Privacy Policy
What we collect, why we collect it, and what you can do about it. Written so you can actually check whether you are comfortable with it.
The short version
If you just read our guides, we collect anonymous usage data through Google Analytics and Microsoft Clarity, and nothing else. Clarity records how you move around a page, so if you are in the UK or EU it only loads after you accept cookies. If you fill in a form, we get your name, email and whatever you write, and we use it to reply to you. If you become a client, we hold the business information needed to do the work. We never sell your data and we do not run advertising on this site.
The detail below explains each of these properly, including how to get your data deleted.
The organisation responsible for your data
Evariko is a digital marketing agency operated by Khairuzzaman Sharia Mondol from Dhaka, Bangladesh. We serve clients in the United Kingdom, United States, Canada and Europe.
For the purposes of UK and EU data protection law, Evariko is the data controller for information collected through evariko.com and through our dealings with you. That means we decide what is collected and why, and we are the ones you hold accountable for it.
You can reach us at sharia@evariko.com or +880 1999 282277 about anything in this policy.
Why a Bangladeshi business follows UK and EU rules
Because you are covered by them wherever we happen to sit. If you are in the UK or EU, GDPR applies to your data regardless of where the company processing it is based. We have written this policy to that standard and apply it to everyone, not only European visitors.
The information we hold, and where it comes from
We do not collect special category data (health, ethnicity, political opinion, religious belief, biometrics), and we ask you not to send any to us. We do not store payment card details ... payments run through bank transfer or a payment provider, and the card data never reaches us.
What runs on this website
Three things touch visitor data on evariko.com. There are no advertising pixels, no retargeting tags and no data brokers.
Google Analytics 4
Tells us which pages get read, how people arrive, and what they do next. IP addresses are truncated before storage. Loads only after you accept analytics cookies.
Google Search Console
Shows us which search queries surface our pages. It reports aggregated data only ... it sets no cookies and never identifies individual visitors.
Microsoft Clarity
Records anonymised session replays and heatmaps so we can see where a page confuses people. Covered in detail in the next section.
Contact form
Sends what you type to our inbox and stores a copy in the website database. It sets one functional cookie to prevent spam submissions.
Cookie categories
- Necessary. Keep the site working, remember your cookie choice, prevent form spam. These cannot be switched off.
- Analytics. Google Analytics and Microsoft Clarity. Off by default for UK and EU visitors until you accept.
You can change your choice at any time by clearing cookies for evariko.com, or by using your browser's privacy settings to block them entirely. Blocking analytics cookies does not affect how the site works for you.
What Microsoft Clarity actually records
This one deserves a plain explanation
Clarity reconstructs a replay of your visit ... where you scrolled, what you clicked, where the cursor moved, where you stopped reading. It is not video of your screen and it does not follow you to other websites, but it is more than a page counter, so we would rather over-explain it than bury it.
What is masked. Text you type into form fields is masked before it leaves your browser. Clarity does not capture what you write in a message box, an email field or any input.
What we use it for. Finding the point where a guide loses people, spotting a button nobody notices, and catching layout problems on devices we do not own. That is the whole purpose.
Consent. For visitors in the UK and EU, Clarity does not load until you accept analytics cookies. Decline and no session is recorded.
Who processes it. Microsoft Corporation, as our processor. Their handling is governed by the Microsoft Privacy Statement.
Our lawful bases
Under UK and EU GDPR we must have a lawful basis for every kind of processing. Ours are:
Where we rely on consent, you can withdraw it at any time and it will not affect anything done before you did. Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and you can object at any time.
Our processors
We do not sell data, rent it, or hand it to advertisers. We do use a small number of service providers to run the business, and they process data on our instructions only.
We also disclose information where the law requires it, where it is necessary to establish or defend a legal claim, or to protect someone's safety. If we are ever compelled to hand over data about you, we will tell you unless we are legally barred from doing so.
If we ever bring in a new processor that handles personal data, this list is updated before it goes live.
Data leaving the UK and EU
Evariko operates from Bangladesh, which has not received an adequacy decision from the UK or the European Commission. Our processors are largely US companies with European infrastructure. So if you are in the UK or EU, your data does cross borders.
Where that happens we rely on Standard Contractual Clauses, which are built into the standard data processing terms of Google and Microsoft, and we apply the safeguards described in Section 11 to anything we hold directly.
You are entitled to ask us for detail on the transfer mechanism covering your data. Email us and we will explain it rather than send you a form.
Retention periods
- Analytics data. 14 months in Google Analytics, then deleted automatically.
- Session replays. Clarity retains these for approximately 30 days, then discards them.
