Privacy Policy

1. Scope and Controller

This Privacy Policy describes how HUK SONS IT Private Limited ("we", "us", "our") collects, uses, stores, and protects personal information. We act as the Data Controller for personal data collected through our public website (huksonsit.com), transactional processes, and marketing communications.

2. Legal Bases for Processing (GDPR Article 6)

If you are located in the United Kingdom or European Economic Area (EEA), we only process your personal information when we have a valid legal basis under Article 6 of the General Data Protection Regulation (GDPR):

• Consent (Art. 6(1)(a)): You have given clear, explicit consent for us to process your data for a specific purpose (e.g., signing up for our newsletter via our double opt-in consent framework). You can withdraw this consent at any time.
• Performance of a Contract (Art. 6(1)(b)): Processing is necessary to fulfill our obligations under a signed service agreement or statement of work, or to take pre-contractual steps at your request (e.g., generating a quote).
• Legal Obligation (Art. 6(1)(c)): Processing is necessary for us to comply with statutory legal requirements (e.g., corporate tax records, compliance audits).
• Legitimate Interests (Art. 6(1)(f)): Processing is necessary for our legitimate business interests, provided those interests do not override your fundamental rights and freedoms (e.g., detecting and preventing web fraud, network security monitoring, and server logs).

3. Data Categories We Collect

We collect only the minimum necessary data to achieve our business objectives:

• Identifiers & Contact Information: Name, professional email address, telephone number, corporate employer name, job title, and service interest details submitted via form fields.
• Consent Evidence: For newsletter and preference signups, we log the user's IP address, User Agent, submission timestamp, confirmation timestamp, and cryptographic signature in the double opt-in JWT payload.
• Network & Usage Data: IP address (coarse country level), browser type, referring pages, and technical parameters collected cookielessly.

4. Sub-processors and Third-Party Disclosures

We utilize third-party vendors (sub-processors) to deliver infrastructure, transactional emailing, and scheduling. All sub-processors operate under signed Data Processing Addenda (DPAs) incorporating standard contractual clauses:

5. International Data Transfers

As a global consultancy, we transfer and store information in data centers located in the European Union, the United States, and our development office in Pakistan. When transferring personal data outside the UK or EEA, we ensure a similar degree of protection is afforded by implementing appropriate safeguards, specifically:

• Transferring to countries deemed to provide an adequate level of protection by the European Commission.
• Utilizing standard contractual clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office (ICO).

6. Technical & Organizational Security Measures

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed, altered, or disclosed in an unauthorized way:

• Encryption: All website traffic and API calls are strictly encrypted in transit using TLS 1.3. Internal data storage (where applicable) is encrypted at rest using AES-256.
• Access Control: Access to client databases and email logs is strictly restricted to authorized engineers on a need-to-know basis, protected by multi-factor authentication (MFA).
• Security Scanning: Automatic network firewall checks and threat scanning are active via Cloudflare security rules to block injection attacks, botnets, and DDoS incidents.

7. Data Retention Policy

We only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements:

• Contact Form Queries: Purged from temporary email logs after 90 days.
• Newsletter Signups: Retained for the duration of the subscription plus 30 days following an unsubscribe request (for audit compliance logs).
• Client Contract Records: Retained for 3 years following the completion of service delivery to comply with local trade laws and tax audits.

8. Your Legal Rights

Under applicable privacy laws, you possess rights including the right to access, correct, delete, object to, and transfer your data. To exercise these rights, please follow the submission instructions on our Data Subject Request Page.

You also have the right to make a complaint at any time to the relevant supervisory authority in your jurisdiction (such as the UK Information Commissioner's Office or the EU Data Protection Board). We would, however, appreciate the chance to deal with your concerns before you approach the authority, so please contact us first.

9. Contact

If you have any questions about this Privacy Policy or our privacy practices, please contact our Data Protection Officer:

Email: privacy@huksonsit.com
Address: House No 2, Street No 1, Garden Town, Girls College Road, Bahawalpur 63100, Punjab, Pakistan