Popular searches

ENIGMADIGITAL MARKETING & IT SOLUTIONS

Howdy!

Enigma delivers end to end IT solutions that help businesses grow, scale, and thrive in the digital era.

Enigma
Enigma
Enigma
Enigma
Enigma

Get in touch

CLOSE

Privacy policy

Updated 12 October 2026. Enigma Marketing is operated by Syed Ahmed Imam Hashmi, an individual service provider based in Sindh, Pakistan. Privacy contact: [email protected], or our request form.

Data and purposes

  • Enquiries: name, email, optional phone, service and message to respond to your request.
  • Orders: contact and confirmed billing country, scope, optional tax identifiers, bank references and payment documents for service delivery and reconciliation. These are not marketing subscriptions.
  • Security: Cloudflare and Turnstile process network/browser information to protect the site. IP-derived country helps pricing and disclosures; we do not store raw IP in the marketing register, collect GPS or create device fingerprints.
  • Cookie evidence: random preference ID, choices, version, server time, page path without query parameters and Global Privacy Control. Short-lived keyed network hashes limit abuse, not advertising.
  • Optional Email and WhatsApp: voluntary contact details and separate permissions. Email requires ownership confirmation; WhatsApp requires documented inbound confirmation. Cookie acceptance, enquiries and orders do not subscribe you.
  • Optional measurement, only with the relevant choice and enabled integration: Google measures public-page visits, enquiries and confirmed purchases. Meta may receive public activity and a hashed email for enquiries and bank-confirmed purchases. Hashes remain personal data; private payment links, tax IDs, bank documents and enquiry text are excluded.

Legal bases and controls

Requested pre-contract steps and contracts support service processing; applicable legal duties support financial records; necessary security uses legitimate interests or other applicable lawful bases. Our global baseline requires separate consent for optional analytics, advertising and marketing. Refusal does not prevent service access. . Global Privacy Control disables advertising.

Providers and international processing

The initial optional-measurement rollout is limited to Pakistan-detected traffic with the relevant permission. Other regions remain paused while applicable provider and transfer arrangements are reviewed. IP country is an operational signal, not proof of legal residence.

Cloudflare hosts and protects the site, including Turnstile. TiDB Cloud stores orders and a separate consent/marketing register; the latter is on the enigma-marketing cluster in Singapore. Google Drive/Sheets hold restricted operational copies. Resend sends transactional and confirmation emails. Google Analytics, Google Ads, Meta and blog-only AdSense are optional integrations, subject to account and consent review. Providers may process data in other countries.

Published terms alone do not establish every required transfer safeguard. We review applicable contracts, provider roles, regions, subprocessors and lawful transfer arrangements before enabling optional advertising or marketing delivery. Contractual safeguards and transfer assessments may be required. We do not claim consent alone or unverified SCCs make every transfer lawful.

Retention and deletion

  • Website enquiry KV records expire after 90 days. Staff mailbox copies require separate review; website jobs cannot erase mailboxes automatically.
  • Cookie permissions last 180 days. Choice evidence is kept up to 24 months. Expired permission cannot authorise tracking; expired preference rows are purged within the evidence review window.
  • Unconfirmed marketing contacts: 7 days. Verified contact eligibility: up to 24 months without renewed consent. Withdrawn contact details: 30 days. Minimal keyed suppression entries remain to prevent unwanted re-subscription and never permit campaigns.
  • Marketing consent evidence: 24 months. Verification tokens: 48 hours; used/expired tokens are purged. Abuse-limit hashes: 2 days.
  • Resolved rights requests: 90 days unless necessary legal hold. Database deletions and withdrawals overwrite the limited private Sheets mirror.
  • Financial/tax records are reviewed against applicable accounting, tax and dispute obligations. Marketing withdrawal does not erase required records. Mailbox, Drive, backups and provider-held copies need coordinated deletion review.

Rights and complaints

Depending on applicable law, request access, correction, deletion, restriction, portability, objection or consent withdrawal via the form or email. We verify identity proportionately, respond within applicable deadlines, and explain necessary retention exceptions. You may complain to your competent authority. Do not send identity documents unless specifically requested securely.

Direct marketing

Email and WhatsApp choices are separate. Unsubscribe using the email link, reply STOP on WhatsApp or contact us. Verified withdrawals suppress future campaigns. Marketing delivery stays disabled until sender and regional obligations are reviewed. Required postal details appear in marketing emails themselves; an invoice-only address is insufficient. Cookies cannot reveal an unknown visitor’s email or phone.

Children and changes

Services and marketing are intended for adults; we do not knowingly profile children for ads. Material optional-purpose changes require a fresh choice. This notice describes actual controls and review requirements, not worldwide legal certification.