Privacy notice
Last updated:
This notice explains how personal data is processed when you visit this Uday3 agency website, contact our team or book an appointment. It covers the website and the related enquiry and booking process.
We use the information needed to provide the website, respond to your request and organise our work with you. The AI and automation examples on the website are illustrations: entering an enquiry does not connect your shop or send its contents to an AI service.
1. Who is responsible for your data?
Uday3
Md Musfiqur Rahman
Kolonnenstraße 8
10827 Berlin
Germany
Privacy enquiries and rights requests: mail@uday3.com
2. Which data is processed, and why?
Visiting the website creates technical connection data, such as IP address, request time, requested URL, browser and device information and security events. These are needed to deliver and protect the website.
If you contact us, we receive the contact and business information you send, such as your name, email address, shop URL, project topic and message. For an appointment, we receive the booking information you provide, the selected time and related correspondence. We use these to understand your request, communicate with you and arrange or deliver the requested service.
Please share only relevant information. Do not include passwords, payment-card details, health information or identifiable customer exports in an initial enquiry. Access to a client’s store and any processing of its customer data are handled separately for an agreed project.
3. Hosting, connection data and security
This website is delivered through OpenAI Sites and its hosting, network and security infrastructure, including Cloudflare. The platform processes technical connection and request information to deliver the website, control access where applicable, maintain availability and protect the service.
This can include IP address, request time, requested URL, browser and device information, response status and security events. Our legal basis is Article 6(1)(f) GDPR: our legitimate interest in providing a reliable, secure business website. The application does not operate an additional database of individual visitor activity.
Platform providers may retain technical records for service delivery, troubleshooting, security and legal requirements under their applicable terms and privacy information. OpenAI’s privacy policy describes its own processing, retention and international transfers. Cloudflare explains its network and security processing in its privacy policy.
4. Contacting us and using the enquiry draft
The enquiry form prepares a draft locally in your browser. It has no lead-submission endpoint and does not send its fields to us when you select “Prepare my enquiry”. Personal contact fields and the shop URL are optional. The fields remain disabled until the local form functionality is ready.
Selecting “Open email app” passes the draft to your chosen email application. We receive it only when you send the email. Selecting “Copy draft” writes the text to your device’s clipboard; it does not read your clipboard. The website itself keeps the draft in page memory. Your browser, clipboard manager or email application may retain information under your own settings.
For an enquiry about a contract with you, the legal basis is Article 6(1)(b) GDPR, including steps requested before entering a contract. For communication with employees or representatives of a business, or other general business enquiries, it is Article 6(1)(f) GDPR: our legitimate interest in responding and maintaining relevant business contact. Your enquiry is not an automatic subscription to marketing messages.
5. Appointment booking through Calendly
Booking buttons are ordinary links to Calendly, LLC in the United States. We do not embed a Calendly widget, so the website does not load that booking service merely because you view a page. You can also arrange a conversation by emailing us.
If you open Calendly and book, it processes the name, email address, chosen time and any additional answers you provide, together with technical information from your visit to its service. Booking details are made available to us to organise the meeting. Calendar and communication services used for the appointment can also receive the information needed to arrange it.
Our legal basis is Article 6(1)(b) GDPR for an appointment you request in connection with a possible contract, or Article 6(1)(f) GDPR for the legitimate interest in arranging business communication. Calendly describes its role as processor for customer booking data and its separate controller role for its own website and service purposes. Its own cookie choices and privacy information apply when you use Calendly.
6. Video portfolio through Bunny Stream
The AI Creative Studio can display preview frames and video players delivered through Bunny Stream by BunnyWay d.o.o. These external resources remain blocked until you allow the optional ‘External media’ category in the privacy controls. Without that choice, your browser does not request the thumbnails or players from Bunny Stream.
After consent, loading a preview or player sends the technical connection data needed to deliver and secure it, including IP address, request time, browser and device information. Bunny states that its player does not set cookies or transmit personally identifiable information as part of playback or analytics, but can send anonymised technical telemetry such as quality, error and buffering metrics. Bunny documents that resumable playback can use the player origin’s local storage to keep the playback position on your device for up to seven days.
The legal basis for loading optional external media and related device access is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw or change this choice at any time through ‘Privacy choices’ in the footer. Withdrawal does not affect earlier lawful processing. If you expressly start a video, access strictly necessary to deliver the requested playback service may additionally rely on Section 25(2) TDDDG.
