Privacy

policy.

Framyn Tech (Private) Limited (“we”, “us”, “our”) is a technology and innovation company based in Lahore, Pakistan. We provide custom software, digital products, automation, cloud and related technology services to clients in Pakistan and around the world.

This policy explains how we handle personal data when you:

• visit our website www.framyntech.com or contact us;
• subscribe to our newsletter;
• are a client, or work for a client or prospective client of ours; or
• apply for a job or engagement with us.

Two roles. For personal data about website visitors, leads, our own clients’ contacts and job applicants, we are the controller: we decide why and how it is used. When we build, host, deploy or manage systems for a client and that work involves the client’s own data, we are normally the client’s processor (or “service provider”). We handle that data only on the client’s documented instructions and under our written agreement with them. If your data is held in a client’s system, please contact that client first about your rights.

Information you give us

• Name, work email, phone number, company and job title.
• Messages, project requirements and files you send through forms, email, calls or meetings.
• Newsletter sign-up details: name and email.

Client and contract information

• Contact details of client representatives, contract and billing details, tax information and payment records.

Information collected automatically on our website

• IP address, browser and device type, operating system, language, pages viewed, time spent, referring site and approximate location derived from IP address.
• Collected through cookies and similar technologies, including Google Analytics.

Recruitment information

• CV, work history, education, portfolio or code samples, references and any details you choose to share.

Information we may access while delivering services

• Depending on the project: source code, system and application logs, access credentials and keys, configuration files, backups, databases, and user or customer records stored in client environments. We treat all of this as confidential client information (see Section 6).

We do not ask you to send us sensitive personal data, such as health, biometric, financial account or government ID numbers, through our website forms. Please do not do so.

• Respond to enquiries and prepare proposals. Legal basis: our legitimate interests, or steps requested by you before entering a contract.
• Provide, manage and support our services. Legal basis: performance of our contract.
• Invoice, collect payment and keep accounts. Legal basis: contract and legal obligation.
• Send our newsletter and marketing emails. Legal basis: your consent, or legitimate interests where the law allows. You can unsubscribe at any time.
• Understand and improve our website and services. Legal basis: consent for non-essential cookies where required, otherwise legitimate interests.
• Secure our systems and prevent fraud and misuse. Legal basis: legitimate interests and legal obligation.
• Assess job applications. Legal basis: steps prior to a contract, and legitimate interests.
• Comply with law and protect our legal rights. Legal basis: legal obligation and legitimate interests.

We do not sell your personal data. We do not use your personal data to make decisions about you based solely on automated processing.

We use cookies and similar technologies for three purposes:

• Essential: to make the website work and keep it secure.
• Analytics: we may use analytics tools, including Google Analytics, to understand how visitors use our site. These tools may collect usage data such as pages viewed and approximate location.
• Marketing: we do not currently use advertising cookies. We will update this policy and ask for consent where required if we add them.

Where required by law, including for visitors in the EEA and UK, we ask for consent before using non-essential cookies. You can also block or delete cookies in your browser settings, though some features may not work properly. If Google Analytics is active, you can opt out using Google’s browser add-on.

If you subscribe to our newsletter, we use your name and email to send updates, articles and offers. You can unsubscribe at any time using the link in every email or by writing to contact@framyntech.com. We use a third-party email service provider to send emails, which processes your email address on our behalf. Unsubscribing will not affect service-related messages about contracts or invoices.

Because we provide custom software, cloud and related technology services, we may have access to client systems and the personal data inside them. For that work:

• We act on the client’s instructions and under our written agreement, including a confidentiality (NDA) clause and, where needed, a Data Processing Agreement.
• We access only the systems and data needed to deliver the agreed work (least privilege), use named individual accounts and require multi-factor authentication for administrative access.
• We do not copy production data into development or test environments unless the client agrees, and we use masked or synthetic data where practical.
• We store credentials, keys and secrets in approved secrets-management tools, not in source code, email or chat.
• We use subcontractors or sub-processors only where permitted by the client, under written terms at least as protective as ours.
• We notify the affected client of a personal data breach without undue delay, in line with our agreement and applicable law.
• When an engagement ends, we return or securely delete client data and revoke access, as agreed, subject to any legal retention requirement.

We share personal data only where needed, with:

• Service providers that support our business, such as cloud hosting, email and collaboration, newsletter, accounting, payment and analytics providers (including Google), under confidentiality and data protection terms.
• Subcontractors or consultants working on a client project.
• Professional advisers such as lawyers, auditors, banks and insurers.
• Authorities, courts or regulators, where required by law or to protect rights and safety.
• A buyer or successor, if we are involved in a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We may adopt additional tools in future, such as a CRM, support desk, project management or recruitment software, and we will update this policy when we do.

We are based in Pakistan, and our clients and service providers may be located around the world. Your data may therefore be processed in Pakistan and in other countries where our service providers or project infrastructure operate.

Where we transfer personal data from the EEA, UK or other regions with transfer restrictions to a country without an adequacy decision, we use approved safeguards, such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (or equivalent), together with supplementary technical measures such as encryption.

We use technical and organizational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, multi-factor authentication, secure device management, regular backups, logging and monitoring, vulnerability patching, secure development practices, employee and contractor confidentiality obligations, and security awareness training.

No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires.

We keep personal data only as long as needed for the purposes in this policy or as the law requires. Our usual periods are:

• Website enquiries and leads: 6 months from last contact.
• Newsletter subscribers: until you unsubscribe.
• Client and contract records, invoices and tax records: 6 years after the contract ends, or longer if the law requires.
• Analytics data: according to the retention settings of the analytics tools we use and only for as long as reasonably needed.
• Unsuccessful job applicants: 6 months, or longer only with your consent.
• Client data held as processor: as set out in the client agreement, and deleted or returned at the end of the engagement.

Subject to applicable law, you may have the right to:

• know what personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to certain processing, including direct marketing;
• withdraw consent at any time (this does not affect earlier processing);
• receive your data in a portable format; and
• complain to a data protection authority.

To exercise a right, email contact@framyntech.com. We may need to verify your identity first. We will respond within 30 days, or within the period required by the law that applies to you.

Our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

Our website may link to third-party sites. We do not control them and are not responsible for their privacy practices.

We may update this policy from time to time. The latest version will always be on our website with its effective date. If we make material changes, we will notify you by email where we have your email address, or through a prominent notice on our website.