Privacy Policy

This Privacy Policy explains how RAHA (“RAHA”, “I”, “we”), the independent design studio of Israt Jahan Raha, handles personal data when you visit gfxraha.com, contact us, book a call or become a client. RAHA provides digital design services remotely to clients worldwide.

1. Who we are (data controller)

RAHA, operated by Israt Jahan Raha, Dhaka, Bangladesh, is the controller of the personal data described here. Contact: info@gfxraha.com. When we process personal data on a client’s behalf inside a project (for example customer names in a design you give us), we act as a processor for that client (see section 4).

2. Personal data we collect

• Contact & inquiry data: name, email, company, website, service, budget, timeline and project details you submit through forms or email.
• Booking data: name, email, time zone, meeting format and chosen date and time when you schedule a call.
• Client & billing data: billing name, company, address, tax or VAT number (if you provide one), invoices and payment confirmations. Card and bank details are handled by the payment provider, not stored by us.
• Project communications & files: messages, feedback, briefs, brand assets and other materials you share.
• Website usage data: pages visited, referring site, approximate location (country/city from IP), browser and device, recorded in standard server logs kept by our hosting provider. We do not currently use any third-party analytics service.

We do not intentionally collect sensitive data (such as health, religious or biometric data). Please don’t include it in forms or project files unless it is essential and agreed in advance.

3. Why we use your data and our legal bases

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

4. Client files & project data

Files you share (logos, photos, documents, product data, customer lists) are used only to deliver your project. They are stored in access-controlled cloud tools, never shared outside the project, and deleted or returned on request after delivery. If a project requires us to handle personal data about your customers or staff, we process it only on your documented instructions; a data processing agreement (DPA) is available on request.

5. Use of AI tools

Some services use generative AI tools. We only upload client materials to AI tools when needed for your project, choose settings or plans that do not allow providers to train on your content where available, and never upload confidential or personal data to AI tools without your permission.

6. Sharing & service providers

We never sell or rent personal data, and we do not “share” it for cross-context behavioural advertising. We use trusted providers (processors) who handle data only to provide their service:

• Website hosting, email & forms: Namecheap (web hosting and email), WordPress and Elementor forms
• File sharing: the cloud storage service agreed with you for each project, used to send large files
• Scheduling & video calls: Google Meet, Zoom, WhatsApp
• Design & collaboration: Figma, Adobe Creative Cloud
• Payments: our card payment provider, PayPal, Wise, Payoneer and banks. Card payments (Visa, Mastercard, American Express and other major cards) are processed securely by the payment provider; RAHA never sees or stores your full card number.
• Analytics: none at present. If this changes, this policy will be updated first

We may also disclose data if required by law, to protect our legal rights, or with your consent.

7. International data transfers

RAHA is based in Bangladesh and works with clients globally, and our providers may store data in the United States, the European Union or other countries. Where data from the EEA, UK or Switzerland is transferred to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) offered by our providers.

8. How long we keep data

• Inquiries that don’t become projects: up to 12 months.
• Project files and communications: up to 2 years after delivery, unless you ask us to delete them sooner.
• Invoices and accounting records: as long as tax law requires, typically 6 to 10 years.
• Server logs: kept by our hosting provider for a limited period under its own retention policy.

9. Cookies & similar technologies

We use essential cookies needed for the site to work and we do not use analytics or advertising cookies. Embedded tools such as scheduling widgets may set their own cookies. You can manage cookies through your browser settings.

10. Your rights

Wherever you live, you can ask us to:

• access a copy of your personal data;
• correct inaccurate data or delete data we no longer need;
• receive your data in a portable format;
• object to or restrict certain processing, and withdraw consent at any time;
• opt out of any marketing emails.

Email info@gfxraha.com. We may need to verify your identity and will respond within 30 days (or the period your local law requires). We will never discriminate against you for exercising your rights.

11. Region-specific information

EEA, UK & Switzerland

You have the rights described under the GDPR / UK GDPR, including the right to lodge a complaint with your local data protection authority (for example the ICO in the UK). We’d appreciate the chance to address your concern first.

United States (including California)

Residents of states with privacy laws, such as California (CCPA/CPRA), may request to know, delete or correct personal information and to opt out of its sale or sharing. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that require a right to limit.

Other countries

If you are located elsewhere, including Canada, Australia, the Middle East or Asia, we will honour the rights your local law provides. Contact us and we will help.

12. Security

We protect data with encrypted connections (HTTPS), two-factor authentication on key accounts, access-controlled file storage and reputable providers. No online system is completely secure; if a breach affecting your data occurs, we will notify you and the authorities where the law requires.

13. Children

Our services are for businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has sent us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as our services or the law change. The date at the top shows the latest version; significant changes will be highlighted on this page or emailed to active clients.

15. Contact

RAHA · Israt Jahan Raha · Dhaka, Bangladesh · info@gfxraha.com