Privacy policy. Your data, explained plainly.

Creta Systems (“Creta”, “we”, “us”) is a software house that builds its own products and delivers software for clients worldwide. We are responsible for the personal data collected through cretasystem.com and when you contact us, work with us or apply to work with us.

For any privacy question, write to info@cretasystem.com or call 0336 8957401.

What you give us

• Contact details such as your name, email address, phone number, company and role when you email, call or message us.
• Project information you choose to share: briefs, goals, timelines, budgets, files and feedback.
• Billing details such as company name, address and tax information when you become a client.
• Application details such as your CV, portfolio and references if you apply to work with us.

What we collect automatically

• Technical data recorded by our hosting provider when you load a page: IP address, browser and device type, pages requested, referring page and time of the request.
• Cookie choices, stored in a single cookie so we don’t ask you again. See our cookie policy.
• Usage data from analytics, only if you allow analytics cookies.

We don’t ask for sensitive data, such as health, religious or biometric information. Please don’t send it to us unless a project genuinely needs it and we have agreed how it will be handled.

We only use personal data where we have a lawful reason to. In practice, that means:

We don’t sell personal data, and we don’t use it for automated decisions that have legal or similarly significant effects on you.

When we build or maintain software for a client, we may handle personal data that belongs to that client’s users. In that case the client is the controller and we act as their processor: we follow their written instructions, keep the data confidential and use it only to deliver the agreed work.

If you are a user of a product we built for someone else, please contact that company first about your data. We will help them answer you.

We share personal data only when we need to, and only with:

• Service providers who help us run the business, such as hosting, cloud infrastructure, email, file storage, project management and accounting tools. They may only use the data to provide their service to us.
• Professional advisers such as lawyers and accountants, under a duty of confidentiality.
• Authorities when the law requires it, or to protect our rights, our clients or the public.
• A buyer or successor if Creta Systems is ever merged, sold or restructured, in which case this policy will continue to protect your data.

We work online with clients worldwide, so your data may be processed in a country other than your own, including Pakistan and the countries where our service providers operate. Where the law requires it, such as for data from the EU, EEA or UK, we put appropriate safeguards in place, for example standard contractual clauses, before the data is transferred.

• Enquiries that don’t become projects: up to 24 months after our last conversation.
• Client and contract records: for the length of the relationship, then as long as tax and accounting law requires.
• Job applications: up to 12 months, unless you agree to us keeping them longer.
• Server logs: up to 90 days, unless needed to investigate a security incident.
• Your cookie choice: 6 months, then we ask again.

When data is no longer needed, we delete it or anonymise it so it can no longer identify you.

We use encrypted connections (HTTPS), access controls, strong authentication and the principle of least privilege, so only the people who need data to do their job can reach it. No system is perfectly secure, but if a breach ever puts your data at risk, we will tell you and the relevant authorities as the law requires.

Depending on where you live, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete your data when we no longer have a reason to keep it;
• restrict or object to how we use it, including for direct marketing;
• send your data to you or another organisation in a portable format;
• withdraw consent you have given, at any time, without affecting earlier use.

Write to info@cretasystem.com. We will reply within 30 days, and may ask you to confirm your identity first. Using these rights is free. You can also complain to your local data protection authority, though we would appreciate the chance to put things right first.

This website and our services are for businesses and adults. We don’t knowingly collect personal data from anyone under 16. If you believe a child has sent us their data, tell us and we will delete it.

Products built under Creta Systems, such as Hoopoe, have their own privacy notices that explain how each product handles data. Links on this site to client projects and other websites lead to services we don’t control, so please read their policies too.

We will update this policy when our practices or the law change, and show the new date at the top of this page. If a change is significant, we will make it clear on the website or tell you directly.