Privacy Policy

Blazed Digital, trading as The Revamp Company is a sole proprietorship registered in the Islamic Republic of Pakistan. Our place of business is Islamabad, Pakistan. For privacy questions, requests and complaints, contact jarvis@therevampcompany.com.

In this Policy, "personal data" includes "personal information" as defined in US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA (CCPA), and has the meaning given in the UK GDPR, the EU GDPR and, where applicable, the Prevention of Electronic Crimes Act 2016 (PECA) and any successor or complementary Pakistani data-protection law, including any enacted form of a Personal Data Protection Bill.

Depending on the activity, we act as a controller (for our own sales, booking, billing, referral-programme and website records) or as a processor (when we handle your customers', staff or other end-user data inside a system we build or run for you). When we are a processor, the Data Processing Agreement applies and this Policy describes our own controller activities.

This Policy covers personal data we collect through therevampcompany.com and related subdomains, booking and assessment forms, email, calls, messaging, invoices, the referral programme, our monthly Plans, and our client portal. It does not cover third-party websites we link to, or a third-party product you connect.

We collect the following categories, depending on how you interact with us:

• Identity and contact data: name, business name, role, email address, telephone number, website URL, and the contents of the "what is holding your growth back" or similar free-text fields, and social media handles or follower counts you share with us.
• Booking and calendar data: requested slot, time zone, meeting links, attendance, and notes we or you add to the booking.
• Commercial data: Statements of Work, invoices, payment references, amounts, currency, payer name, and the status of Plan subscriptions, deposits and milestones.
• Referral-partner data: partner name, contact details, introduction records, wallet credits, commission calculations and payout details.
• Technical data: IP address, browser type, device type, referring URL, and similar logs our host generates. Google Analytics records pages viewed, approximate location and device details, and Google Ads measures whether an ad led to a booking; both use cookies except for visitors in the UK, EEA and Switzerland, where they run without cookies. See the Cookie Policy. The Meta Pixel sets advertising cookies (_fbp and _fbc) so we can measure whether an ad led to a page view or a booked call.
• Communications: emails, messages, call notes, recordings if we tell you a call is recorded, and files you send.
• Client-system data: if you give us access to your systems, we may see personal data of your customers, staff and suppliers. We process that data as your processor under the Data Processing Agreement.
• Portal usage: account identifiers, support tickets, change requests and diagnostic information from our client portal.
• Outreach data: when we run outreach for you, business contact details of prospects (name, role, business email, business and public profile information) gathered from public sources or data providers, and their replies and opt-outs.

We do not seek special-category data, children's data, or payment-card primary account numbers. Do not send them. Payment-card data, if you pay by card, is handled by the payment provider, not stored by us.

We collect personal data directly from you (forms, email, calls, bookings, payments and messages), automatically from your device when you load our website or client portal (server logs, Google Analytics, Google Ads and the Meta Pixel described in the Cookie Policy), and from service providers who process payments or host meetings on our behalf. We may also receive an introduction from a referral partner, in which case we will take the contact details they give us and tell you the source when we first write to you where required.

We use personal data for the purposes below. Where UK GDPR or EU GDPR applies, the listed legal bases apply. Where only Pakistani law applies, we process as permitted by that law and by your contract with us.

• Contract: to take steps at your request before contracting, to book and run a Review, to perform a Statement of Work, to bill and collect Fees, to provide your Plan, and to operate a referral-partner relationship. GDPR Article 6(1)(b).
• Legitimate interests: to operate, secure and improve our business, to keep records, to defend claims, to prevent fraud, chargebacks and abuse, to measure limited technical performance, and to tell existing or prospective business contacts about our Services where permitted, including commercial email sent in line with the CAN-SPAM Act. GDPR Article 6(1)(f). You may object as described below. We have balanced these interests against your rights and consider the processing necessary and proportionate for a B2B service.
• Legal obligation: to keep tax, accounting and anti-fraud records, and to respond to competent authorities. GDPR Article 6(1)(c).
• Consent: only where we ask for it, for example optional marketing that law requires consent for. For visitors in the UK, EEA and Switzerland, Google Analytics and Google Ads run without cookies and do not rely on consent; see the Cookie Policy. You may withdraw consent at any time without affecting earlier processing. GDPR Article 6(1)(a).

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

We share personal data with the following categories of recipients, only as needed:

• Google, for Google Calendar and Google Workspace, to schedule Reviews and related meetings and to store business email, for Google Analytics website measurement, and for Google Ads to measure and show our ads, including a conversion event when a booking is confirmed.
• Meta Platforms, Inc., to measure our ads. The Meta Pixel sends page views and, when you book a call, a Lead. Our server also sends that Lead with a hashed form of your email and name, your IP address and your browser, so the conversion is still counted if the browser pixel is blocked. See the Cookie Policy.
• Payoneer and any other payment, invoicing or payout provider we use from time to time (which may include banks, Wise, PayPal, Stripe or similar), to collect Fees and pay referral commissions.
• Hosting, domain, email and infrastructure providers that host this website, our client portal, staging or production systems.
• Professional advisers, contractors and subprocessors who work under confidentiality obligations.
• Authorities, courts, payment schemes and collection agents when law requires or when we enforce the contract.
• A buyer or successor if we transfer our business, under appropriate safeguards.

