish solicitor.
Standard Engagement Agreements
To keep engagements clean and transparent, all substantive work is delivered under one of two standard B2B agreements, depending on the service you require:
Core Commercial Terms Summary
- No Hidden Retainers: Zero upfront professional fee unless an agreed custom deliverable is formally commissioned with specific criteria.
- Clear Acceptance Tests: Deliverables are verified against objective, testable criteria agreed before project commencement.
- Fair Liability: In line with standard B2B reasonableness tests, total aggregate liability is capped at the greater of £5,000 or total fees paid under the relevant agreement. Nothing limits liability for death, personal injury caused by negligence, or fraud.
- Intellectual Property: You own your data and materials. Custom project deliverables are licensed for your perpetual internal commercial use upon payment of agreed fees. Pre-existing software frameworks and benchmarking tools remain consultant IP.
- Governing Law: All engagements, agreements, and terms are governed exclusively by Scots law and subject to the exclusive jurisdiction of the Scottish courts.