Privacy Policy

Who controls your data

This site and everything on it is run by Mohamed Abu Khadra, writing and publishing as an individual author. For UK/EU data protection purposes, Mohamed Abu Khadra is the “data controller” for the personal data described below. You can reach him at mo@mohamedabukhadra.com.

Information We Collect, and Why

1. Newsletter and free-guide subscribers

When you sign up for the newsletter, or ask for a free guide or pack by email (one of the help packs, or the Reset chapter), I collect your email address and, optionally, your name, so I can send you what you asked for and, if you agree, occasional updates after that. The packs and the Reset open on the page after you give your email; the box for occasional updates is separate, is never ticked for you, and the pack opens whether or not you tick it. The Puppy Starter Pack on the Before page and the Printable Pack on the After page need no email: they open on the page.

The Family Readiness Test works the same way. Your answers stay in your browser; with your email address I save only the result (Let’s get the puppy, Maybe later or Not for us) and its score, so I know which of the three came up.

Lawful basis: your consent — given by submitting the form. You can withdraw it at any time (see “Your Rights” below).

Retention: kept for as long as you stay subscribed. If you unsubscribe, your address is kept on a suppression list (marked inactive, not deleted) so that I don’t accidentally email you again — you can ask for full deletion instead at any time.

2. The professional outreach list

Separately from the newsletter, I sometimes write directly to dog trainers, behaviourists, shelter and rescue staff, and similar professionals about free resources relevant to their work (for example the packs at /help).

Source: for this list, I only use a name, professional role, organisation, and business contact details that your own employer or organisation has already published on its own public website (for example a “team” or “contact” page) — never anything scraped from a private or paywalled source, and never a personal or home address.

Purpose: a small number of relevant, one-to-one professional emails — not a bulk marketing blast, and not shared or sold to anyone else.

Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR) — reaching out, business to business, using contact details you or your organisation chose to publish, for a purpose closely related to your professional role. I’ve judged this against the impact on you: the volume is low, the content is relevant to your work, and opting out is a one-line reply.

Retention: up to 24 months from the last time I contacted you, after which your details are deleted from this list unless you’ve engaged with it (replied, or subscribed to the newsletter separately). This site had no previously documented retention rule for this list; 24 months is the period I’m committing to now.

Your right to object and be removed: you can object to being on this list at any time, for any reason, and I will remove you — no questions asked. Reply to any email from the list, or write to mo@mohamedabukhadra.com with “remove me” and the address I used.

3. Site analytics and cookies

There are two kinds of counting on this site, and the difference between them is your consent.

Without any choice from you: each visit to this site is added to an anonymous tally, and so is every pack page, pack file opened from a pack page, buy link and unsubscribe. My server makes the count from the request your browser already sent, the way any web server does, and stores nothing on your device: no cookie, no local storage, no tracking script. For each page your browser asks for afresh (the first page of a visit, a reload, a link opened in a new tab) it records which page, the campaign code in the link if there is one (for example ?src=; a code names a channel or a batch, never a person), the country (my host works it out from your connection), the website you came from, the kind of device and browser (phone, tablet or computer; Chrome, Safari and so on) and the hour it happened. Pages you open by clicking inside a visit are not counted. It does not keep your IP address or your browser’s full details. To count how many different people come in a day, the server turns your IP address and browser details into a short code with a secret key that is made fresh each day and deleted early the next morning (within about 27 hours; copies in my hosting provider’s backups can last a little longer); only the code is kept, for the statistics, and once the key is gone the code cannot be traced to anyone. Nothing that follows you from one day to the next is kept. My hosting provider, Vercel, keeps ordinary server logs of requests, which include IP addresses, for security and operations. Crawlers and scripts that identify themselves are not counted. A browser that sends Global Privacy Control or Do Not Track is counted only as one more page load on the pages of the site, with no country, source, device or daily code, and is not counted on pack pages, buy links or unsubscribes. When you send a sign-up form or ask for a pack, the server also records what you asked for (which form or pack, whether a box was ticked and, for the readiness test, the result and score) with the date and time, kept with your sign-up. That record is the proof of what you asked for and of whether you agreed to updates, so it is part of the service and is not switched off by a browser signal. The lawful basis for these tallies is my legitimate interest in knowing how many people visit, which pages are used and which links work. You can object at any time: send Global Privacy Control or Do Not Track, use the button below, or write to me.