We do not sell personal data. Sending the Meta Pixel and booking Lead to Meta can count as "sharing" for cross-context behavioral advertising under the CCPA and similar US state laws, because Meta may use it to measure and deliver ads. You can opt out by blocking cookies or through Meta ad preferences, as described in the Cookie Policy. A referral partner who introduced you may be told that a Review was booked or that a qualifying payment cleared, to the extent needed to operate the programme, and not more.

Blazed Digital is established in Pakistan. If you are in the United States, your personal data will be accessed from Pakistan and stored with providers in the United States and other locations. Pakistan is not the subject of a UK or EU adequacy decision. If you are in the United Kingdom or the European Economic Area, your personal data will be transferred to Pakistan and may be stored or accessed in other countries where our providers operate (including, for Google and many payment providers, the United States and other locations).

Where UK GDPR or EU GDPR applies to a transfer, we rely on one or more of: (a) the transfer is necessary for the performance of a contract with you, or for pre-contractual steps you requested, or for the conclusion or performance of a contract in your interest; (b) standard contractual clauses or the UK international data-transfer addendum with the recipient, where the recipient is a provider that offers them; and (c) your explicit consent where we ask for it and law requires it. We will provide a copy of relevant safeguards on request to jarvis@therevampcompany.com, redacted for confidentiality.

Pakistani law, including PECA, may compel disclosure to Pakistani authorities in circumstances that differ from US, UK or EU law. If that risk is unacceptable to you, do not use the Services.

We keep personal data only as long as needed for the purposes above, including:

• booking and unsuccessful sales enquiries: ordinarily up to twenty-four (24) months after last contact;
• client and billing records: for the engagement and then at least six (6) years, or longer if tax or limitation-period rules require;
• Plan accounts: for the subscription and a reasonable wind-down period;
• outreach opt-outs: for as long as needed to honour the opt-out;
• referral records: for the programme relationship and then as needed to evidence commission, clawback and tax;
• server logs: for a short operational period unless needed for security or a dispute;
• legal hold: for as long as a claim, investigation or chargeback is reasonably in prospect.

When we no longer need personal data, we delete or irreversibly anonymise it, except for copies on backup systems that are overwritten in the ordinary cycle.

We use organisational and technical measures appropriate to a small professional-services business, including restricted access, commercial cloud providers, and least-privilege credentials where we control them. No method of transmission or storage is completely secure. You must keep your own passwords and access tokens safe and tell us promptly of a suspected breach involving our Services.

If you are a resident of a US state with a consumer privacy law (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others), you may have the right to know what personal information we hold about you, to access, correct or delete it, to obtain a portable copy, and to opt out of sale, targeted advertising and profiling. Many of these laws exempt business-to-business data, but we will honour reasonable requests where we can. We will not discriminate against you for exercising these rights. You may use an authorised agent where law allows, and if we deny a request you may appeal by replying to our decision.

You can opt out of our marketing emails at any time using the unsubscribe link in each email or by writing to us. We process opt-outs within ten (10) business days, as the CAN-SPAM Act requires.

If UK GDPR or EU GDPR applies to you, you may have the right to request access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interests or to direct marketing. You may withdraw consent where processing is based on consent. Those rights are not absolute; exemptions apply, including where we must keep data for a contract, a legal duty or a claim.

To exercise a right, email jarvis@therevampcompany.com from the address we hold for you, or with enough information to verify you. We may ask for additional information. We will respond within the time law requires. We may refuse requests that are manifestly unfounded, excessive or that would compromise our or another person's rights, and we may charge a reasonable fee where law allows.

If you are in the US, you may contact your state attorney general. If UK GDPR or EU GDPR applies, you may complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office (ICO). In an EU or EEA member state you may complain to your local authority, including the Data Protection Commission (DPC) in Ireland. We ask that you contact us first so we can try to resolve the matter.

Under PECA and other Pakistani law, unauthorised access, interference and certain electronic communications offences are criminal. If you have a Pakistani-law privacy concern, contact us at the same email. Rights under any future Pakistani personal-data statute will be honoured to the extent they apply and cannot be excluded.

The Services are directed at businesses and are not intended for anyone under eighteen (18), or under twenty-one (21) where that is the age of majority for the relevant act. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

We may update this Policy by posting a new version with a new effective date. Material changes will be notified by email where we hold a current address, or by a notice on the website. The updated Policy applies from its effective date to processing that continues after that date.