Privacy Policy

1. Who we are

Tkmonk is a UI/UX, website design and branding studio based in Pakistan, serving clients in the UAE and worldwide. This policy explains the handling of personal information in connection with tkmonk.com, its WordPress blog at tkmonk.com/Blog/, enquiries and business relationships. Personal information is information relating to an identified or identifiable individual.

For privacy enquiries, contact info@tkmonk.com or +92 312 8290757. Tkmonk is the business contact responsible for the website and enquiry processing described here. The legal supplier for an engagement is identified in its agreement or invoice. Our published business location is Pakistan. Contact us by email to obtain the appropriate postal correspondence details or to identify the operator relevant to your engagement.

2. Scope and our role

This policy covers information we handle for our own website operation, enquiries, client administration and related communications. It does not automatically govern an independent third party's website simply because we designed it or link to it.

If we process your customers' or users' data solely on your documented instructions during a client project, the relevant service and data-processing agreement should explain those arrangements. Requests about that client-controlled information should normally be directed to the client, although we will assist as required by the agreement and applicable law.

3. Information you provide

Our published contact forms request a name, email address, phone number, subject or message. Project enquiry forms may additionally request the service required, budget range and preferred starting timeline. We use the details you choose to submit and subsequent correspondence to understand and respond to your enquiry.

During a project, relevant information may include company and billing details, authorised contacts, instructions, feedback, approvals, correspondence and deliverables. Do not include identity documents, payment-card details, health information or other sensitive information in a general enquiry. Where a project genuinely requires sensitive information, suitable arrangements must be agreed first.

4. Technical information and server records

Website and infrastructure providers may generate records such as an IP address, requested page, browser or device information, access time, referring page and error details when a website is accessed. The information actually collected depends on the deployed hosting, security and website configuration.

Such records can support delivery, troubleshooting and protection against misuse. They should not be used for unrelated profiling without an appropriate purpose, notice and legal basis. Contact-form submissions also include the submitting page address, the visitor IP address and browser/user-agent information. The supplied form implementation sends the IP address to ip-api.com to estimate a city and country, then includes those approximate location details in the enquiry email. This is IP-based estimation, not a request for device GPS coordinates, and the estimate may be inaccurate. The service receives the queried IP address; this lookup does not require the visitor’s message, name or phone number. See https://ip-api.com/docs/legal for the provider’s own terms and privacy information.

5. Blog interactions and public submissions

Reading articles does not require you to provide a public comment. If comments, account registration, subscriptions or uploads are enabled, the relevant form should explain the information requested and which details will be public. Do not post private contact information or confidential project material in a public field.

WordPress features and plugins can process information differently from the main website. A public feature collects information only where that feature is enabled and you use it. Any comment, registration or subscription interface must identify the relevant collection before submission. The contact details in this policy can be used to request information about a particular blog interaction, including any external moderation or avatar service involved.

6. Information from other sources

We may receive relevant business-contact information when a colleague introduces you, an authorised representative contacts us on your behalf or a platform carries your project enquiry. We will use it only for a compatible business purpose and explain the source where required.

Public availability does not make every use appropriate. Information from referrals or business correspondence should not automatically be added to unrelated marketing lists. If information about another person is supplied to us, the sender should have authority to share it for the intended purpose.

7. Why information is used

Information may be used to respond to enquiries; assess project requirements; prepare proposals; communicate about services; carry out an agreed engagement; manage approvals, billing and records; provide requested support; investigate technical problems; protect systems; or meet legal obligations and resolve disputes.

Each use must be connected to a legitimate, specific purpose and an available legal basis. We will collect only information reasonably needed for that purpose. A project enquiry is not blanket permission for unrelated advertising, publication of your details or unrestricted sharing with third parties.

8. Legal grounds and consent

The lawful basis depends on the activity and the law applicable to it. It may include taking requested steps toward an agreement, performing a contract, meeting legal duties, or obtaining valid consent. Where recognised by the relevant law, a properly assessed legitimate interest may support necessary activities provided individual rights are respected.

We do not assume that one legal basis is available in every country. Where consent is required, it must be obtained in an appropriate form and may be withdrawn for future processing. Withdrawal does not invalidate earlier lawful processing and does not prevent retention required by law or another valid basis.

