The lawful basis on which we use your data

We only use your personal data where we have a lawful basis to do so:

Consent where you have agreed to a specific purpose (for example, subscribing to our newsletter or accepting non-essential cookies)

Contract where processing is necessary to deliver the services you have engaged us for

Legitimate interests where processing supports normal business activity that does not materially impact your rights (for example, responding to inquiries, business-to-business direct marketing, and analytics)

Legal obligation where processing is required by law (for example, keeping tax records)

You can withdraw consent at any time using the details in Section 8.0 or the unsubscribe link in any marketing email.

What information we collect and how we use it

Information you provide directly

When you contact us, book a call, submit a form, subscribe to our newsletter, or apply for a job, we collect the information you share, including your name, email address, phone number, company, job title, and any details you include in your message or application.

We use this to respond to inquiries, schedule and conduct calls, deliver projects we've been engaged for, send invoices and project communications, review job applications, and send marketing where you have consented or where we have a legitimate business interest.

Information collected automatically

When you visit the Website, we collect technical information through cookies and similar technologies, including your IP address, browser type, device information, referring website, pages visited, time spent on pages, scroll depth, and interaction events. We use this to administer and improve the Website, understand how visitors use our content, measure content performance, and detect fraud or abuse.

Information from third parties

We may receive information about you from Cal.com when you book a call, from Apollo.io and Hunter.io as part of our business-to-business direct marketing, from LinkedIn (through the LinkedIn Insight Tag with your consent, and through your public LinkedIn profile), and from publicly available business sources.

Apollo and Hunter act as independent controllers when sharing contact information with us. To exercise rights against their databases, contact them directly via Apollo's Privacy Policy and Hunter's Privacy Policy. We do not contribute your data to their databases.

• Administer, secure, and improve the Website

• Understand how visitors use our content

• Measure the performance of our articles, case studies, and outreach

• Identify browsing patterns and improve user experience

• Detect and prevent fraud, abuse, and technical issues

→ How we use cookies and tracking technologies

We use strictly necessary cookies for core Website functionality, analytics cookies (Google Analytics via Google Tag Manager) to understand how visitors use our content, and marketing cookies (LinkedIn Insight Tag, with your consent) to measure marketing performance.

You can manage cookie preferences through our cookie banner or your browser settings. Our Website recognizes the Global Privacy Control (GPC) browser signal and treats it as a request to opt out of the sale or sharing of personal information under applicable law.

Who we share your personal data with

We do not sell your personal information

We share personal data with the following service providers who process it on our behalf under contract:

• Google Workspace, Google Analytics, and Google Tag Manager

• Cal.com (booking)

• LinkedIn (Insight Tag and advertising)

• Slack (internal communications)

• Payment processors (for invoicing)

Each has its own privacy policy that we recommend reviewing.

We may also share your personal data with regulators, law enforcement, or authorities where legally required, or in connection with a merger, acquisition, or sale of assets.

How we handle international transfers of your data

Outcraft is registered in the United States and our team operates from Pakistan, with clients and service providers around the world. Your personal data may be transferred to and processed in countries other than your own, including the United States and Pakistan.

Where personal data is transferred from the European Economic Area, United Kingdom, or Switzerland to a country not deemed to provide adequate protection, we implement appropriate safeguards including Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Agreement.

How long we keep your personal data

We keep your personal data only for as long as we need it for the purposes described in this Policy, or as required by law. Specifically:

• Website analytics: 14 months (Google Analytics setting)

• Inquiry and prospect data: up to three years from last interaction

• Job applicant data: up to two years after application

• Client project data: duration of engagement plus seven years for tax and legal records

• Newsletter subscribers: until you unsubscribe

You can request deletion of your data at any time using the details in Section 8.0.

The rights you have over your personal data

Depending on where you live, you have the following rights regarding your personal data:

• Access the personal data we hold about you

• Correct inaccurate or incomplete data

• Delete your personal data where we no longer need to process it

• Restrict or object to our processing, including for direct marketing

• Data portability, where you can ask us to transfer your data to another controller

• Withdraw consent at any time where processing is based on consent

• Not be subject to solely automated decision-making that produces significant effects

• Lodge a complaint with your data protection authority

For California residents (CCPA/CPRA): you have additional rights to know what personal information we collect, to opt out of the sale or sharing of personal information (we do not sell your information; we may "share" it in limited circumstances for cross-context behavioral advertising through the LinkedIn Insight Tag, which you can opt out of), to limit the use of sensitive personal information, and to appeal a denial of your rights.

For residents of Colorado, Connecticut, Virginia, Texas, Utah, Oregon, Montana, and other US states with comprehensive privacy laws: you have similar rights under your state's law. Contact us to exercise them.

To exercise any of these rights, contact us using the details below. We will respond within the time required by applicable law, typically within 30 days.

How we protect your personal data

We take reasonable steps to protect your personal data, including secure storage, encryption in transit and at rest where appropriate, access controls, and working only with service providers that meet appropriate security standards. No system is completely secure. If we become aware of a personal data breach likely to result in risk to your rights, we will notify affected individuals and authorities within the timeframes required by applicable law.

Our Website and services are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

For questions, complaints, or to exercise any of your rights, contact us:

Email:hello@outcraft.agency (please put "Privacy Request" in the subject line)
‍Post: Outcraft, 5900 Balcones Dr, Ste 17270, Austin, Texas 78731, United States

If you are not satisfied with our response, you have the right to lodge a complaint with your data protection authority.