Privacy Policy | SuperSITE Web Design Pakistan

1. Who We Are & How to Contact Us

SuperSITE (trading name of Super Site Web Design & Development) is a web design and development agency headquartered in Lahore, Pakistan. We operate the website www.supersite.pk.

We act as the data controller for personal data collected through this website — meaning we determine the purpose and means of processing. For client projects we undertake, we may also act as a data processor on behalf of our clients.

For all privacy-related enquiries, contact us at: | Subject line: Privacy Enquiry

2. Definitions

In this Policy: "Personal Data" means any information that can be used to identify you directly or indirectly. "Processing" means any operation performed on personal data, including collection, storage, use, or deletion. "You / User" means any visitor to or user of www.supersite.pk.

3. What Data We Collect

Information you provide directly

Full name, email address, phone number, company name, and project details submitted through our contact or quote forms.
Files, URLs, or reference links you voluntarily share when requesting a quote or portfolio review.
CV or resume details if you apply for a position at SuperSITE via our contact form or email.
Any communications you send us by email or through forms on this website.

Information collected automatically when you visit our website

IP address and approximate geographic location (country and city level).
Browser type and version, operating system, device type, and screen resolution.
Pages visited, time on site, scroll depth, referral source (how you found us), and click behaviour.
Company name and industry sector (for business visitors, via B2B visitor identification — see Section 9).

Information received from third parties

If you interact with our ads on LinkedIn or Facebook and subsequently visit our website, those platforms may pass limited profile data to us (subject to your privacy settings on those platforms).

4. Legal Basis for Processing

We process your personal data on the following legal grounds:

Contractual necessity: Processing your name, email, and project details is necessary to respond to your enquiry and provide the services you request.
Legitimate interests: We use analytics and marketing tools to understand how our website is used and to improve our services. We have assessed that these interests do not override your fundamental rights.
Consent: Where we rely on consent (e.g., marketing communications), you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Legal obligation: We may process data to comply with applicable laws, court orders, or government requests.

5. How We Use Your Data

To respond to project enquiries, provide quotes, and deliver contracted services.
To communicate about ongoing projects if you become a client.
To process and evaluate job applications received through our website or email.
To improve our website content, design, and user experience using aggregated analytics data.
To understand which marketing channels bring visitors to our site and allocate marketing budget accordingly.
To protect our website and systems from spam and fraudulent submissions.
To comply with legal obligations and defend our legal rights.

We do not sell your personal data to any third party. We do not send unsolicited bulk marketing emails.

6. Google Services

Google Tag Manager

We use Google Tag Manager (GTM) to manage and deploy tracking and analytics tags. GTM itself does not collect personal data but acts as a container that triggers the tools described below. Operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Privacy Policy →

Google Analytics 4

We use Google Analytics 4 (via GTM) to measure visitor behaviour on our site. GA4 collects pseudonymous data including page views, session duration, device type, and traffic source. IP addresses are anonymised before storage. Retention period: 14 months (GA4 default). Opt out: Google Analytics Opt-Out Browser Add-on.

Google Search Console

We use Google Search Console to monitor our website's visibility in Google Search. Search Console does not collect data about individual visitors to our site.

Google reCAPTCHA v3

Our forms are protected by Google reCAPTCHA v3 to prevent automated spam. reCAPTCHA collects hardware and software information from your device (including mouse movements and timing data) and sends it to Google for risk scoring. No visible challenge is shown to users. This processing is necessary to protect our services. By submitting any form on this website, you acknowledge Google's Privacy Policy and Terms of Service.

7. Meta (Facebook) Pixel

We use the Meta Pixel (via GTM) to measure the effectiveness of our advertising on Facebook and Instagram, and to build relevant custom audiences for future campaigns. The Pixel may collect your IP address, browser information, and pages visited. If you have a Facebook account, Meta may associate this with your profile. Manage your preferences at facebook.com/settings. Operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. Meta Privacy Policy →

8. LinkedIn Insight Tag

We use the LinkedIn Insight Tag (via GTM) for conversion tracking and LinkedIn retargeting. The tag enables us to understand the professional demographics (job function, seniority, industry) of website visitors and measure the performance of LinkedIn ad campaigns. Opt out at LinkedIn Ad Settings. Operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn Privacy Policy →

9. Microsoft Bing & Clarity

We may use Microsoft Advertising UET tags to measure the performance of Bing search ad campaigns, and Microsoft Clarity to analyse anonymised heatmaps and session recordings to improve website usability. Clarity data does not include personally identifiable information. Data is processed by Microsoft Corporation subject to Microsoft's Privacy Statement.

10. B2B Visitor Identification

We use a B2B visitor identification service (such as RB2B or a similar platform) that identifies the company name, industry, and approximate location of business visitors to our website based on their IP address. This service does not identify individual employees — only company-level data is surfaced. This information is used solely for internal sales intelligence to understand the types of businesses visiting our site. It is not shared with third parties or used to contact individuals without their consent. To opt out of this identification, email us at with the subject line B2B Opt-Out, and we will suppress your IP from future identification.

