Privacy
What this site collects, and what it doesn't.
Waysa runs no analytics, sets no tracking cookies, and keeps no database of visitors. This notice sets out the little it does collect, why, and what you can make us do about it.
Last updated 3 August 2026
Who we are
This site is operated by Amaan Ullah, a sole trader based in the United Kingdom trading as Waysa. For the purposes of UK data protection law we are the "controller" of the personal data described below — meaning we decide what is collected and why, and we are the ones answerable for it.
You can reach us about anything in this notice at hello@waysasystems.co.uk, or by post at Unit 2, Hockney Road, Bradford BD8 9HQ.
The short version
If you only read one section, read this one. We collect your email address if you ask us to send you a resource or sign up to the newsletter. We collect your name, email and whatever you type into the form if you book a call. Our host records your IP address in its server logs, and we hold it for about a minute to stop the download form being hammered. That is the entire list.
There is no analytics script on this site. No Google Analytics, no advertising pixels, no session recording, no tracking cookies, and no third party watching you read the page. We do not sell, rent or share your data with anyone for marketing, and we make no automated decisions about you.
What we collect, why, and on what basis
UK GDPR requires us to have a specific lawful basis for each use of your data. Where we rely on "legitimate interests", you have the right to object — see Your rights below.
| What | When and why | Lawful basis |
|---|---|---|
| Your email address | When you request a file from the resource library. We use it to email you the download link, and we receive a copy so we know who asked. | Legitimate interests — responding to a request you made and understanding who our material reaches. |
| Your email address | When you subscribe to the newsletter. Used to send the newsletter and nothing else. | Consent, which you can withdraw at any time by unsubscribing. |
| Your name, email address, timezone and any notes you add | When you book a call using the calendar embedded on this site. Collected by Cal.com, our scheduling provider, and used to hold and confirm the appointment. | Steps taken at your request before entering a contract. |
| Your IP address | On every request, in our host's server logs. Separately, the resource form holds it in memory for about sixty seconds to limit how often the same visitor can submit. | Legitimate interests — keeping the site up, secure, and not trivially abusable. |
| Whatever you write to us | When you email us or reply to something we sent. Kept in our mailbox so we have the thread. | Legitimate interests — being able to hold a conversation with the person we are talking to. |
We have no customer database and no CRM behind this website. An email address you give us exists in the message we sent you, in the copy that arrived in our inbox, and in our email provider's sending logs. That is all.
Cookies and browser storage
This site sets no cookies of its own and runs no analytics or advertising cookies, so there is no consent banner — because there is nothing to consent to.
If you switch the site between light and dark, we save that one choice in your browser's local storage under the key "waysa-theme". It never leaves your device and is never sent to us. Clearing your site data removes it.
The booking calendar is an embedded Cal.com widget. Cal.com is a separate company and may set its own cookies or storage in that embed, under its own privacy policy rather than this one. If you would rather not load it, simply do not open the booking section — nothing loads until the page reaches it.
The typefaces this site uses are served from our own domain. Your browser makes no request to Google Fonts or any other font host when you visit.
Who else handles your data
We use a small number of service providers to run the site. They process data on our instructions under contract, and none of them are permitted to use it for their own purposes.
| Provider | What they do | What they see |
|---|---|---|
| Vercel | Hosts the website and runs its server code. | Your IP address, browser type and the pages requested, in ordinary server logs. |
| Resend | Sends the resource download emails. | The email address you submitted and the contents of the message we sent to it. |
| Cal.com | Provides the booking calendar and manages appointments. | The name, email, timezone and notes you enter when booking. |
| Amazon Web Services | Receives mail addressed to our domain, in its Ireland region, and passes it on to our mailbox. | Anything you send us by email, and our copy of resource requests, in transit. |
| Hosts the mailbox that mail is delivered into. | Anything you send us by email, and our copy of resource requests. |
We will also disclose personal data where the law requires it — for example in response to a valid order from a court or regulator. We will not do so on a bare request.
Data leaving the UK
Some of the providers above are based in, or store data in, the United States and elsewhere outside the UK. Where personal data is transferred out of the UK, it is protected by an approved safeguard — in practice the UK's data bridge for providers certified under the EU–US Data Privacy Framework, or the International Data Transfer Addendum to the European Commission's standard contractual clauses. You can ask us which applies to a given provider.
How long we keep things
- Download links are signed and stop working seven days after they are issued. Requesting the resource again mints a fresh one.
- The IP address used for rate limiting is held in memory for about sixty seconds and is never written to disk by us.
- Server logs are retained by our host for a short period in line with its own retention policy, not ours.
- Newsletter subscriptions are kept until you unsubscribe.
- Emails and booking records are kept for as long as we may reasonably need them for the relationship or for our own records, and reviewed periodically.
If you ask us to delete something and we have no legal reason to keep it, we will delete it.
Your rights
Under UK data protection law you can ask us to do any of the following, free of charge:
- Tell you what personal data we hold about you, and give you a copy of it.
- Correct it if it is wrong or incomplete.
- Delete it, where we have no overriding reason to keep it.
- Restrict what we do with it while a dispute about it is resolved.
- Send it to you, or to someone else, in a portable format.
- Stop processing it where we rely on legitimate interests and you object.
- Withdraw consent, at any time, where consent is what we relied on — withdrawing it does not affect anything done beforehand.
Email hello@waysasystems.co.uk and we will respond within one month. We may ask you to confirm who you are first, so that we do not hand your data to someone else.
If you think we have got this wrong, please tell us and give us a chance to fix it. You also have the right to complain directly to the Information Commissioner's Office at any time — ico.org.uk, 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Security
The site is served over HTTPS. Files in the resource library sit outside the public web root and are reachable only through a cryptographically signed, time-limited link, so a URL cannot be guessed and a forwarded one goes stale.
No system is perfectly secure and we will not claim otherwise. If you believe you have found a vulnerability in this site, please email us rather than disclosing it publicly, and we will get to it quickly.
Children
This site sells business services and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their details, email us and we will remove them.
Changes to this notice
We will update this notice when what the site does changes. The date at the top of the page is the date of the current version. If a change materially affects how we use data you have already given us, we will make a point of telling the people affected rather than quietly editing the page.