Who I am
IN SHORTI run this site myself, as a sole trader. I decide how your data is used, so I am the “controller”.
anwarmalik.com is run by Anwar Ul Haq Malik, a sole trader trading as Anwar Malik, based in England.
If you live in Ireland or elsewhere in the EU, you can also contact my EU representative about anything in this policy. I have not appointed a Data Protection Officer, because the law does not require one for a business of this size and type. You can reach me directly on the email above.
TownsConnect is run by a separate company, Digital Towns® Ltd, which has its own privacy policy at townsconnect.com. This policy does not cover TownsConnect.
What this policy covers
This policy covers anwarmalik.com and everything you do on it:
- reading pages and articles
- asking questions through Ask Anwar, Ask this post and the FAQ
- joining the newsletter or getting the playbook
- sending a speaking invite or a Work with me brief
- signing up for, paying for and using the From MSc to Market playbook membership
- emails I send you
It applies to people in the UK under UK GDPR and the Data Protection Act 2018, and to people in Ireland and the rest of the EU under the EU GDPR.
What I collect, why, and for how long
IN SHORTOnly what I need for the thing you asked for. Each use has a legal basis and a time limit.
The law needs a “lawful basis” for each use of your data. The ones I rely on are: your consent; a contract with you, or steps you asked for before one; a legal obligation; and my legitimate interests, where I have checked they are not outweighed by your rights.
Please do not send me health information or other sensitive details in a brief, question or exercise. If you do, I will only use it to reply to you, and I will delete it when I no longer need it.
AI on this site
IN SHORTWhen you are talking to AI, the site tells you. AI drafts, a person decides.
- You are told when it is AI. Ask Anwar, Ask this post and Ask the Playbook are AI systems, and they are labelled as AI wherever they appear, as Article 50 of the EU AI Act requires.
- Answers come from this site. They answer from published pages, verified FAQs and case studies, and say so when they cannot find an answer.
- Where your question goes. Your question is sent to Microsoft's Azure OpenAI service to write the answer. Microsoft processes it under a data processing agreement and does not use prompts to train its models.
- Why questions are logged. I keep questions and answers for 12 months, so I can spot mistakes, stop misuse and turn common questions into reviewed FAQ answers. They are not linked to your name unless you give it.
- Behind the scenes. Assistants help me sort briefs and invites and draft replies and FAQ answers. A person reviews everything before it is sent or published.
- No automated decisions. No decision with a legal or similarly significant effect on you is made by automated means alone.
Please do not type personal or confidential details into the AI features.
Cookies and similar technologies
IN SHORTNo advertising or tracking cookies. Only what the site needs to work, and your own display choice.
Cookies and similar technologies, such as browser storage, save small pieces of information on your device. In the UK they are covered by the Privacy and Electronic Communications Regulations (PECR). In Ireland they are covered by the ePrivacy Regulations 2011.
Analytics. The site does not use analytics cookies at the moment. If I add them, I will update this table first, and:
- UK visitors: first-party analytics used only to count visits and improve the site may run without asking first, as the Data (Use and Access) Act 2025 now allows. I will tell you, and give you a clear, easy way to turn them off.
- Visitors in Ireland and the EU: analytics run only if you say yes.
Strictly necessary cookies do not need your consent. You can block cookies in your browser, but signing in and payment will then stop working.
Who I share it with
IN SHORTA few trusted providers that run the site for me. I never sell your data.
These providers are “processors”. They only use your data on my instructions, under written contracts:
Stripe also acts as a separate controller for some purposes, such as fraud prevention and its own legal duties. Its own privacy policy covers that use.
I may also share data with professional advisers, such as an accountant or solicitor, under a duty of confidence, or when the law requires it.
Where your data is stored
Your data is stored in Microsoft Azure data centres in the UK (UK South) and Ireland (North Europe).
- Between the UK and the EU. Data can move freely under adequacy decisions. The European Commission renewed the UK's adequacy decision in December 2025, until 27 December 2031.
- Outside the UK and EU. Some providers, such as Stripe or Microsoft support teams, may access data from other countries, including the United States. When that happens, I rely on one of these safeguards:
- the UK International Data Transfer Agreement or Addendum
- the EU Standard Contractual Clauses
- the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified
You can ask me for a copy of the relevant safeguard.
Your rights
IN SHORTAsk me to see, correct, delete or stop using your data. It is free, and I reply within one month.
Use the form at the end of this page, or email me. I reply within one month. For complex requests, I can extend that by up to two more months, and I will tell you why.
I may ask for proof of who you are, but only if I need it. Some rights have limits. For example, I have to keep payment records for tax purposes. If I cannot do what you ask, I will explain why and tell you how to complain.
Complaints
If you are unhappy with how I have used your data, please tell me first, using the form below or by email. I will:
- acknowledge your complaint within 30 days
- look into it without undue delay
- keep you updated
- tell you the outcome
You can also complain to a regulator:
In the UK, the ICO will usually expect you to have raised the complaint with me first.
Emails
I only send the newsletter if you sign up for it. Every email has a one-click unsubscribe link. After you unsubscribe, I keep your email address on a “do not send” list, so I can respect your choice.
Members also get service emails, such as receipts, renewal reminders and review notices. These are part of the membership, so you cannot switch them off while you are a member. The weekday study reminder is optional, and you can turn it off in your account.
Children
The site is meant for adults, students and organisations. It is not aimed at children.
- You must be 16 or over to create an account or join the newsletter.
- You must be 18 or over to buy a plan.
If I learn that I hold data about a child under 16 without a parent's consent, I will delete it.
Keeping your data safe
These are the main protections:
- Data is encrypted in transit and at rest.
- The admin area is invite-only.
- Access is limited by role.
- Every admin action is recorded in an audit log.
- Multi-factor sign-in for admin accounts.
If a breach puts your rights at risk, I will tell the ICO and, where needed, the Data Protection Commission, within 72 hours. If the risk to you is high, I will tell you too.
Changes to this policy
When I change this policy, I update the date and version number at the top of the page. If a change affects members in a significant way, I will email them before it takes effect.
Make a request or complaint
Use this form for any privacy request or complaint. I read every one myself.
See also the Terms of use and sale.