Legal
Privacy policy
What happens to personal information when you use this website: what is collected, why, who else can see it, and what you can require us to do about it.
In effect from 12 September 2026
Who we are
Stage 3 Consulting decides what personal information this website collects and what happens to it afterwards. In data protection language that makes it the controller, and the party answerable for everything set out below.
- Legal entity
- Stage 3 Consulting
- Registered address
- 1061-D, DHA Phase 6, Lahore, Pakistan
- Data protection contact
- Omar Khan, Founder & CEO
omar@stage3consulting.com
What this policy covers
It covers this website and the enquiry form on it. It does not cover personal information handled inside a client engagement — research respondents, recruitment records, or data a client passes to us to analyse. That work is governed by the contract signed for it, and for a research organisation it is the larger obligation of the two.
Research participants are covered by the notice they are given at the time of the research, not by this page. This page covers the website.
What we collect
Three different things, gathered in three different ways. They are worth separating, because you control the first, you cannot avoid the second, and the third does not involve us at all once the page has loaded.
What you send us
The enquiry form asks for your name, your organisation and a work email, all of which are required; a phone number, which is not; the capability your enquiry relates to; and the description of the challenge you type into the message field. Nothing else on this site asks you for anything.
Nothing here asks for financial details, identity documents or any special category of personal data, and none of it should be sent through the form.
What the server records
Serving a page produces a log entry, as it does on any website. That entry typically holds:
- the IP address the request came from;
- the date and time of the request;
- the page or file requested, and the response the server gave;
- the page that referred you, where your browser sends one;
- the browser and operating system your browser reports.
These entries are a by-product of delivering the page rather than something added to observe you, and they are not used to build a profile.
A submission through the enquiry form also stores the IP address it came from and the browser your browser reports, alongside the message itself. That is there to catch abuse of the form, not to identify you.
What your browser sends elsewhere
The typefaces used on this site are loaded from Google's font service. Your browser fetches them directly from Google, which discloses your IP address and browser details to Google whether or not you do anything on the page.
We have kept the fonts with Google's service rather than host them on our own server, so the disclosure stands. It happens on every page load, before you have done anything on the page, and this paragraph is how you are told about it.
Why we use it
- To answer your enquiry — to read what you sent, reply to it, and carry on the conversation you started.
- To keep the site working — to diagnose errors, investigate abuse and keep the service available.
- To meet obligations that apply to us — where a law or a regulator requires a record to be kept.
Two commitments go with that. Enquiry details are used to answer the enquiry; they are not added to a marketing list. And personal information collected through this site is never sold.
Our lawful basis
The vocabulary below is the GDPR's, because it is the most demanding standard likely to be held against a site of this kind. We use it as the standard we hold ourselves to, not as a claim about which regime governs us.
This policy, and anything arising from it, is governed by the laws of Pakistan, and the courts at Lahore have jurisdiction.
- Answering your enquiry — our legitimate interest in responding to someone who has contacted us, and steps taken at your request before entering into a contract.
- Running and securing the site — our legitimate interest in keeping it available and free of abuse.
- Any non-essential cookie — consent, asked for before anything is set and withdrawable afterwards. Nothing on the site relies on this basis today.
- Records we are required to keep — legal obligation, where a law that applies to us requires a record to be kept and for as long as it requires it.
The enquiry form
The form on the contact page is the only place on this site that collects anything you have typed, so it is worth being precise about what happens to a submission.
- The submission is written to the site's own database before any email is sent, so that a failed delivery cannot lose an enquiry. That means two copies exist, and both are personal information.
- The form carries one hidden field, positioned off-screen and out of the keyboard order. People never see it; automated scripts fill it in, and a submission that fills it is discarded. It records nothing about you.
- Two emails follow. One tells us an enquiry has arrived. The other acknowledges it to the address you gave, so you know it reached us; that acknowledgement never repeats what you wrote.
- Enquiries are delivered to info@stage3consulting.com and are also held in the site's admin panel, where a reply is written and kept with the enquiry. They are read by the Stage 3 people who answer enquiries and by those holding administrative access to the site, who are named in clause 08.
- The database that stores them sits on this site's hosting, which is provided by Hostinger.
Please keep commercially sensitive material out of the message field. A web form is a good way to start a conversation and a poor way to move confidential information. Say that there is something to discuss and we will arrange a route that suits it.
Cookies and analytics
This site sets no cookies on your device. There is no visitor account to sign into, nothing held in a basket and nothing that has to be remembered between one page and the next, so nothing is stored by us and no consent banner is warranted. The admin panel our own staff sign into sets a session cookie for them; it is never set for a visitor to this site.
No analytics runs on this site. There is no analytics product, no tag manager and no tracking script on any page, so no such company receives anything about your visit. The font request described above is the only request a page makes to anyone other than our own server. It is not a cookie, but it is still a disclosure, and it happens on every page load.
Both statements describe the site as it is built today, and we will not promise anything about what is added later. If analytics, an embedded video, a chat widget or a visitor login is ever added, this clause is rewritten first and consent is asked for before any non-essential cookie is set.
Third parties and processors
These are the organisations that handle this data on our behalf. Each is used for the purpose set against it and for nothing else, and the list is complete as this policy stands.
- Website and database hosting: Hostinger.
- Delivery of enquiry email: the same hosting provider's mail service, which delivers enquiries to info@stage3consulting.com.
- Typeface delivery: Google, which receives your IP address and browser details when the fonts are fetched.
- Analytics: none. No analytics provider receives anything from this site.
- Administrative access to the site and its data: Revebe Digital Pvt. Ltd., which built the site and maintains it.
How long we keep it
Nothing is kept for longer than the purpose it was collected for requires. When that purpose ends, the record is deleted or stripped of anything that identifies a person.
- Enquiry submissions, in the database and in the inbox: kept while the conversation is live, and afterwards only for as long as there is a business or legal reason to keep them.
- Server logs: kept for the short period needed to diagnose errors and investigate abuse, then discarded in the ordinary course.
- Backups: held on the hosting provider's own backup cycle and overwritten as that cycle turns over.
Backups deserve the honesty most policies withhold. A record deleted from the live database survives in backups until that cycle turns over, and the deletion is only complete when it does.
If you want to know how long a particular record about you has been held, or want it removed sooner, ask us and we will tell you.
Your rights over your information
Subject to the law that applies, you can ask us to:
- give you a copy of the personal information we hold about you;
- correct anything that is wrong or incomplete;
- delete it, where there is no continuing reason to keep it;
- restrict what we do with it while a question about it is resolved;
- stop processing that rests on legitimate interests, where you object to it;
- provide it in a portable form, or send it to another organisation;
- act on a withdrawal of consent, which you can make at any time — it does not undo what was lawfully done before it.
We may need to establish who you are before acting on a request. Send it to the address below and we will reply within one to two working days.
- Requests to
- info@stage3consulting.com
- Response time
- One to two working days
- Complaints to
- info@stage3consulting.com
Changes to this policy
When this policy changes, the revised version is published on this page and the effective date at the top changes with it. Where a change materially affects information already collected, we will say so on this page rather than rely on anyone noticing a new date.
How to contact us
Questions about this policy, and any request about your own information, go to Omar Khan, Founder & CEO, who is the data protection contact named in the first clause.
- info@stage3consulting.com
- Phone
- +92 345 8708000
- Post
- 1061-D, DHA Phase 6, Lahore, Pakistan
- Complaints
- info@stage3consulting.com
For anything that is not about data protection, the enquiry form is the faster route.