Privacy Policy

01General Provisions

The company undertakes to ensure maximum protection of all data provided by clients, including source code, architecture diagrams, confidential documentation and personal data. Data handling is based on the principles of transparency, minimal access and strict compliance with information protection legislation.

02Data Classification and Inventory

• All data received from clients is inventoried and classified by sensitivity level (for example: public, internal, confidential, critical).
• Source code, personal data, trade secrets and other critical information fall under the highest level of protection.

03Data Collection and Processing

• Only the data necessary to perform specific integration and maintenance tasks is collected.
• Any data processing is carried out strictly within agreed purposes and with the client's written consent.

04Data Storage and Transfer

• All data is stored only on secured servers with restricted physical and logical access.
• Data and source code are always encrypted at rest and in transit using modern cryptographic protocols.
• Storing data on employees' local devices is prohibited unless provided for by the security policy.

05Access and Control

• Access to client data is granted only to employees for whom it is strictly necessary (principle of least privilege).
• Multi-factor authentication and strict role-based access control (RBAC) are used.
• All actions with data are logged and regularly reviewed for unauthorized access.

06Source Code Protection

• Source code is stored in secured repositories with restricted access, protected by two-factor authentication.
• All employees and contractors with access to source code sign a non-disclosure agreement (NDA).
• Employees receive regular training on secure development and the handling of source code.

07Sharing Data with Third Parties

• Data may be shared with third parties only with the client's written consent and under appropriate confidentiality agreements.
• All contractors and partners are required to observe equivalent data protection standards.

08Deletion and Return of Data

• Upon termination of cooperation or at the client's request, all data and source code are deleted from corporate resources or returned to the client in an agreed format.
• Deletion is confirmed by a corresponding act.

09Incident Response

• If a security incident is detected, measures to contain and eliminate the threat are taken immediately.
• The client is informed of the incident as soon as possible and receives a report on its causes and the measures taken.

10Compliance with Standards and Training

• The company regularly audits its security policy and trains employees on current data protection standards.
• The policy is reviewed at least once a year or whenever legislation changes.

11Legal Aspects

• The company strictly complies with national and international standards (GDPR, ISO/IEC 27001, etc.) and local legislation.
• All legal matters are governed by contracts and agreements with the client.