Privacy Policy

We collect contact details you provide directly — name, work email, company, and the message content — when you book a consultation, email us, or submit a form. For active engagements, we receive operational data necessary to perform services: supplier records, contracts, payment details, and similar business documentation.

We also collect limited technical data automatically when you visit the site, including IP address, user agent, referring URL, and pages viewed, for security and analytics.

We use personal data to respond to enquiries, deliver contracted services, manage billing, meet legal and tax obligations, secure our systems, and improve the website. We do not sell personal data and do not use client operational data for marketing.

Where GDPR or equivalent law applies, we rely on legitimate interests (responding to enquiries, securing our site), contract performance (delivering engagements), and legal obligation (records and tax) as the bases for processing.

We share information only with vetted subprocessors who support our operations — including infrastructure, email, scheduling, and accounting providers — and with authorities where required by law. A current list of subprocessors is available on request for clients under engagement.

Hampala operates internationally. Where data is transferred outside its country of origin, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

We retain personal data for as long as necessary to deliver services, meet legal and tax obligations (typically up to seven years for financial records), and resolve disputes. Enquiry records are deleted within 24 months of the last interaction unless an engagement begins.

You may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. To exercise these rights, email hello@hampala.com. You also have the right to lodge a complaint with your local data protection authority.

We maintain administrative, technical, and physical safeguards designed to protect personal data — including encrypted transport, least-privilege access, MFA on internal systems, and vendor due diligence. See our Security page for more detail.