Adobe Commerce development
Storefront design
Performance & SEO
AI & agentic commerce
Release trackerThis policy explains what personal data Mistri collects through this website, why, who it is shared with, how long it is kept and the choices you have.
Last updated: 1 November 2026
Who we are
This website (mistri.tech) is operated by Mistri Tech, an Adobe Commerce, AI and custom web application development business based in Sialkot, Pakistan. Mistri Tech is the controller of the personal data described here. For any privacy question or request, use the contact form and choose “Privacy request” in your message.
What we collect
When you contact us or book an audit call
The contact form and the “Book a free audit call” form ask for your name and email address, and optionally your phone number, company or store URL, the service you are interested in, your Magento version and a message. The form is sent to us by email. It is not saved in the website database.
When you browse the site
- Server and security logs: your IP address, browser, the pages requested and the time. Our hosting provider and Cloudflare record these to deliver the site and protect it from attacks.
- Cookies and local storage: listed in the cookie table below. We do not use advertising cookies, and we do not currently use analytics tools. Forms are protected by Google reCAPTCHA, which runs when you submit a form.
We do not ask for sensitive data such as health, financial or government ID information. Please do not send passwords or access keys through the forms.
Why we use it and our legal basis
| Purpose | Data | Legal basis (EU and UK GDPR) |
|---|---|---|
| Reply to your enquiry and prepare an audit or proposal | Form details and emails | Steps you ask for before a contract, and our legitimate interest in answering business enquiries |
| Deliver the website, keep it secure and prevent abuse | Logs, IP address, security cookies | Legitimate interest in running a secure website |
| Protect forms from spam and abuse | reCAPTCHA signals such as IP address, browser data and interaction with the page | Legitimate interest in keeping our forms free of spam |
| Remember your light or dark display choice | A setting in your browser’s local storage | Strictly necessary for a feature you choose to use |
| Meet legal, tax and accounting duties if you become a client | Contact and contract details | Legal obligation |
We do not sell your personal data, share it for cross-context behavioural advertising or use it for automated decisions that have legal or similarly significant effects on you.
Cookies and similar technologies
| Name | Set by | Purpose and duration |
|---|---|---|
| PHPSESSID | This website (Adobe Commerce) | Keeps your browsing session working. Expires when the session ends or after one hour of inactivity. |
| form_key | This website (Adobe Commerce) | Protects forms against cross-site request forgery. Session length. |
| mage-cache-sessid, section_data_ids, private_content_version, X-Magento-Vary, and mage-* entries in local storage | This website (Adobe Commerce) | Make sure cached pages and page sections show correctly. Session to one year. |
| amplog_redirect_flag | This website (Amasty extension) | Technical flag used by an installed Adobe Commerce extension. Session length. |
| mage-messages | This website (Adobe Commerce) | Shows messages such as “Thanks for contacting us”. Cleared once displayed. |
| mz-theme (local storage) | This website | Remembers your light or dark mode choice. Stays until you clear your browser storage. |
| _GRECAPTCHA (local storage) and Google cookies | Google reCAPTCHA | Set only when you submit a form, to check that a person sent it. See Google’s privacy policy. |
| __cf_bm and similar | Cloudflare | Security and bot protection. Usually up to 30 minutes. |
These are all strictly necessary for the site or for a feature you use, so they do not need consent. You can block or delete cookies in your browser settings; some site features, such as the contact form, may then stop working.
Who we share data with
We share personal data only with service providers that help us run this website and our business, under contracts that require them to protect it and use it only on our instructions:
- Hosting: Contabo GmbH, which hosts the website on servers in the European Union.
- Content delivery and security: Cloudflare, Inc., which delivers the site and filters malicious traffic.
- Email: the email service provider we use to receive and answer messages.
- Spam protection: Google LLC, through reCAPTCHA on our forms. Google processes this data under its Privacy Policy and Terms of Service.
We may also disclose data when the law requires it, or to protect our rights, our clients or the public. If you become a client, project data is handled under the agreement we sign with you.
International transfers
Some providers, such as Cloudflare, may process data outside your country, including in the United States. Where data leaves the EU or the UK, we rely on safeguards recognised by law, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or an adequacy decision.
How long we keep it
- Enquiries that do not become a project: up to 24 months after our last contact, so we can follow up on the same conversation, then deleted.
- Client records: for as long as the law requires for contracts, tax and accounting.
- Server and security logs: a short period, normally up to 30 days, unless needed to investigate an incident.
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- ask us to delete it;
- restrict or object to how we use it, including objecting at any time to processing based on legitimate interests;
- receive it in a portable format;
- opt out of any sale or sharing of personal data (we do neither);
- not be treated differently for exercising these rights.
To make a request, contact us through the contact form. We may ask you to confirm your identity, and we reply within the time the law requires (one month under the GDPR, 45 days under California law). You can also complain to your data protection authority, for example the authority in your EU country, the UK Information Commissioner’s Office or the Office of the Australian Information Commissioner.
Security
The site is served over HTTPS only. Access to the servers and admin area is restricted and protected, and software is kept up to date with security patches. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Children
This website is for businesses. It is not directed at children under 16, and we do not knowingly collect their personal data.
Changes to this policy
We will update this page when our practices change, for example if we add analytics or a newsletter, and change the “Last updated” date above.