Privacy Policy
& Terms

ButtWarraichJutt Studio ('we', 'us', 'our') is the data controller responsible for your personal data. We are a web development and portfolio design studio operating under Pakistani law and serving clients internationally.

Data Controller: ButtWarraichJutt Studio. Email: buttwarraichjuttstudio@gmail.com. For all data protection enquiries, privacy requests, and complaints, contact us at the email above. We respond within 30 days.

This policy is governed by the Personal Data Protection Act (PDPA) 2023 of Pakistan. Where we process data of individuals in the European Union or United Kingdom, the EU General Data Protection Regulation (GDPR) and UK GDPR also apply. Where we process data of California residents, the California Consumer Privacy Act (CCPA) applies. In cases of conflict, the stricter standard applies.

When you contact us via our enquiry form or email, we collect: full name, email address, company or organisation name (optional), telephone number (if provided), project brief and description, budget range (if provided), and any other information you voluntarily include in your message.

When you visit our website, we may automatically collect: IP address (anonymised), browser type and version, operating system, pages visited and time spent, referring URL, and device type. This is collected only if you consent to analytics cookies. No automatic collection occurs without consent.

We do not collect or store payment card details. All payments are processed through third-party providers (bank transfer, PayPal, Wise). These providers have their own privacy policies and are responsible for your payment data. We only retain invoice records (name, amount, date) for accounting purposes.

We do not collect sensitive personal data as defined by PDPA 2023 Section 2(xxvii) including racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or sexual orientation. We do not collect data from children under 13 years of age.

We process your personal data on the basis of your freely given, specific, informed, and unambiguous consent when you submit our contact form or accept our cookie policy. You may withdraw consent at any time by emailing buttwarraichjuttstudio@gmail.com. Withdrawal does not affect the lawfulness of processing before withdrawal.

When you engage us for a project, we process your personal data to fulfil our contractual obligations including communicating about the project, delivering work, and issuing invoices. This processing is necessary; without it, we cannot perform the contract.

We retain financial records (invoices, payment records) for 7 years to comply with Pakistan's Income Tax Ordinance 2001 and Companies Act 2017, and equivalent obligations in other jurisdictions where we operate.

Where GDPR applies, we may process data on the basis of legitimate interests for example, to protect the security of our website and prevent fraud. We have conducted a Legitimate Interests Assessment (LIA) and determined this does not override your fundamental rights.

Under PDPA 2023 Section 6 and GDPR Article 5(1)(b), we only use your personal data for the specific, explicit, and legitimate purposes stated at the time of collection. We do not use your data for any other purpose without your additional consent.

We use your name and email to respond to your project enquiry, discuss requirements, and manage the working relationship. We do not use enquiry data for marketing without your separate consent.

During an active project, we use your contact details and project information to deliver the agreed services, request feedback, and provide progress updates. Project data is shared only with team members directly involved in your project.

We use your name, company name, and email to issue invoices and record payments. This data is retained for 7 years as required by applicable tax law. It is not used for any other purpose.

We do not use your personal data for automated decision-making or profiling as defined under PDPA 2023 Section 16 and GDPR Article 22. No decision that significantly affects you is made by automated means alone.

Cookies are small text files stored on your device by your browser when you visit a website. They allow the site to remember information about your visit. Under Pakistan's Electronic Transactions Ordinance 2002 and GDPR, we are required to inform you about cookies and obtain consent before setting non-essential cookies.

Cookie name: bwj_consent Purpose: Stores your cookie consent preference. Duration: 365 days. Cookie name: bwj_analytics Purpose: Stores whether you opted into analytics. Duration: 365 days. These cookies are strictly necessary for the consent mechanism to function and are set only after you interact with the cookie notice.

If you accept analytics cookies, we may collect anonymised data on page views, session duration, and navigation paths to improve the website. No personally identifiable information is collected via analytics. Analytics cookies are only set after you explicitly opt in via the cookie consent modal.

When you submit your cookie preferences, we store a consent audit record in your browser's localStorage (key: bwj_consent_record) containing: timestamp (ISO 8601), consent level, analytics opt-in status, and policy version number. This record is maintained for accountability and regulatory compliance.

You can withdraw cookie consent at any time by clearing your browser cookies and localStorage, or by using your browser's built-in cookie management tools. Alternatively, email buttwarraichjuttstudio@gmail.com and we will provide instructions. Withdrawing consent does not affect processing that occurred before withdrawal.

We do not place third-party advertising, social media, or cross-site tracking cookies on our website. If we embed third-party content (e.g. video, maps) in the future, we will update this policy and obtain fresh consent.

We do not sell, rent, trade, or otherwise transfer your personal data to third parties for commercial purposes. This applies absolutely and without exception.

We may share data with trusted third-party service providers who assist in operating our business including email services (e.g. Google Workspace) and payment processors (PayPal, Wise). These providers are contractually bound to process your data only on our instructions and in compliance with applicable data protection law.

Our service providers may process data outside Pakistan. Where data is transferred to countries without adequate data protection laws recognised by Pakistan's PDPA 2023 or EU GDPR, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) under GDPR Article 46, or equivalent mechanisms. You may request details of these safeguards by contacting us.

We may disclose your personal data if required to do so by law, court order, or competent regulatory authority in Pakistan or any other jurisdiction. We will notify you of such a request unless legally prohibited from doing so.

In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the new entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

Under PDPA 2023 Section 7 and GDPR Article 5(1)(e), we retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. When data is no longer needed, it is securely deleted or anonymised.

