Privacy Policy

Who we are

Nycto is the trading name of [legal entity name and form], a company registered in [place of registration] under company number [company registration number], with its registered office at [registered address]. We are the controller of the personal data described here, except where we act as a processor for a client (see 'Clients and their staff').

Our team works from Pakistan, and we are registered with the Federal Board of Revenue in Pakistan under [FBR registration / NTN]. This matters for your privacy rather than being an administrative detail: it means the people who build and support your systems access data from Pakistan, and the 'International transfers' section below explains the safeguards that applies. [Counsel: confirm which entity contracts with clients and which is controller, and document the intra-group arrangement between them.]

Contact us at info@nyctosys.com, on +92 333 1000195, or by post at the address above. Put 'Privacy' in the subject line.

We have not appointed a data protection officer. [Counsel to confirm no DPO is required under Art. 37 GDPR.]

EU representative

We are established outside the EU, in Pakistan, and offer services to people in the EU, so Art. 27 GDPR requires us to appoint a representative in the EU unless our processing is occasional, low-risk and does not involve special categories of data on a large scale (Art. 27(2)).

Our representative is [EU representative name], [EU representative address], [EU representative email]. You can contact the representative instead of us on anything in this policy, including data requests and complaints.

If counsel concludes the Art. 27(2) exemption applies, this section will be replaced by a short note saying so.

What we collect

What we collect depends on how you deal with us.

Why we use it and on what basis

The GDPR requires a lawful basis (Art. 6) for each purpose. Each line below gives the purpose, the data, the basis and the retention period. Where we rely on legitimate interest, we have weighed our interest against yours and concluded ours does not override your rights; you can object at any time (see 'Your rights') and we will explain the balance on request.

• Running and securing the website. Data: hosting access logs. Legal basis: legitimate interest (Art. 6(1)(f)) in keeping the site available and detecting abuse. Kept: [access-log retention period], default 30 days.
• Answering enquiries and quoting. Data: name, contact details, message content, phone or WhatsApp number. Legal basis: steps at your request before a contract (Art. 6(1)(b)) if you contract with us personally; otherwise our legitimate interest in responding to business enquiries (Art. 6(1)(f)). Kept: 24 months after our last contact.
• Delivering a project and managing the relationship. Data: client staff contact details, project communications, access details. Legal basis: performance of the contract (Art. 6(1)(b)) if you contract with us personally; otherwise our legitimate interest in performing the contract with your employer (Art. 6(1)(f)). Kept: life of the contract, then 7 years as part of the contract record.
• Invoicing, accounting and tax. Data: billing contacts, invoices, payment records. Legal basis: legal obligation (Art. 6(1)(c)) under the company and tax law that applies to us [Counsel to confirm the retention period under Pakistani law]. Kept: 7 years after the end of the financial year in which the contract ended.
• Processing personal data inside client systems. Data: whatever those systems contain. Legal basis: the client's lawful basis; we act as processor under Art. 28 on the client's instructions. Kept: as the DPA says; deleted or returned when the service ends.
• Establishing, exercising or defending legal claims. Data: any of the above, as relevant. Legal basis: legitimate interest (Art. 6(1)(f)). Kept: until the limitation period runs, which we take as 7 years by default. [Confirm the limitation period with counsel under the chosen governing law.].
• Recruitment. Data: application data. Legal basis: steps before a contract (Art. 6(1)(b)) and our legitimate interest in hiring (Art. 6(1)(f)). Kept: 6 months after the decision, longer only with your consent.
• Social media pages. Data: profile data, comments, messages. Legal basis: legitimate interest (Art. 6(1)(f)) in presenting our work and replying to people. Kept: on the platform under its rules; not copied by us.
• Showing you as a client on our website. Data: company name and logo, and where a testimonial names a person, that person's name and role. Legal basis: your agreement in the contract; for a named person, consent (Art. 6(1)(a)). Kept: until you withdraw or the contract says otherwise.
• Marketing email. Data: name and email address. Legal basis: consent (Art. 6(1)(a)) only. Kept: until you withdraw.

Who we share it with

We do not sell personal data. We share it only with the recipients below, and only what each needs. We keep a list of the processors we use, with each one's name, country and purpose; email us and we will send you the current list.

• Hosting provider: [hosting provider legal name], [server location]: serves the website and keeps the access logs.
• Email provider: [email/mailbox provider for info@nyctosys.com]: stores and delivers our email.
• Communication and project tools: WhatsApp (Meta) for messages you send us there; [other tools used during projects, e.g. video calls, project tracking, file sharing].
• Subcontractors and freelancers: specialists we bring into a project under written confidentiality and data-processing terms. We tell clients before a subcontractor touches their data.
• Professional advisers: accountants, lawyers and insurers, when we need their advice or a claim arises.
• Banks and payment providers: to receive payment from you.
• Public authorities, courts and regulators: where the law requires it or to protect our rights.
• A buyer or successor: if we sell or restructure the business, under the same protections as this policy.

International transfers

Our team works from Pakistan, and we would rather state that plainly than bury it.

Pakistan has no adequacy decision from either the European Commission or the UK government, so personal data reaching us from the EU, EEA or UK is a restricted transfer and needs safeguards. We do not rely on adequacy to cover it.

For data reaching us from the EU or EEA we use the Standard Contractual Clauses in Commission Decision (EU) 2021/914, supported by a transfer impact assessment. For data reaching us from the United Kingdom we use the UK International Data Transfer Agreement, or the UK Addendum to the EU SCCs, supported by a transfer risk assessment. [Counsel to complete both assessments and confirm which instrument is used where.]

When you email or message us directly, you send the data to us yourself. The European Data Protection Board treats that as a direct disclosure rather than a transfer by a controller. We still apply the protections below to it.

