Privacy Policy | DEVOITEX

Effective date: 1 July 2026 · Last updated: 8 November 2026

Summary

DEVOITEX is an engineering team that builds, changes, tests, launches and maintains software for clients. Our engineers use AI tools in this work and remain responsible for the result.
On this website we do not use advertising pixels or tracking cookies. We count visits with Umami, an analytics tool without cookies that runs on our own server (section 11). We also process server logs, what you send us through the contact form or by email, and a theme setting stored in your browser.
When we work on a project, a client may give us source code, documentation, access credentials and data from its systems, including personal data. For personal data in client systems we usually act as a processor on the client’s instructions (section 2).
Necessary parts of project materials may be processed by external AI providers and other service providers, including outside the EU/EEA, under the rules and safeguards described in sections 4, 8 and 9.
We do not sell personal data and do not use client materials to train our own models or for any purpose outside the agreed work without the client’s agreement.
You can exercise your data protection rights by writing to support@devoitex.com (section 13).

1. Who we are and what this Policy covers

This Privacy Policy explains how DEVOITEX (“DEVOITEX”, “we”, “us”) processes personal data when you visit devoitex.com, contact us, become our client or are connected with a client project. It also describes how we handle confidential project materials and access to client systems, because in our work they are closely linked to personal data.

Who is responsible: FOP Anna Andriivna Serdiukova (individual entrepreneur, Ukraine), tax ID 3117915209, address: 106/2 Holosiivskyi Avenue, apt. 50, Kyiv 01001, Ukraine, phone +380731234011, email: support@devoitex.com.
Contact for privacy questions and requests: support@devoitex.com.
Contact for data protection questions: support@devoitex.com.
Representative in the EU/EEA (Article 27 GDPR): we have not yet appointed a representative. Until we do, people in the EU/EEA, including Norway, can contact us directly at support@devoitex.com, and we will answer under the GDPR. When a representative is appointed, we will name it here.

This Policy provides the information required by the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), in particular its Articles 13 and 14, where its provisions apply to our activities, and by the Law of Ukraine “On Personal Data Protection” No. 2297-VI of 1 June 2010 and other applicable laws and regulations.

This Policy does not cover the websites, applications and systems of our clients. The people who use them are covered by the client’s own privacy policy, and the client decides how their data is used (section 2).

This Policy is not a contract. It does not replace our Terms of Use, the Service Agreement, a non-disclosure agreement (NDA) or a data processing agreement (DPA). Where we process personal data on behalf of a client, the terms agreed with that client, including the DPA, govern that processing.

2. Our role: controller or processor

Under the GDPR, the controller determines why and how personal data is processed, and a processor processes personal data on behalf of the controller (Article 4(7) and 4(8) GDPR). Our role depends on whose purposes the processing serves, not on who physically holds the data.

We act as controller for:

data of website visitors: server logs, contact form submissions and emails sent to us;
contact and business data of clients, prospective clients and their representatives, and our correspondence with them;
proposals, contracts, invoices, payment and accounting records;
security records of our own accounts and systems, records of incidents and of data subject requests;
data we need to comply with the law or to establish, exercise or defend legal claims.

We usually act as processor for:

personal data contained in client systems and materials that we receive or access to perform the agreed work, for example data of the client’s customers, users, website visitors and employees in databases, logs, backups, CMS, repositories or test data;
personal data of other people that the client gives us for the project.

In these cases the client is the controller (or a processor acting for its own customer), and we process such data only on the client’s documented instructions and within the agreed scope. This processing must be governed by a contract that meets Article 28 GDPR, usually a DPA. If a project involves such processing and no DPA has been signed yet, we will propose one before the work starts.

We do not use personal data from client projects for our own purposes. The exception is processing required by law, for example keeping records of a security incident or answering a lawful request from an authority; for such processing we act as controller.

Source code, architecture, business logic, configurations, keys and other trade secrets are usually not personal data in themselves, but we protect them as confidential information (section 6) under the agreements with the client. Credentials and logs often contain personal data as well, for example a named user account or IP addresses; in that case both sets of rules apply.

The service providers we use (for example, AI, hosting or email providers) act as our processors or sub-processors when they process data on our behalf. For some data, such as their own account, billing, security or abuse-monitoring data, they may act as independent controllers under their own terms (section 8).

3. Personal data we process

For each category we explain what data is involved, why we process it, on what legal basis, who receives it and how long we keep it. Your rights are described in section 13; here we note what is specific to each category.

