Privacy

Who is responsible for your data

I am Jamil Abduljalil, sole trader, trading as OwnerKit from Ghana. I am the data controller for everything described on this page. Postal address: P.O. Box DTD 4026, Accra, Ghana. You can reach me through the contact form, which comes directly to me.

Data you give me

When you buy, the checkout runs on Gumroad. Gumroad collects your email address and your payment details under its own privacy policy and acts as the merchant of record; I never see your card number. Gumroad shows me your email address, what you bought, when, and the country the tax was worked out for, which is what I need to answer a question or issue a refund. I collect your email address directly only when you join a list on this site — the free worksheet, or the “keep me posted” box under the free workbook — and I use it for exactly that: the file you asked for, and occasional updates you can stop with the unsubscribe link in any message. An address on a list is kept until you unsubscribe, and for six months after that on a suppression list so you are not added again by mistake. The sign-up form also checks your IP address in memory for a few minutes to limit repeat submissions; it is not written down. When you send a message through the contact form I store the message, your address, and a salted one-way hash of your IP address to prevent abuse; the hash cannot be turned back into an address, and messages are cleared on a rolling basis. The legal basis is performing our contract for anything you bought, and your consent for anything you opted into.

The free workbook download counter

Each download of the free construction workbook adds one to a counter, filed under the page it was downloaded from (the demo page, or one of its copies used in LinkedIn, Facebook, Reddit and advertising links). The counter stores a timestamp and the page name, and nothing else: no cookie, no device identifier, no IP address, no user agent. It tells me how many people took the file from where; nothing in it identifies anyone, and I do not combine it with anything else.

If I contacted you and you did not give me your details

If you received an email or a LinkedIn message from me that you did not ask for, this section is the notice you are owed under Article 14 of the UK and EU GDPR, and it explains where I got your details.

• What I hold: your name, your role, your company, your country and — for email — a business email address. On LinkedIn, I keep your name, company and country in a private tracking sheet, and nothing from your profile beyond that. No special-category data.
• Where it came from: business contact details published by you or your employer — a company website, your professional profile, or a trade directory. The specific source is named in the message itself. I do not buy lists and I do not scrape.
• Why: to ask whether a workbook I built for construction businesses is useful to you or your clients, and to ask what is wrong with it. The legal basis is legitimate interests — mine in finding the small number of people this is genuinely relevant to, weighed against your interest in not being interrupted, which is why the list is small, hand-built, role-relevant, and stops the moment you say so.
• How long: until you ask me to stop, or six months after the last contact, whichever comes first. If you opt out, I keep your address on a suppression list — and nothing else — so that you are not contacted again by mistake.
• Your right to object: you can object at any time, for any reason or none, and I must stop. Reply “no” or “remove” to any message, or use the contact form. One word is enough and you do not owe me an explanation.
• Where the data is: I am established in Ghana and I collect and hold the data there directly, so this is not a restricted transfer out of the UK or the EU — there is no exporter established in either. Ghana has no UK or EU adequacy decision. The data is a business email address and a job title, held by one person, alongside the providers named below.

On UK and EU representatives: a controller outside the UK or the EU has to appoint a representative there unless its processing of UK or EU data is occasional, low-risk and does not involve special-category data on a large scale. OwnerKit is one person selling a spreadsheet, and the data is a business email address and a job title — so I have not appointed one, and this sentence is here so that you know the position rather than having to guess it. If you think that is wrong, write to me and say so.

Who else touches it

Gumroad (Gumroad, Inc., United States) is the merchant of record and handles your purchase as a controller in its own right, under its own privacy policy: it holds your payment details, delivers the files and processes refunds; I never see your card. Two providers process data on my behalf. Netlify hosts the site and stores the subscriber addresses, the contact-form messages, the download counter and the records of orders placed through the earlier card checkout. Google is the email provider: contact-form messages and order notifications are relayed through a Google Apps Script into a Gmail inbox, so that they reach a mailbox I can answer from. An order record holds your reference, your email address, what you bought, the amount, when you paid and when you first downloaded — kept for seven years, because tax records have to be.

Your rights, whichever way I got your data

You can ask me for a copy of what I hold, ask me to correct it, ask me to delete it, ask me to restrict what I do with it, or object to it — through the contact form. I answer within one month. I do not sell your data, and I share it only with the providers named above. There is no automated decision-making. If you are unhappy with how I have handled it you can complain to your national data protection authority: in the UK that is the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/, and in the EU it is the supervisory authority for your country.

Cookies and tracking

This site sets no analytics cookies, no advertising pixels and no third-party trackers, and the download counter above uses none of them. When you follow a buy button to Gumroad, your browser tells Gumroad only that you came from this site’s address — not which page, and nothing about you. If any of this ever changes, a consent banner will appear before anything is set, and this page will say so.