- Enquiries that do not become clients. 24 months, in case you come back, then deleted.
- Client records. For the length of the engagement and 6 years afterwards, which is what financial and contractual record-keeping requires.
- Access credentials. Removed within 14 days of an engagement ending. We ask you to revoke access on your side too.
- Correspondence. 24 months after our last exchange, unless it relates to a client engagement, in which case the client record period applies.
You can ask for earlier deletion at any point, and we will comply unless a legal obligation requires us to keep something.
What you can ask us to do
Access
Ask what we hold about you and get a copy of it.
Rectification
Have anything inaccurate corrected or incomplete data completed.
Erasure
Have your data deleted where we have no overriding obligation to keep it.
Restriction
Have us pause processing while a dispute or accuracy question is resolved.
Portability
Receive data you gave us in a machine-readable format, or have it sent elsewhere.
Objection
Object to processing based on legitimate interests, and withdraw consent where consent applies.
How to exercise them. Email sharia@evariko.com. No form, no fee. We respond within 30 days, and if a request is complex enough to need longer we will tell you why before the 30 days are up.
We may ask you to confirm your identity before we act, because handing someone's data to the wrong person is the failure mode these rights exist to prevent.
When we work on your website
Delivering SEO and content work means we get access to systems that hold data about your customers ... your analytics, your Search Console, sometimes your CMS. Two things follow from that.
You are the controller, we are the processor. For your customers' data, you decide what is collected and why. We act on your instructions. If you need a formal Data Processing Agreement for your own compliance, ask and we will sign one.
We ask for the least access that works. Read-only where read-only is enough. Named accounts rather than shared logins wherever your platform supports it, so access can be revoked individually and activity is attributable.
When the engagement ends
We remove our access within 14 days and delete working copies of your data beyond what we must retain for financial records. Revoke access from your side as well ... belt and braces beats trusting either party's process.
How we protect information
- The site runs over HTTPS, so traffic between your browser and our server is encrypted.
- Two-factor authentication is enabled on our Google Workspace accounts and on the hosting and WordPress admin.
- Client credentials are stored in a password manager, never in plain text in documents or chat.
- Project data lives in access-controlled Google Workspace files, shared only with the people working on that account.
- Access is reviewed when someone joins or leaves a project, not annually.
No system is perfect and we will not claim otherwise. If a breach occurs that is likely to risk your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and tell you directly without undue delay.
Our services are not for under-18s
Evariko provides business-to-business services. Our site is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal information, email us and we will delete it.
How we handle updates
The effective date at the top of this page always reflects the current version. When a change materially affects how we handle your data ... a new processor, a new category of collection, a longer retention period ... we will say so clearly and, for clients and subscribers, tell you by email before it takes effect.
We will not quietly expand what we collect and rely on you having agreed to a policy you read once.
Common questions about your data
Do you sell my data or share it with advertisers?
No. There are no advertising pixels on this site, no retargeting tags, and no data brokers. The only companies that see visitor data are the processors listed in Section 06, and they act on our instructions.
Can I read your guides without being tracked?
Yes. Decline analytics cookies and neither Google Analytics nor Microsoft Clarity loads. Everything on the site still works. We would rather have fewer data points than readers who feel watched.
Does Clarity record what I type?
No. Text entered into form fields is masked in the browser before anything is sent. We can see that a field was filled in, not what was written in it.
How do I get my data deleted?
Email sharia@evariko.com and say so. No form, no fee, no retention team trying to talk you out of it. We respond within 30 days and delete everything we are not legally required to keep.
Will you sign a Data Processing Agreement?
Yes. If your compliance process needs a DPA before we touch your systems, send yours or ask us for ours. This is routine rather than a special request.
Where is my data actually stored?
Google Workspace and Google Analytics on Google's infrastructure, Clarity on Microsoft's, and website form submissions with our host. We work from Bangladesh, so our team accesses that data from there. Section 07 explains the safeguards covering the transfer.
Do you use AI tools on my data?
We use AI assistance in research and drafting. We do not put client credentials, customer records or any personal data belonging to your customers into third-party AI tools. Business context and public information about your market, yes. Personal data, no.
Questions about your data?
Ask us directly. If we have got something wrong, or you want something deleted, the fastest route is an email that says so plainly.
If you are not satisfied with our response
You have the right to complain to a data protection authority. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EU it is the supervisory authority in the country where you live or work. We would rather you raised it with us first, but that route is yours regardless.
© Evariko, 2026. All rights reserved. This Privacy Policy was last reviewed on 1 October 2026.