Legal

Privacy Policy

Last updated: 1 August 2026

The KnowHow Company (“we”, “us”, “our”) is Mohamed Abu Khadra’s consulting practice, operating across Egypt and the wider Middle East. We take your privacy seriously. This policy explains what data we collect, why, and the rights you have over it.

1. Data we collect

We only collect data you voluntarily provide:

  • Contact form submissions: name, company, email, phone, country, service interest, and message.
  • Newsletter subscriptions: email address (and optionally name).
  • Analytics data: anonymised page views, device type, referrer, and event interactions. For our own first-party analytics, IP addresses are hashed (SHA-256) before storage — we never store your raw IP ourselves. If you grant analytics or marketing consent via our cookie banner, the third-party tools we use (e.g. Google Analytics via Google Tag Manager, and any ad platforms you’ve consented to) receive your IP address directly from your browser as part of how those services work, independent of our own storage.
  • Admin account: your email and a hashed password (PBKDF2, 100,000 iterations) if you have been granted admin access.

2. Legal basis for processing (GDPR)

We process your data under the following legal bases:

  • Consent (Art. 6(1)(a)): when you submit a contact form or subscribe to our newsletter.
  • Contractual necessity (Art. 6(1)(b)): to respond to your enquiry and potentially enter a consulting engagement.
  • Legitimate interest (Art. 6(1)(f)): first-party analytics to improve our services, using anonymised or pseudonymised data.
  • Legal obligation (Art. 6(1)(c)): where we are required to retain records for tax or regulatory purposes.

3. How we use your data

  • To respond to your enquiry and provide consulting services if engaged.
  • To send you our newsletter, if you have subscribed (you can unsubscribe at any time).
  • To improve our website and services through anonymised analytics.
  • To measure the performance of our marketing, but only if you have granted marketing consent via our cookie banner.

4. Cookies

We use cookies and similar technologies. Non-essential cookies (analytics and marketing) only load after you grant consent via our cookie banner. See our Cookie Policy for a full list. You can withdraw consent at any time by clearing your browser storage or using the consent controls.

5. Data sharing

We do not sell your data. We share it only with:

  • Service providers we use to operate this website (e.g. hosting, analytics, email delivery), under contract and GDPR-appropriate safeguards.
  • Regulatory or law-enforcement authorities, where legally required.

We operate from Cairo, Egypt, so your data is routinely accessed from Egypt as part of normal business operations — it does not stay within the UK/EEA. Where we or our service providers transfer personal data internationally, we do so under the UK’s International Data Transfer Agreement (IDTA), Standard Contractual Clauses, or another legally recognised safeguard appropriate to the destination country.

6. Data retention

  • Contact form submissions: retained for 24 months, then deleted unless you become a client.
  • Newsletter subscriptions: retained until you unsubscribe.
  • Analytics events: aggregated and retained for 13 months, then automatically deleted.
  • Client records: retained for the duration of the engagement plus 7 years for legal/tax purposes.

7. Your rights (GDPR / UK GDPR)

You have the right to:

  • Access the personal data we hold about you (request a copy via privacy@theknowhow.uk or our self-service export request page).
  • Rectification of inaccurate data.
  • Erasure (“right to be forgotten”) — request deletion of your data.
  • Restriction or objection to processing.
  • Data portability — receive your data in a machine-readable format.
  • Withdraw consent at any time, without affecting processing done before withdrawal.
  • Lodge a complaint with the UK ICO (ico.org.uk) or your local data protection authority.

8. Security measures

We protect your data with:

  • HTTPS / TLS encryption in transit (HSTS enforced).
  • Content Security Policy (CSP) headers.
  • PBKDF2 password hashing (100,000 iterations, SHA-512).
  • Server-side session tokens (HMAC-signed, 7-day expiry, httpOnly cookies).
  • Rate limiting on all public and admin endpoints.
  • Input sanitization to prevent XSS and injection.
  • Honeypot anti-spam on forms.

9. Children’s data

Our services are intended for businesses and professionals. We do not knowingly collect data from children under 16. If you believe we have, please contact us immediately.

10. Changes to this policy

We may update this policy from time to time. The “last updated” date above reflects the most recent revision. Material changes will be notified via email to newsletter subscribers.

11. Contact

For any privacy-related enquiry, or to exercise your rights, contact our Data Protection Lead:

Email: privacy@theknowhow.uk
Post: The KnowHow Company, Cairo, Egypt
Response time: within 30 days (GDPR requirement).