01.Data Controller & Scope
The entity responsible for the collection, control, and processing of your personal data under the European General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Indian Digital Personal Data Protection Act, 2023 (DPDP Act) is:
SK Sahinur Islam (Genious Sonu)
Senior Web Application Developer & IT Engineer
Location: Kolkata, West Bengal, India
Direct Privacy Inquiries: sahinurislamm2002@gmail.com
Official Domain: https://genioussonu.me
02. Categories of Information Collected
I believe in strict data minimization. I collect only the information strictly required to facilitate professional correspondence, protect infrastructure security, and optimize performance:
When submitting a message through the website contact form, I collect your name, email address, and the text content of your inquiry. This is processed securely via the Resend API.
Standard HTTP edge request headers including truncated/anonymized IP address, user-agent string, browser version, device category, referring URL, and server request timestamps.
Client-side storage tokens for PWA offline caching (Service Worker `sw.js`), dark mode preferences, and cookie consent state flags (`cookie-consent-choice`).
03. Legal Bases for Processing
In accordance with international privacy frameworks (GDPR Article 6 & Indian DPDP Act 2023), processing is justified strictly under:
- Consent: For optional performance analytics cookies (Google Analytics 4) and voluntary interactions with the AI chatbot widget.
- Contractual / Pre-Contractual Necessity: To respond to software development inquiries, freelance consulting requests, or project bids submitted by you.
- Legitimate Interests: Maintaining web application integrity, DDoS mitigation, network firewall filtering, and debugging technical runtime errors.
05. How Your Information is Utilized
Your information is exclusively used for the specific purposes for which it was supplied:
- Evaluating and responding to freelance software development, full-stack engineering, and IT infrastructure consulting inquiries.
- Delivering compiled, optimized website assets via Vercel Edge networks and modern Next.js serverless functions.
- Detecting, investigating, and stopping unauthorized intrusions, bot floods, prompt injection, and cyber threats.
- Analyzing anonymized, aggregated page traffic metrics (only when explicit consent is provided) to understand which engineering blog articles resonate with readers.
06. Third-Party Sub-processors
I partner exclusively with industry-standard, SOC 2 / ISO 27001 compliant cloud infrastructure providers to operate this Website:
Primary hosting, edge routing, serverless compute, and SSL termination. Compliant with EU-US Data Privacy Framework.
Transactional email delivery service utilized securely by /api/contact to dispatch contact form submissions to my private inbox.
Headless Content Management System (CMS) hosting technical blog posts, project metadata, and gear recommendations under GDPR standards.
Optional Google Analytics 4 (telemetry activated only upon consent) and Google Gemini API (supporting chatbot conversational inference).
High-speed LPU AI inference engine powering the Genious Bot conversational assistant under strict zero-training API policies.
07.Data Security & Encryption Architecture
Security is not an afterthought; it is built into the architecture of this application:
- Transport Layer Security: All network traffic between your browser and the site is encrypted using modern TLS 1.3 cryptographic suites with HTTP Strict Transport Security (HSTS).
- Hardened Headers: Explicit security headers including X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and Referrer-Policy: strict-origin-when-cross-origin.
- Credential Isolation: Zero sensitive environment variables or third-party secret tokens are ever bundled or exposed to client-side JavaScript.
08. Data Retention Periods
I do not hoard personal data. Inquiries received via the contact form are retained for up to 24 months in my secure email archive for business continuity, or until you request premature deletion. Temporary edge server logs are automatically purged within 30 days.
09. Your Global Privacy Rights
Depending on your location, you hold statutory rights regarding your personal information:
Right of access (Art. 15), rectification (Art. 16), erasure / "right to be forgotten" (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and right to withdraw consent without detriment.
Right to know specific pieces of personal information collected, right to delete personal information, right to non-discrimination, and right to opt-out of any data sale (I do not sell data).
Right to access summary of personal data and processing activities, right to correction and erasure of inaccurate personal data, right to grievance redressal, and right to nominate an authorized representative.
10.Zero Data Sale & Sharing Guarantee
I have never sold, rented, leased, or monetized your personal data, email address, or browsing behavior to data brokers, ad networks, or third parties—and I never will.
11.Children's Privacy Protection
This Website is a professional engineering portfolio directed toward businesses, recruiters, engineers, and clients. It is not intended for or directed toward individuals under the age of 13 (or under 16 in the European Union). I do not knowingly collect personal data from minors. If you believe a minor has submitted personal data through this site, please contact me immediately for expedited deletion.
12.Exercising Your Rights & Contact
To exercise your rights of access, rectification, erasure, or to raise any data protection inquiry, email me directly with the subject line [Privacy Rights Request]:
SK Sahinur Islam
Attn: Data Privacy & Protection
Email: sahinurislamm2002@gmail.com
Response Time: Within 30 calendar days (free of charge)