Privacy policy

1. Data controller

Omar Hajjoub (OH Studio) is the controller of personal data collected via omarhajjoub.site, the shop, forms (contact, briefs), invoicing, client presentations and payments started on the Site.

To exercise your rights or ask a question, use the contact email published on the Site.

2. Data we collect

Depending on your use: identity and contact details, message/brief content, order data (products, amounts, currency, payment method), bank-transfer proofs, billing data, technical identifiers (IP, logs, device, cookies/trackers where configured), and payment-provider status/reference data.

We do not collect full card numbers on our own servers when payment is handled by a provider (Stripe, Paddle, etc.); those providers process card data under their own policies.

3. Purposes and legal bases

Contract / pre-contract: handle inquiries, quotes, shop orders, digital delivery, invoices and payment follow-up.

Legitimate interest: secure the Site, prevent fraud/abuse, improve experience (aggregated analytics when enabled), reasonable business archiving.

Legal obligation: accounting, invoice retention, lawful authority requests.

Consent: non-essential cookies and any marketing messages (only if offered and accepted).

4. Recipients and processors

Data is accessible to Omar Hajjoub and technical processors as needed: host, transactional email, payment gateways (Stripe, Paddle, PayPal when enabled), analytics tools when enabled.

Paddle may act as Merchant of Record for some sales and process customer data for sale, tax and invoicing under its terms.

We do not sell your data to third-party advertisers.

5. International transfers

Some providers may process data outside Morocco and/or the EEA. Appropriate safeguards are sought (including SCCs / technical measures) where GDPR or similar rules apply.

6. Retention

Messages and leads: as needed for commercial follow-up, then limited archive or deletion.

Orders, invoices and payment proofs: statutory commercial/accounting periods.

Technical logs: short security and diagnostics windows.

Cookies: as described in the Cookie Policy.

7. Your rights

Where applicable (notably GDPR for EU/EEA individuals): access, rectification, erasure, restriction, objection, portability, and withdrawal of consent.

You may lodge a complaint with your local supervisory authority (e.g. CNIL for residents of France).

Identity verification may be required before responding.

8. Security

Reasonable measures are applied (HTTPS, admin access control, application hardening). No system is perfect—report suspicious incidents via Site contact.

9. Minors

Services target professionals and adults. If you are under 16 (or the applicable digital-consent age), do not use forms without parental authorization.