Privacy Policy
What happens to the data you send through this website, who sees it, and how to have it deleted.
Last updated: 14 September 2026
Written for the Republic of Kazakhstan Law No. 94-V on personal data and its protection. It describes what actually happens, not what sounds good. If a sentence stops being true, we change the sentence.
1. Who we are
The operator of your personal data is Northhold Advisory LLP, business identification number (BIN) 260540009757, registered in Astana, Kazakhstan. Any question about your data goes to hello@northholdadvisory.com. We will send our postal address on request.
2. What we collect
From the form: your name and work email, which are required because there is no way to answer you without them, plus phone or WhatsApp, company, role, jurisdiction and your message if you choose to fill them in. Everything except the name and the email is optional, and leaving a field empty changes nothing about how we answer. After that, whatever you tell us in the correspondence.
The site has no cookies at all, no advertising trackers, no registration and no payments. It stores nothing in your browser and loads fonts from its own domain. The only external request is a cookieless counter, Cloudflare Web Analytics, which reports page views, referrer, country and device type in aggregate and does not identify you. That is why you see no cookie banner here, there is nothing to ask you about.
3. Why, and on what basis
The only purpose is to answer your enquiry and, if it goes further, to agree the scope of work. No mailing lists, no advertising, no sharing with anyone for money. The basis is your consent, given by the tick box in the form (article 8), together with the steps taken at your request before a contract.
4. Where the data goes
The form is received by a handler on our hosting that checks the fields, sends us an email and keeps no copy: it writes to no database. So the enquiry lives in one place only, our mailbox, and on our side only the founder reads it.
The companies that carry the letter are outside Kazakhstan: Netlify (hosting and the handler) and the mail provider that holds our mailbox. Article 16 allows this transfer with your consent, which is why the consent text in the form says so plainly instead of hiding it here. If you write to us on WhatsApp instead, that conversation lives with the messenger, on Meta servers outside Kazakhstan, under their own rules; we use it for short questions and keep documents to email. If you would rather your data stayed in the country, write to us from your own mail and share only what suits you.
5. How long we keep it
If the conversation does not turn into work, we delete the enquiry and the correspondence within twelve months of the last letter, and we clear the mailbox once a year. If we do work together, project documents are kept for as long as the contract and the rules for such documents require. You can ask for deletion sooner at any time.
6. Your rights
Under article 24 you may find out what we hold about you, have it corrected, blocked or destroyed, object to the processing and withdraw your consent. One address for all of it: hello@northholdadvisory.com. A plain letter is enough, no special form.
Our deadlines: receipt confirmed within one business day; correction or blocking within one business day of your demand, as the law requires; destruction within ten business days, with a note telling you it is done. Withdrawing consent needs no reason and costs nothing. If you are in the EU or the UK, the GDPR gives you the same rights plus portability and a complaint to your supervisory authority; use the same address.
7. Protection and changes
The site works over an encrypted connection with HSTS, the letter travels encrypted, every account in the chain has two-factor authentication, and access belongs to one person. We ask for the minimum and keep it for the minimum, which is the part of protection that works best. Everything you write is confidential from the first letter, before any contract, and we are glad to sign an NDA.
When the way we handle data changes, this page changes with it and the date at the top moves. A consent already given covers the version in force when you gave it; if a change affects you, we ask again rather than assume.