Privacy Policy

# Privacy Policy

**Last updated:** [DATE]

Hajiparvaneh Systems ("Hajiparvaneh Systems," "we," "us," or "our") provides software architecture and product engineering services, including scalable .NET backends, structured web platforms, and full-stack product development from concept through production.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you visit our website, submit an inquiry, request a consultation, communicate with us, or engage us for services.

## 1. Data controller

The data controller is:

If Hajiparvaneh Systems is established outside the European Economic Area, identify the EU representative here where legally required: [INSERT EU REPRESENTATIVE OR STATE NOT APPLICABLE].

## 2. Personal data we may collect

Depending on how you interact with us, we may collect:

- Identity and professional contact information, such as name, business email address, telephone number, job title, company, and country; - Inquiry and consultation information, including project objectives, technical requirements, budget range, timelines, and information included in messages or uploaded files; - Communications and scheduling information, including meeting invitations, correspondence, call notes, and consultation recordings where recording has been separately disclosed and consented to where required; - Website and device data, such as IP address, browser type, device information, pages viewed, approximate location, and log data; - Marketing preferences, consent records, and unsubscribe requests; - Client and prospective-client information necessary to prepare proposals, perform services, manage accounts, invoice, and protect our rights.

Please do not submit special-category personal data, confidential credentials, production access keys, or unnecessary personal information through a public inquiry form.

## 3. How we collect data

We collect personal data directly from you when you use an inquiry or consultation form, email us, schedule a meeting, enter into a contract, or otherwise communicate with us. We may also receive limited information from business contacts, referral partners, professional platforms, or publicly available sources, provided that the collection and use are lawful.

## 4. Purposes and legal bases

We process personal data for the following purposes:

- To respond to an inquiry or consultation request and take steps at your request before entering into a contract: **performance of a contract or pre-contractual measures**; - To provide, administer, secure, and improve our website and services: **legitimate interests**, subject to a balancing assessment, or **performance of a contract** where applicable; - To prepare proposals, statements of work, invoices, and client records: **performance of a contract** and **legal obligations**; - To communicate about an active engagement: **performance of a contract** or **legitimate interests**; - To send marketing or unsolicited commercial communications where required: **consent**. In particular, prior consent should be obtained for email marketing to individuals and in jurisdictions such as Germany where Section 7 UWG may apply, unless a clearly documented statutory exception applies; - To comply with legal obligations, prevent fraud, enforce agreements, and establish or defend legal claims: **legal obligations** or **legitimate interests**; - To use non-essential analytics, advertising, or similar cookies: **consent** obtained through the cookie consent mechanism.

Consent may be withdrawn at any time. Withdrawal does not affect processing that occurred before withdrawal.

## 5. Inquiry and consultation handling

We use inquiry information to assess fit, understand your requirements, arrange a consultation, respond to questions, and prepare a potential proposal. Access should be limited to personnel and service providers who need it for these purposes. We do not sell inquiry data.

If your inquiry contains another person's personal data, you should ensure that you have a lawful basis to provide it and have given any required notice to that person. Do not provide passwords, API keys, security vulnerabilities, regulated data, or production data through the public consultation path.

Consultation calls should not be recorded by default. If a call will be recorded, we will provide a clear notice before recording and obtain consent where required. Participants must not record a call without appropriate notice and consent.

## 6. Recipients and service providers

We may disclose personal data to carefully selected providers that support hosting, email, form processing, scheduling, customer relationship management, analytics, security, accounting, legal, and professional services. These providers must process data under appropriate contractual terms and only for authorized purposes.

We may also disclose information where required by law, court order, regulatory authority, or where necessary to protect rights, safety, systems, or property. If Hajiparvaneh Systems is involved in a merger, acquisition, financing, or sale of assets, data may be transferred subject to applicable legal requirements.

## 7. International transfers

Some providers may process personal data outside the EEA, the United Kingdom, or your country. Where required, we use an appropriate transfer mechanism, such as an adequacy decision, EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and documented supplementary measures where appropriate. The current list of relevant providers and transfer mechanisms is available from [INSERT PRIVACY CONTACT].

## 8. Retention

We retain personal data only for as long as necessary for the purposes described above, including to handle an inquiry, maintain business and tax records, resolve disputes, enforce agreements, and meet legal obligations. Unless a longer period is legally required or justified, inquiry records should be deleted or anonymized after [INSERT PERIOD, FOR EXAMPLE 12-24 MONTHS] of inactivity, and marketing records should be retained only while needed to demonstrate consent and honor suppression requests.

Client records are retained according to the applicable contract, legal requirements, and documented retention schedule.

## 9. Security

We use reasonable technical and organizational measures appropriate to the risk, including access controls, authentication, secure transmission where available, provider due diligence, backups, and incident response procedures. No internet transmission or storage system can be guaranteed to be completely secure.

## 10. Your rights

Subject to applicable law, you may have the right to request access to, correction of, deletion of, or restriction of processing of your personal data; object to processing based on legitimate interests; receive a portable copy of certain data; withdraw consent; and lodge a complaint with your local supervisory authority. You may also opt out of marketing communications at any time by using the unsubscribe mechanism or contacting us.

To exercise a right, contact [INSERT PRIVACY EMAIL]. We may need to verify your identity. We will respond within the period required by applicable law.

## 11. Children

Our services are directed to businesses and are not intended for children. We do not knowingly collect personal data from children through the consultation path.

## 12. Changes

We may update this Privacy Policy from time to time. The current version and effective date will be posted on this page. Material changes will be communicated where required.

## 13. Contact and complaints

Privacy questions and requests should be sent to [INSERT PRIVACY EMAIL] or [INSERT POSTAL ADDRESS]. You may also contact the competent data protection authority in your jurisdiction. The relevant EU supervisory authority directory is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

This template must be completed with the correct legal entity, address, providers, retention periods, transfer arrangements, and actual processing practices before publication.