Privacy Policy

Who we are

The Shark Web is a growth marketing and engineering studio based in Dhaka, Bangladesh, serving clients in Bangladesh, the United Kingdom, the European Union, the United States, and internationally. For anything on this page, an enquiry, a data access request, a correction, or deletion, write to info@thesharkweb.com and a person on our team reads and answers it.

This policy covers this website (thesharkweb.com). It does not govern client delivery work carried out after a commercial agreement is executed; client engagements are governed by their respective signed scopes of work and contracts.

What we collect

When you send an enquiry. Your name, email address, phone number if you provide one, the service or goal you selected, and whatever you write in the message field. Alongside that, our backend stores the page you submitted it from, campaign parameters in the URL you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content), referring URL, and your IP address.

If you arrived from a Meta ad and granted cookie consent, we also store the click and browser identifiers Meta sets (fbc and fbp). These exist strictly to attribute enquiries to the campaign that produced them.

When you subscribe to the newsletter. Your email address and the page you subscribed from.

When you accept analytics. Page views, session duration, device and browser metadata, and approximate city-level location derived from your IP. None of this loads until you explicitly press ACCEPT on the consent banner. If analytics is unconfigured or declined, tracking scripts never load.

When you book a call via Cal.com. Booking links generated for invited leads pass your name and email address as query parameters (ResolvesLeadContact::bookingUrl()). This is a direct transfer of your contact details to Cal.com, Inc., who pre-fill the booking calendar under their own privacy policy.

Why we hold it and our legal basis

Under the General Data Protection Regulation (GDPR) and applicable data protection laws, we only process personal data where we have a lawful basis:

To reply to your enquiry and manage sales triage: Our legitimate interest (GDPR Art. 6(1)(f)) in answering prospective clients and maintaining an accurate record of pipeline conversations, and taking pre-contractual steps at your request (Art. 6(1)(b)).
To deliver client work: Performance of a contract (GDPR Art. 6(1)(b)) once an agreement is signed, and legal obligations for statutory accounting and tax records (Art. 6(1)(c)).
To send the newsletter: Consent (GDPR Art. 6(1)(a)), given when you submit your email in the subscription form. Every email carries an instant unsubscribe link.
To measure website traffic: Consent (GDPR Art. 6(1)(a)), granted only if you press ACCEPT on the cookie banner.
To protect site security and prevent spam: Our legitimate interest (GDPR Art. 6(1)(f)) in defending our infrastructure, enforcing rate limits, and screening automated abuse.

We do not sell personal data, and we never share it for third-party marketing.

Automated lead qualification

When you submit an enquiry through our site, our backend (LeadScoringService) performs an automated evaluation to assign an internal triage score (hot, warm, or cold) and stores the corresponding scoring reasons (score_reasons).

What is scored: The evaluation looks at transparent objective criteria: whether your email domain is a business domain rather than a consumer webmail provider, budget and investment signals mentioned in the brief, timeline urgency, and specific service scopes.

No automated legal decisions: This scoring is purely an internal triage aid to help our team prioritize response queues. It does not produce legal effects, does not reject or exclude any enquiry, and does not make automated decisions about you. Every submission is accessible to human team members and can be manually reclassified.

Who processes your data

We rely on a small set of third-party service providers to deliver the website and services. Each processor receives only the data strictly necessary for its purpose:

Resend (Resend, Inc., USA), delivers transactional emails, including enquiry auto-responders, team notifications, and booking invitations via ResendMailer.
Brevo (Brevo SAS, France / EU), manages newsletter subscriber lists and handles automated unsubscribe compliance via BrevoNewsletterService.
Cal.com (Cal.com, Inc., USA), hosts the appointment calendar, receiving pre-filled name and email attributes via the booking URL.
Meta (Meta Platforms, Inc., USA), receives conversions via the Conversions API (MetaConversionsService) and client-side pixel only when configured and consent is granted.
Google (Google LLC, USA), Google Analytics 4 and Google Tag Manager, strictly opt-in and loaded only when configured and accepted.
Hosting & Email Infrastructure, secure server and mailbox infrastructure located in Bangladesh and US data centers hosting the web application and database.

International data transfers

We rely on the safeguards our providers publish in their data processing terms: standard contractual clauses and, where the provider holds it, certification under the EU-US or UK-US Data Privacy Framework. We do not have bespoke transfer agreements of our own; ask us and we will send you the provider terms we rely on.

How long we keep it

Enquiries, 24 months after the last contact, then deleted from our CRM. If the same person also subscribed to the newsletter, their address stays in Brevo until they unsubscribe. Converted clients are kept for the engagement and the statutory period.
Newsletter, retained until you unsubscribe, after which your address is immediately suppressed and removed from active mailings.
Analytics data, up to 14 months, matching the GA4 property data retention limit when analytics is configured.
Server logs & security records, rotated daily and pruned after operational diagnostic requirements.

Your rights

Under applicable data protection law (including GDPR and UK GDPR), you have rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete information.
Erasure: Request permanent deletion of your data (“right to be forgotten”).
Restriction & Objection: Object to processing based on legitimate interests or ask us to restrict processing.
Portability: Request transmission of your data in a structured, machine-readable format.
Withdraw consent: Withdraw consent for marketing emails or analytics at any time without affecting past processing.

To exercise any right, email info@thesharkweb.com. We respond within 30 days and do not charge a fee unless a request is manifestly unfounded or excessive.

Right to complain to a supervisory authority: If you are based in the United Kingdom, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). If you are in the European Economic Area, you may lodge a complaint with your national Data Protection Authority. We welcome the opportunity to resolve any concern directly with you first.

Security

The site runs exclusively over encrypted HTTPS, enquiry data is stored in a secured database accessible only to authorized agency staff, and API credentials are encrypted at rest. Access to the administrative control panel requires individual user credentials and password authentication.

In the unlikely event of a security breach affecting personal data, we will notify affected individuals and relevant supervisory authorities in accordance with applicable legal deadlines.

Children

This site is a business-to-business marketing platform. It is not intended for individuals under 16 years of age, and we do not knowingly collect personal data from minors. If you believe a minor has submitted personal information to us, please notify us at info@thesharkweb.com and we will delete it promptly.

Changes to this policy

When our systems or legal obligations change, this policy is updated and the date at the top moves. If material changes are made (such as adding a new processor or purpose), we will highlight them on the site or notify newsletter subscribers directly.