Do not count my visits on this browser

Only if you accept in the banner: counting visits. A random ID is kept in your browser’s storage. It holds no name or email, but it recognises this browser when it returns, so it counts as personal data under UK and EU law. Against that ID the site records the pages you open (and the first and last page of each visit), how far you scroll, how long you stay, links you follow out of the site, files you download, which buttons you press (downloads, the copy buttons, the speaking enquiry form being sent), the campaign tags in the link you arrived by, your country, your device type and browser type, and the website you came from. That is how I learn how many people read what. I never receive your name or email from it, and I do not join it to your sign-up. If you reject, or have not chosen, none of this runs and nothing is stored on your device (the anonymous tally above still counts the page load). If your browser sends Global Privacy Control or Do Not Track, I treat that as a no and do not ask. The lawful basis is your consent.

Third-party tools: this site does not currently use Google Analytics, Microsoft Clarity or any advertising tool. If I add one, it will load only after you accept, you will be asked again, this section will be updated first, and Google’s Consent Mode will be told your choice.

You can change your mind at any time with Cookie settings in the footer; withdrawing deletes the ID this site stored in your browser. Your choice is remembered for up to 180 days (Safari may delete what a site stores sooner, after 7 days without a visit, and then you will be asked again). Analytics records are deleted after 14 months; the sign-up counters are kept with the subscriber records.

What this site stores in your browser:

• kh_consent (a cookie and local storage, up to 180 days): your cookie choice. Essential.
• mak_vid (local storage, until you withdraw or clear it): the random ID. Analytics, only if you accept.
• mak_sid, mak_first, mak_landing (session storage, until you close the tab): the current visit. Analytics, only if you accept.
• kh_unlocked (a session cookie and session storage, until you close the browser): a single “1”, set after you give an email address for a pack, so that the next pack you open in the same visit does not ask again. It holds no address and no ID and is not used for counting. Essential to the service you asked for.
• mak_notrack (a cookie and local storage, one year): only if you press “Do not count my visits” above or open the site with ?notrack=1. A plain “1” that tells this site not to count this browser.
• Cloudflare Turnstile (a third party, on pages with a form): the spam check, described below.

4. Speaking enquiries

If you send the speaking enquiry form, I collect the name, email, organisation and event details you enter, to reply to you and plan the event. The lawful basis is taking steps at your request, and my legitimate interest in running the speaking work. It is stored in the site database (Vercel), and the notification email to me passes through Resend. I keep it for as long as it takes to reply and plan the event, and no longer than 24 months after our last contact, then delete it. You can ask me to delete it sooner (see Your Rights).

Who processes your data

I don’t sell, rent, or share your personal data. A small number of specialist services process it on my behalf, strictly to run the site:

• Vercel — hosting, and the Postgres database that stores subscriber and outreach-list records.
• Resend — sends the emails you ask for or agree to: the email that carries a pack’s link, the welcome email after a newsletter sign-up and, if you ticked the box, occasional updates.
• Cloudflare Turnstile — a spam and bot check on the forms, so the mailing list isn’t filled with junk sign-ups. While a form is on the page it receives your IP address, your browser details and a technical fingerprint of how the browser behaves, to tell people from bots, and Cloudflare also uses those signals to improve its own bot detection (it is responsible for that part; see Cloudflare’s Turnstile privacy addendum). It runs only on pages that have a form.
• Optional analytics/advertising tools (see above) — only when configured and only after you accept cookies for that category.

Data Storage and International Transfers

This site is hosted on Vercel, and subscriber and outreach-list records are stored in a Postgres database provisioned through Vercel’s infrastructure. That database is hosted in Frankfurt, Germany.

Some of the processors above (including Vercel and Resend) may process data outside the UK and EU, including in the United States. Where that happens, it relies on that provider’s own standard contractual safeguards for international transfers. I don’t control those safeguards directly, but I only use providers who publish them.

Your Rights

Under UK/EU data protection law, you have the right to:

• ask what personal data I hold about you, and get a copy of it;
• ask me to correct or delete it;
• object to how it’s used (including the outreach list above, or the newsletter);
• withdraw consent at any time, where consent is the basis for processing;
• complain to a regulator if you think I’ve got this wrong.

For any of the above, email mo@mohamedabukhadra.com and I’ll take care of it promptly — usually within a few days, and always within the legal time limit. Every newsletter email also includes a one-click unsubscribe link, so you can opt out of that list without contacting me at all.

If you’re in the UK and you think I haven’t handled your data properly, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. I’d appreciate the chance to put it right first, but that right is yours regardless.