9. Cookies and similar technologies

Cookies, local storage and similar technologies can support functions such as session handling, preference storage and consent choices. Analytics, advertising and embedded services can introduce additional identifiers. The main website and WordPress blog may have different settings, so choices should be checked on the part of the site you are using.

Where legally required, non-essential technologies must remain disabled until valid consent is given. Any consent interface must reflect real behaviour, offer the required choices and allow preferences to be changed. Browser settings can also control or remove cookies, although blocking necessary functions may affect website features.

Where a cookie-preference control is displayed, use that control to review or change the choices it supports. You can also manage cookies through your browser. Where a non-essential technology requires consent, we will not rely on this policy or a general project enquiry as that consent. Contact us for information about a particular cookie or integration. No assertion is made that a browser preference removes previously submitted enquiry information.

10. Analytics, advertising and marketing messages

We will not use information supplied through a project enquiry for unrelated advertising audiences, behavioural profiling or cross-site tracking without first providing the required information and establishing an appropriate lawful basis. If an analytics or advertising integration is introduced, its purpose, relevant information, recipient and required choices must be disclosed before collection. The main website files reviewed for this policy did not identify a named analytics or advertising integration; this is not a representation about every server-side service or WordPress extension.

Project correspondence and requested replies are different from promotional messages. Where marketing is sent, it must follow applicable consent and direct-marketing requirements and provide an effective opt-out. Contact info@tkmonk.com to request that promotional communications stop. Essential messages about an active engagement may still be needed. A subscription facility, if introduced, must explain the mailing arrangement at collection. We will not treat a request for a project quotation as an automatic subscription to promotional mail.

11. Service providers and permitted disclosures

Relevant information may need to be handled by providers supplying hosting, email delivery, communications, collaboration, invoicing, security or other functions actually used in operating the business. Access should be limited to the relevant service and governed by suitable contractual and confidentiality arrangements where required.

Information may also be disclosed to professional advisers, authorities or another party where legally required or necessary to establish, exercise or defend a legal right. Any disclosure in a business transfer must have a lawful basis and appropriate safeguards and notice. The main website form sends enquiries by email through the mail server configured at mail.lunoft.com, using PHPMailer to prepare and transmit the message. PHPMailer is software used for delivery, not by itself a separate recipient of your enquiry. The external IP-location lookup is described in section 4. Relevant hosting and email infrastructure handles information necessary to provide those services. We will not sell or rent enquiry information for independent third-party marketing.

12. Payments and billing

The information needed to invoice and reconcile a project may include a billing name, company details, address where required, invoice reference and transaction confirmation. Payment methods and any external payment provider should be disclosed through the agreed payment process.

Do not send full payment-card numbers, security codes or banking passwords through a contact form or ordinary project message. The published enquiry forms are not payment-card entry forms. Payment instructions and any payment-service provider must be identified as part of the agreed billing process. This notice does not authorise the collection or storage of payment authentication secrets, or assert an unverified payment-platform arrangement.

13. Collaboration, subcontractors and AI tools

Design and development projects may require approved team members, subcontractors or collaboration services to access relevant materials. Confidentiality, access controls and any required client instructions should apply. Sharing a file for one project does not authorise its use for another client or public promotion.

Using generative AI with personal information requires an appropriate purpose, lawful basis, notice and safeguards, plus any required client approval. Confidential or personal information must not be uploaded simply because a tool is convenient. We will not submit identifiable enquiry information, private customer datasets or confidential client materials to a generative AI service merely by relying on a general agreement to provide design services. Any proposed use involving that information requires a separate assessment and the required disclosure, lawful basis and contractual authorisation. This policy does not assert that a particular AI vendor currently receives your personal information.

14. International handling

Cross-border projects and external providers can involve access to information from countries other than your own. The applicable safeguards depend on the locations, recipient, purpose and law governing the transfer. Serving UAE clients does not, by itself, establish where all information is stored.

Where a transfer is regulated, the required lawful transfer mechanism and safeguards must be in place before it occurs. Tkmonk operates from Pakistan; information sent to us may consequently be accessed there. External hosting, email, location and approved collaboration services may involve additional international processing. We will identify relevant recipients and transfer arrangements on an appropriate request or before a new transfer where notice is required. This policy is not blanket consent to transfers and does not replace a legally required safeguard.