A. Website visitors and people who contact us

Server logs. When you open the website, the web server automatically records technical data, such as your IP address, the date and time of the request, the address requested, the response code, the amount of data transferred, the referring page and your browser’s user-agent string (browser, operating system, device type).
Theme setting. If you switch between the light and dark theme, your choice is saved in your browser’s local storage. It stays on your device and is not sent to us.
Contact form. Your name, email address, company, website address, message and budget range, and, if you came from a pricing button, the type of service you selected. Together with them we record the date and time, the language of the page and your IP address. A hidden anti-spam field is also used: if it is filled in, the submission is discarded and not stored.
Email and other channels. Your message, contact details and anything else you choose to send us.
Purposes: delivering the website and keeping it secure and working; detecting and investigating attacks and errors; answering your request, clarifying your task and preparing a proposal; protecting the form from spam and abuse, including a limit on the number of submissions from one IP address.
Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR), if you contact us on your own behalf; our legitimate interests (Article 6(1)(f) GDPR) in operating a secure website that displays consistently, answering requests from businesses and their representatives and protecting the form from abuse. The checkbox in the form confirms that you have been informed about this Policy; we do not rely on it as consent to answer your request. The name, email and message fields are required because we cannot answer without them; the other fields are optional.
Recipients: our hosting provider; the providers of the tools we use to store and analyse logs; our email provider, because each form submission is also sent to our mailbox (without the IP address); team members who handle requests.
Retention: web server logs — 30 days, logs in centralised log storage — 30 days, longer only if needed to investigate a specific incident; requests that did not lead to cooperation — 12 months after the last contact; if a request leads to cooperation, it is kept as part of client data (category B). For the submission limit, a hashed (pseudonymised) form of your IP address is kept for the 10-minute limit window and deleted during later processing of the form. The theme setting stays in your browser until you clear the site data.
Specific to this category: you may object to processing based on legitimate interests and ask us to delete your request once we no longer need it.

Please do not send passwords, access keys or personal data of other people (for example, of your customers) through the form or by regular email. If the work requires them, we will agree on a secure channel (section 5).

B. Clients, prospective clients and their representatives

Data: first and last name, business email, phone number, position, company; correspondence and notes from calls and meetings; proposals, contracts and invoices; billing details (company details, tax or VAT number, address); payment history and the history of our cooperation; user names in tools we use together, such as messengers, task trackers or repository hosting.
Sources: you, your colleagues, and public sources such as company websites and business registers.
Purposes: preparing and concluding contracts, providing the services, communication and project management, invoicing and payments, accounting and tax, handling claims and disputes.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) if you are the client yourself, for example as a sole trader; our legitimate interests (Article 6(1)(f) GDPR) in working with a client company through its representatives; legal obligations (Article 6(1)(c) GDPR) for accounting and tax records.
Recipients: providers of email, messaging, video calls, task management, document storage, invoicing and accounting tools; banks and payment providers; accountants, lawyers and auditors; authorities where the law requires it.
Retention:
- contact details, business correspondence and the history of our cooperation — for the duration of the cooperation and up to 3 years after it ends, unless longer storage is needed to defend legal claims;
- contracts, invoices and accounting documents — for the periods required by applicable law;
- documents needed to defend against claims and legal disputes — until the relevant limitation periods expire.
Specific to this category: the right to data portability applies to data processed on the basis of a contract with you; deletion may be postponed for data we must keep by law.

C. Project materials and data in client systems

Data: source code and repositories, documentation and technical specifications, software architecture, configurations, logs, error reports, crash dumps and test results, integration, API and infrastructure data, database extracts, and test or production data that the client has allowed us to process. These materials may contain personal data of the client’s customers, users, employees or other people.
Sources: the client, or systems to which the client gives us access.
Our role: processor for the personal data contained in these materials (section 2); for confidential information, see section 6.
Purposes: performing the agreed work: analysis, development, changes, testing, deployment, support and security review; keeping this processing secure.
Legal basis: determined by the client as controller; we process the data on its documented instructions (Article 28 GDPR). For our own records of the work performed (for example, to invoice it or to defend claims) — Article 6(1)(b) or 6(1)(f) GDPR.
Recipients: team members working on the project; providers of AI services, hosting and cloud, repository hosting and development tools (sections 4 and 8). The client’s own systems and providers remain under the client’s control.
Retention: for the duration of the work, then returned or deleted as described in section 10 and in the agreements with the client.
Specific to this category: if your data is in a client’s system, please send requests about it to that client as controller; we will help the client respond (section 13).

D. Access credentials and secrets

Data: passwords, tokens, API keys, SSH keys, certificates and other credentials; information about access rights and connected systems; records of connections and actions, where such records are kept by us or by the systems we access.
Purposes: performing the agreed work; the security and traceability of access.
Legal basis: where credentials or access records relate to an identifiable person — processing on the client’s behalf (Article 28 GDPR) for the project work, and our legitimate interests (Article 6(1)(f) GDPR) for our own security records.
Recipients: only team members who need the access for their task, and the tools in which we store secrets (section 5).
Retention: until the task or project ends or the access is revoked, then deleted from our storage (section 10).