11. Cookies

Cookies are small text files placed on your device when you visit a website. We use the following categories:

Category	Purpose	Can be disabled?
Strictly necessary	CSRF security tokens that protect our forms from cross-site request forgery attacks.	No — required for site security.
Analytics	Google Analytics 4, Microsoft Clarity — measure usage patterns to improve our site.	Yes — via browser settings or platform opt-out tools linked above.
Marketing & Retargeting	Meta Pixel, LinkedIn Insight Tag — enable advertising campaign measurement and audience building.	Yes — via platform ad preference settings.

You can manage cookies at any time through your browser settings. Note that disabling certain cookies may affect site functionality. For guidance on common browsers:

12. International Data Transfers

SuperSITE is based in Pakistan. By using our website, your data may be transferred to and processed in countries outside Pakistan, including the United States and the European Union, by the third-party tools listed in this Policy (Google, Meta, LinkedIn, Microsoft). These transfers occur as part of those platforms' standard operations and are subject to their respective data protection frameworks. We select service providers that maintain appropriate data security standards.

13. Data Sharing & Disclosure

We do not sell or rent your personal data. We may share data in the following limited circumstances:

Service providers: Third-party tools listed in this Policy (Google, Meta, LinkedIn, Microsoft, and B2B identification platforms) receive data as described. All are bound by their own data protection obligations.
Legal requirements: We may disclose personal data if required to do so by applicable law, court order, subpoena, governmental or regulatory authority, or where we have a good-faith belief that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend our legal rights; (c) prevent or investigate illegal activity, fraud, or threats to safety; or (d) respond to emergency situations involving risk to life.
Business transfers: If SuperSITE is involved in a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same privacy commitments. We will provide notice via a prominent notice on our website or by email before your data is transferred and becomes subject to a different privacy policy.

14. Data Retention

Form submissions (name, email, phone, project details): retained for up to 2 years for business records and follow-up, then deleted.
Job applications not resulting in employment: retained for 6 months, then deleted unless you consent to being contacted for future vacancies.
Analytics data: retained per each platform's default settings (typically 14 months for Google Analytics 4).
Rate-limiting data (hashed IP address for spam prevention): automatically purged after 24 hours.
We do not retain data indefinitely. Data is deleted when it is no longer required for the purpose for which it was collected.

15. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

HTTPS/TLS encryption for all data in transit to and from this website.
Encrypted SMTP for email transmission of form submissions.
IP-based rate limiting and CSRF token validation on all forms.
Access controls limiting who within our organisation can access submitted data.

We do not store credit card, payment card, or banking credentials on our servers. We do not handle payment transactions directly — payments are processed via bank transfer or third-party payment platforms (JazzCash, EasyPaisa) under their respective security standards.

Despite our precautions, no internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

16. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right to access: Request a copy of the personal data we hold about you and confirm how it is being used.
Right to rectification: Request correction of inaccurate or incomplete personal data.
Right to erasure: Request deletion of your personal data where there is no compelling reason for us to continue holding it.
Right to restrict processing: Request that we pause processing your data in certain circumstances (e.g., while accuracy is disputed).
Right to data portability: Request your data in a structured, commonly used, machine-readable format.
Right to object: Object to processing based on our legitimate interests, including for direct marketing purposes. We will stop unless we have compelling legitimate grounds that override your rights.
Right to object to automated decision-making: Object to decisions made solely by automated means, including profiling, that have a legal or similarly significant effect on you.
Right to withdraw consent: Where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

To exercise any of these rights, email with the subject line Data Subject Request and describe the right you wish to exercise. We will respond within 30 days. We may request proof of identity before processing your request.

17. SMS & WhatsApp Communications

We communicate with clients and prospects via WhatsApp and SMS for project updates and enquiry follow-ups. Phone numbers collected through our forms are used only to respond to your specific enquiry or manage your project. We do not share, sell, or disclose phone numbers to third parties. We do not add you to broadcast lists without your explicit consent. You may opt out of WhatsApp or SMS communications at any time by informing us.

18. Children's Privacy

This website is intended for business and professional use by adults. We do not knowingly collect personal data from children under the age of 18. If you are under 18, please do not submit any personal information through this website. If we become aware that we have inadvertently collected personal data from a child under 18, we will delete it promptly. Parents or guardians who believe their child has submitted data to us should contact us immediately at .

19. Third-Party Links

Our website contains links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policy of every website you visit. Links to third-party sites do not constitute our endorsement of those sites or their content.

20. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Policy periodically. Your continued use of our website after any changes constitutes your acceptance of the revised Policy.

21. Contact

For any privacy-related questions or requests, contact us at:

SuperSITE — Super Site Web Design & Development
Lahore, Pakistan

Subject line: Privacy Enquiry