7. Google, portfolio websites and external links
The Google business-profile/reviews link and portfolio links open external websites only when you choose them. We do not embed Google reviews, maps or social feeds. Except for the Bunny video player described above, portfolio images and fonts are delivered with this website.
When you follow a link, the destination receives the connection information needed to provide its own website and may use its own cookies or services. The application uses a no-referrer policy and external links use protective link attributes. We do not attach your enquiry fields to these links. The destination operator is responsible for its own processing under its privacy notice.
9. Recipients and international processing
Data can be received by the hosting and security providers identified above, Bunny Stream when you choose a portfolio film, our email provider, Calendly and the calendar or communication providers involved in a requested appointment. Within our business, access is limited to people who need the information for your request or project. Professional advisers and public authorities receive information only where required or permitted for a specific legal purpose.
Some providers operate globally, including in the United States. The named providers’ privacy notices and data processing documents explain their international processing. Calendly and Cloudflare describe reliance on the EU–US Data Privacy Framework and/or European Commission standard contractual clauses for relevant transfers; the applicable mechanism depends on the provider, certification scope and processing concerned.
Transfers for which we are responsible must meet Chapter V GDPR: an applicable adequacy decision under Article 45, or appropriate safeguards under Article 46, including any supplementary measures required in the circumstances. You can contact us for information about recipients and the safeguards applicable to your data, and a copy where available, with necessary protection for other people’s information.
10. How long is information kept?
The website itself retains the unsent draft only in the current page’s memory. Clipboard contents, browser autofill and email drafts are controlled through your device and applications. The hosting platform’s technical records follow the security, service and retention criteria described in the hosting section and its provider information.
Enquiry and appointment correspondence is kept for as long as needed to answer the request, arrange or follow up on the meeting, or carry out an agreed project. When those purposes end, it is deleted unless a specific legal retention duty or the establishment, exercise or defence of a legal claim requires further retention.
Commercial correspondence, contracts and tax-relevant records can be subject to statutory retention periods, including the applicable periods under Section 257 HGB and Section 147 AO. During required retention, use is limited to the relevant purpose. Records are deleted or anonymised when the applicable purposes and obligations have ended. Article 6(1)(c) GDPR applies where retention is legally required; Article 6(1)(f) applies to necessary protection of legal claims.
11. Your GDPR rights
Subject to the legal conditions, you can request access and a copy of your personal data (Article 15), correction (Article 16), erasure (Article 17) and restriction of processing (Article 18). Data portability applies under Article 20 where processing is automated and based on consent or a contract.
If processing is based on consent, you can withdraw that consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal. There is no requirement to give marketing consent to make an enquiry.
Send rights requests to the privacy email shown above. We normally respond within one month of receipt. If the request is complex or there are several requests, the GDPR permits an extension of up to two further months; we inform you within the first month and explain why. If identity verification is necessary, we request only proportionate information.
12. Your right to object
Under Article 21 GDPR, you may object on grounds relating to your particular situation to processing based on Article 6(1)(f), including related profiling. We then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
If personal data is processed for direct marketing, you may object to that use at any time, without giving a reason. It must then stop for that purpose. Contact the privacy email above to exercise this right.
13. Complaints to a supervisory authority
You may complain to a competent data protection authority under Article 77 GDPR, in particular in the country of your habitual residence, place of work or the alleged infringement. You do not have to contact us first.
The Berlin Commissioner for Data Protection and Freedom of Information can be contacted at Alt-Moabit 59–61, 10555 Berlin, Germany; email mailbox@datenschutz-berlin.de. The European Data Protection Board maintains contact details for national supervisory authorities.
Berlin supervisory authority · European supervisory authorities
14. Your choices and automated decisions
You can read the website without creating an account or submitting an enquiry. Technical connection data is necessary to deliver a page. For a reply or appointment, a usable contact method and enough context to deal with the request are needed; other information is voluntary. You can email us instead of using the draft tool or Calendly.
This application does not make decisions based solely on automated processing that produce legal or similarly significant effects under Article 22 GDPR. It does not run an AI chatbot or automatically analyse the personal contents of your enquiry with an AI model.
15. Secure communication and updates
The website is delivered over HTTPS. Ordinary email is not the same as end-to-end encrypted communication. Contact us first if you need a secure way to transfer confidential information or client data.
If an agreed project requires us to process personal data from your shop on your behalf, the roles, instructions, access, tools and any required Article 28 GDPR data processing agreement are addressed separately before that processing begins. This notice does not replace those project arrangements.
We update this notice when the website’s features, service providers or relevant processing changes. The date at the top identifies this version.