15. Retention and deletion

Information should be kept only for as long as necessary for the stated purpose, an applicable legal obligation or a justified need to resolve disputes. Relevant considerations include whether an enquiry became a project, the agreement's duration, outstanding support, required accounting records and applicable limitation periods.

For enquiries that do not become projects, retention is assessed by whether the enquiry remains active, an agreed follow-up is pending, or a genuine dispute or legal requirement justifies keeping the record. Project files and correspondence are assessed by delivery, payment, support, agreed handover and applicable claims periods. Financial records follow the statutory accounting and tax requirements that apply. Technical logs are assessed by troubleshooting and security needs; marketing preference records may be retained to respect an opt-out. These criteria govern retention rather than an unsupported claim that every system deletes data after a fixed number of days. Information no longer required should be deleted or appropriately anonymised; any information retained for a legal hold should be restricted to that purpose. Backup copies may expire through a documented cycle rather than immediate selective deletion.

16. Security and incidents

Security measures must be appropriate to the nature of the information and risks of processing. Relevant measures may include access restrictions, secure account management, protective technical controls, staff or contractor confidentiality and suitable backup arrangements. We will apply suitable confidentiality and access requirements to people handling project information. This notice does not claim a security certification, a completed independent audit or encryption of every processing step. In particular, the supplied form implementation uses an HTTP connection for its external IP-location lookup; the receiving service and the network path can therefore process the queried IP without transport encryption for that step.

No online service can promise absolute security. If an incident affects personal information, it must be assessed and handled in accordance with applicable obligations, including required notifications. To report a suspected privacy or security problem, email info@tkmonk.com without unnecessarily including sensitive data in the initial message.

17. Your requests and rights

Depending on the law and circumstances, you may have rights to information about processing; access; correction; deletion; restriction; objection; portability; withdrawal of consent; or complaint to a competent authority. These rights are subject to applicable conditions and exceptions and are not asserted to be identical in every jurisdiction.

Send requests to info@tkmonk.com, identifying the relevant relationship or information. We may request proportionate verification to protect against unauthorised disclosure. Do not send identification documents unless needed and a suitable method has been arranged. Requests should be addressed within the period required by applicable law, with explanations of any lawful extension or refusal.

18. Automated decisions

Ordinary technical measures, such as spam screening, are not necessarily legally significant automated decisions. The IP-location lookup adds an approximate geographic label to an enquiry; the supplied form code does not use it to make an automated eligibility or contracting decision. We will not introduce a solely automated decision with legal or similarly significant effects by treating this general policy as sufficient permission. If such processing is used, provide the legally required explanation, basis, consequences and applicable review or objection rights before deployment.

19. Children and information submitted by mistake

Tkmonk's professional services are intended for business customers and people able to enter a relevant agreement. The website is not designed to solicit children's personal information. If you believe information about a child has been submitted without an appropriate basis, contact us so it can be assessed and handled under the applicable rules.

Age thresholds, parental-authorisation requirements and duties can differ by location and service. This policy does not substitute a universal age threshold for those requirements. Where information was supplied accidentally, contact us promptly; deletion requests remain subject to any lawful retention requirement.

20. External websites and communications services

Links to social networks, meeting tools or other sites may take you to services operated by independent organisations. Their privacy notices apply to their own processing. Review the notice before supplying information through an external service.

If an external resource is embedded and collects information before you click it, that collection must also be described and controlled appropriately on this website. A general external-links disclaimer does not remove responsibility for choosing and configuring an embedded integration.

21. Complaints and updates

Please contact info@tkmonk.com with a description of a privacy concern and the outcome you seek. We will consider the concern and respond through an appropriate channel. This does not prevent you from exercising any right to complain to the competent data-protection authority or seek another available remedy.

This policy may be updated to reflect actual changes in services, technology or legal requirements. The published version should show its effective or updated date. Material changes require additional notice or renewed consent where applicable; updating the page alone does not legitimise an incompatible new use of previously collected information.

22. Contact details

Privacy contact: info@tkmonk.com. Telephone: +92 312 8290757. Website: https://tkmonk.com/. Contact page: https://tkmonk.com/contact-us. Business location stated publicly: Pakistan, serving the UAE and worldwide. For postal correspondence or identification of the legal supplier relevant to your matter, request the appropriate details through the privacy email above. Please describe your concern without disclosing more personal information than is necessary.