When an EU client sends us personal data, the client is the exporter and we are the importer. Our safeguard is the Standard Contractual Clauses in Commission Decision (EU) 2021/914. We sign Module 2 (controller to processor) or Module 3 (processor to processor) as part of our DPA, and Module 1 (controller to controller) on request for our own records about your staff.

Under the SCCs we commit to supplementary measures: encryption in transit for every connection; encryption at rest for client data we hold; access limited to named people on the project; challenging any government access request we consider unlawful and telling the client where the law allows; and telling you if we can no longer meet the SCCs. [Counsel to complete the transfer risk assessment once the team's actual working location is confirmed.]

Where the SCCs do not cover a one-off situation, we rely on Art. 49(1)(b) (the transfer is necessary for a contract with you, or for steps you asked for before one) or Art. 49(1)(c) (a contract in your interest between us and your employer). We do not rely on derogations for regular transfers of client data.

Our own providers may sit outside both the UK and the EEA. Where they do, we use their SCCs or another Chapter V mechanism; the processor list states each provider's country.

If you are in the UK, the same protections apply under the UK GDPR. For transfers from the UK we use the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs.

How long we keep data

These periods are defaults set for this policy and should be confirmed by counsel against the law that governs our contracts. When a period ends we delete the data or anonymise it. Backups that still hold deleted data are overwritten within [backup cycle, default 90 days].

• Website access logs: [access-log retention period], default 30 days.
• Enquiries that do not lead to a project: 24 months after our last contact.
• Client contact details and project communications: life of the contract, then 7 years.
• Contracts, invoices and payment records: 7 years after the end of the financial year in which the contract ended.
• Client data we process as a processor: as the DPA says; by default deleted or returned within 30 days of the end of the service, except copies the law requires us to keep.
• Access credentials clients give us: revoked or deleted when the work they were issued for is finished.
• Job applications: 6 months after the decision; longer only with your consent.
• Consent records (testimonials, marketing): as long as we rely on the consent, then 3 years as proof.
• Legal holds: if a claim is threatened or started, we keep the relevant data until it is resolved, whatever the period above.

Security

We protect data in ways proportionate to the risk (Art. 32). We commit to the following. [Team to confirm each measure is in place before publishing; verify HTTPS is enforced on www.nyctosys.com.]

No system is perfectly secure. If a breach affects your data and is likely to put your rights at risk, we will tell you without undue delay, and we will notify the supervisory authority within 72 hours where Art. 33 requires it. Where we are a processor, we tell the client without undue delay so the client can notify.

• Every connection to our website and to the tools we use is encrypted with TLS.
• Accounts use strong, unique passwords and multi-factor authentication wherever the service offers it.
• Access to client data is limited to the people working on that project, and client credentials are kept in a password manager, never in email or chat.
• Devices that hold client data are encrypted and kept up to date with security patches.
• Data is deleted when its retention period ends.

Your rights

Under Arts 15 to 22 GDPR you have the rights below over personal data we hold as controller. If the data belongs to one of our clients (we are the processor), we will pass your request to the client and help them answer it.

To use a right, email info@nyctosys.com with 'Data request' in the subject line, or contact our EU representative. If we cannot tell from the request that it is you, we may ask you to confirm your identity, usually by replying from the email address we hold for you. We answer within one month. If a request is complex or you have made several, we can extend by up to two further months and will tell you within the first month why. Requests are free; if one is clearly unfounded or excessive we may charge a reasonable fee or refuse it, and we will explain why (Art. 12).

• Access (Art. 15): ask whether we hold data about you and get a copy, with the information in this policy applied to your data.
• Rectification (Art. 16): ask us to correct inaccurate data or complete incomplete data.
• Erasure (Art. 17): ask us to delete your data, for example when we no longer need it or you withdraw consent; we can refuse where the law requires us to keep it or for a legal claim.
• Restriction (Art. 18): ask us to freeze processing while a dispute about accuracy or lawfulness is resolved.
• Portability (Art. 20): for data you gave us that we process by automated means under consent or a contract, receive it in a common machine-readable format or have it sent to another controller.
• Objection (Art. 21): object to processing based on our legitimate interests; we stop unless we show compelling grounds that override yours. Objection to direct marketing is absolute: we stop.
• Automated decisions (Art. 22): not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We make no such decisions.

Withdrawing consent

Where we rely on your consent, for example to name you in a testimonial or to send you marketing email, you can withdraw it at any time by emailing us. One email is enough. Withdrawal does not affect what we did while the consent was valid (Art. 7(3)).

Complaints

If you think we have mishandled your data, tell us first and we will try to put it right.

You also have the right to lodge a complaint with a supervisory authority (Art. 77). You can go to the authority in the EU member state where you usually live, where you work, or where the alleged breach happened. The European Data Protection Board lists every national authority at edpb.europa.eu. In the UK the authority is the Information Commissioner's Office (ico.org.uk). You can also bring a court claim in the member state where you live (Art. 79).

Automated decision-making

We do not make decisions about you by automated means alone, and we do not profile you. If a client asks us to build a system that does, for example an AI chatbot or an automated screening tool, the client is the controller for that system and must explain it in its own policy.

Children

Our website and services are for businesses. They are not directed at anyone under 16 and we do not knowingly collect data from children. If you believe a child has sent us personal data, email us and we will delete it.

Changes to this policy

We may update this policy when our services, providers or the law change. The date at the top shows the current version. If a change matters to you, for example a new processor for client data or a new purpose, we will tell existing clients by email before it takes effect. Older versions are available on request.

Review by counsel

This document is a template drafted for Nycto. It has not been reviewed by a lawyer. It must be reviewed by qualified legal counsel, in particular on the EU representative question, the transfer impact assessment, the retention periods and the governing law, before it is relied upon or published as final.