If your enquiry does not result in a project, your contact data is retained for 12 months and then deleted. This allows us to follow up on conversations and maintain context if you return. After 12 months, all enquiry data is permanently deleted.

Data related to active and completed projects is retained for the duration of the project plus 2 years, to handle any post-delivery support, disputes, or follow-on work. After this period, project communications are deleted and only invoice records are kept.

Invoice data, payment records, and related correspondence are retained for 7 years in compliance with Pakistan's Income Tax Ordinance 2001, Section 174 (record-keeping obligations). This retention is a legal requirement and cannot be shortened on request.

Cookie consent records (stored in your browser's localStorage) persist until you clear your browser data. Server-side consent logs, if maintained, are retained for 3 years for regulatory accountability purposes.

Under the Personal Data Protection Act 2023, you have the following rights: (1) Right to access your personal data (Section 10). (2) Right to rectification of inaccurate data (Section 11). (3) Right to erasure ('right to be forgotten') (Section 12). (4) Right to restriction of processing (Section 13). (5) Right to data portability (Section 14). (6) Right to object to processing (Section 15). (7) Right not to be subject to automated decision-making (Section 16).

If you are located in the EU or UK, you also have the right to lodge a complaint with your national data protection supervisory authority. In the EU, this is the relevant national DPA (e.g. ICO in the UK, CNIL in France). You also have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

If you are a California resident, you have the right to: know what personal data we collect, request deletion of your personal data, opt out of the sale of personal data (we do not sell data), and not be discriminated against for exercising your rights. Submit requests to buttwarraichjuttstudio@gmail.com.

To exercise any of your rights, email buttwarraichjuttstudio@gmail.com with the subject line 'Data Subject Request'. We will respond within 30 days (or 72 hours for breach notifications). We may need to verify your identity before processing your request. Requests are free of charge; unreasonable or repetitive requests may incur a reasonable fee.

You have the right to lodge a complaint with the relevant data protection authority. In Pakistan: the National Commission for Personal Data Protection (once established under PDPA 2023). In the EU/UK: your local supervisory authority. We encourage you to contact us first so we can resolve your concern directly.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These include: encrypted email communications, secure file storage with access controls, and restricted access to personal data on a need-to-know basis.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by PDPA 2023 Section 19 and GDPR Article 33. We will also notify affected individuals without undue delay where the breach is likely to result in high risk.

We take reasonable steps to ensure that third-party service providers who process data on our behalf maintain appropriate security standards. However, no internet transmission is completely secure. While we strive to protect your data, we cannot guarantee the absolute security of information transmitted to our website.

All projects require a non-refundable 50% deposit of the agreed total fee before work begins. The deposit confirms your project booking and allows us to allocate studio resources. No design or development work commences until the advance payment is received and cleared.

The remaining 50% is due upon completion of the project and your approval of the final deliverables. Access to the GitHub repository, live deployment credentials, and all final assets are released only after the final payment has been received in full and cleared.

We accept bank transfers (IBAN/SWIFT), PayPal, and Wise. Invoices are issued in GBP (£) by default. International clients may request USD or EUR invoicing at the prevailing exchange rate on the invoice date. All invoices are due within 7 calendar days.

Payments not received within 14 days of the invoice due date will incur a late payment charge of 5% of the outstanding balance per week. We reserve the right to suspend project work and withhold deliverables until all outstanding amounts are paid in full.

If a client cancels after work has commenced, the 50% advance payment is non-refundable as it compensates for time and resources already allocated. Cancellations before project commencement may receive a full or partial refund at our discretion. Requests for refunds must be submitted in writing to buttwarraichjuttstudio@gmail.com.

We do not withhold source code. Every project is delivered with complete, unencrypted source code. You receive full ownership of the code we write for you upon receipt of final payment.

All source code is delivered via a private GitHub repository. Upon final payment, you are transferred ownership (or admin access) to the repository. The repo includes: full source code, configuration files, README documentation, deployment instructions, and .env.example files.

Upon receipt of full and final payment, all intellectual property rights in the delivered work including copyright in the code and design are assigned to you, the client. This assignment is worldwide, perpetual, irrevocable, and royalty-free. Until final payment is received, all IP remains the property of ButtWarraichJutt Studio.

We retain the right to display completed projects in our studio portfolio and on social media, unless you request confidentiality in writing before project commencement. We will not publish work until the project is publicly live or you grant explicit permission.

Our projects make use of open source software (e.g. Next.js, React, Tailwind CSS). These remain governed by their respective open source licences. We will document all third-party dependencies and their licences in the delivered project README.

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at buttwarraichjuttstudio@gmail.com and we will delete it promptly.

Individuals between 13 and 18 years of age may use our services only with the explicit consent of a parent or legal guardian. By submitting an enquiry or entering into a contract, you confirm that you are 18 or older, or that you have obtained the required parental consent.

We may update this Privacy Policy and Terms from time to time to reflect changes in our practices, new legal requirements, or regulatory guidance. The 'Last Updated' date at the top of this page indicates when the policy was last revised.

For material changes that affect how we process your personal data, we will notify you by email (if we hold your email address) and/or by displaying a prominent notice on our website. Your continued use of our website or services after notification constitutes acceptance of the revised policy.

Previous versions of this policy are available on request by emailing buttwarraichjuttstudio@gmail.com. We retain previous versions for a minimum of 3 years.