E. Data processed with AI tools

Data: prompts, instructions and task descriptions; fragments of code, logs, documents and other project context; generated results and the results of analysis, testing and fixes; metadata of our interaction with the AI service, such as account identifiers, timestamps and usage data.
Purposes, legal basis and our role: the same as for the underlying material (categories B, C or D). The AI providers act as our processors or sub-processors (section 4).
Recipients: the companies that provide the AI services we use (section 8).
Retention: in our own tools — as for the project materials; at the provider — according to its terms and the settings we use (section 10).

F. Payments, security and legal obligations

Data: invoices, payment records and tax data; security logs of our own accounts and systems; records of incidents and data breaches; records of data subject requests and our answers; correspondence with authorities, advisers and courts.
Purposes: complying with legal obligations, keeping our systems secure, documenting compliance, establishing, exercising or defending legal claims.
Legal basis: legal obligations (Article 6(1)(c) GDPR); our legitimate interests (Article 6(1)(f) GDPR).
Recipients: accountants, auditors, lawyers, banks and payment providers; competent authorities and courts.
Retention:
- accounting and tax documents, invoices and payment records — 5 years after the end of the calendar year to which the documents relate, unless applicable law requires a longer period;
- security logs — 12 months;
- records of incidents and data breaches — 3 years after the incident is closed;
- data subject requests and our responses — 3 years after the request is closed;
- correspondence with public authorities, advisers and courts — 3 years after the relevant matter or interaction ends, unless a longer period is required by law or to defend legal claims.
Specific to this category: the right to erasure may not apply while the law requires us to keep the data (Article 17(3) GDPR).

4. Use of artificial intelligence

AI tools are part of how our engineers work. Clients do not manage AI agents themselves: our engineers set the tasks, check the results and are responsible for what is delivered.

4.1. What we use AI for

In our work we may use third-party AI models, APIs, cloud environments and specialised tools to:

analyse requirements and architecture;
process technical materials provided by the client;
generate, refactor and fix code;
find vulnerabilities and errors;
test, document and optimise software;
prepare changes for deployment.

4.2. What an AI service may receive

Depending on the tool and the task, an AI service may receive the text of a request, source code, fragments of documents, logs, configurations, error messages, test data or other material needed for the task. Some tools work directly in a repository or development environment (so-called coding agents): they can read files in the working directory and run the commands we allow.

When we use external AI services or other cloud services, the data sent to them is processed on the provider’s infrastructure. Such data leaves our own systems, and the provider’s infrastructure may be located outside the EU/EEA (section 9).

4.3. Who processes the data

An AI model is software, not a recipient of data. The recipient is the company that provides the AI service. Depending on its terms, it processes the data as our processor or sub-processor, and for some data (for example, its own account, billing, security or abuse-monitoring data) as an independent controller.

4.4. Our rules for using AI

Only what is needed. We send an AI service only the data needed for the specific task, as far as this is technically and practically possible.
Checking the terms. Before using an AI service for client materials, we check its terms on confidentiality, data retention, use of data for training and service improvement, sub-processors and data location, and the settings available to us.
Training on client data. Whether a provider may use inputs and outputs to train or improve its models depends on its terms and on the plan and settings we use. For client materials we use only services whose terms or settings exclude such use. If such terms are not available for a tool, we do not use it for client personal data or confidential materials without the client’s agreement.
Retention at the provider. A provider may keep inputs and outputs for a limited time under its terms, for example for abuse monitoring or to meet legal requirements, even if we delete our own copies.
Secrets. We do not deliberately include passwords, keys or tokens in requests to AI services. Where a tool allows it, we exclude files with secrets from its context. A coding agent that works in an environment containing secrets can technically access them, so we use test or limited credentials where possible and do not keep production secrets in environments where AI tools run, unless this is needed for the task and agreed with the client.
Personal and production data. Where possible we work with test, synthetic, anonymised or pseudonymised data. We send production data or personal data to an AI service only when it is needed for the task and permitted by the client. We cannot guarantee that all data is anonymised: for example, logs and database extracts can contain personal data.
High-risk data. We do not send special categories of personal data, data of children, financial data or similar high-risk data to AI services unless this is strictly necessary and agreed with the client (section 6).
Human review. Engineers set the tasks, review AI-generated results, test them and decide what is delivered or deployed. AI results are not delivered to the client without review by an engineer.
No automated decisions about you. We do not make decisions about website visitors, clients or their representatives based solely on automated processing that produce legal or similarly significant effects (Article 22 GDPR).
The client’s choice. A client may ask us not to use AI tools on its project, to exclude certain providers or to use only providers it has approved. We agree on this in the proposal; it may affect the timeline and price.

4.5. List of providers

We keep a list of the AI providers and other service providers that may process client data on our behalf, with their role, purpose and processing locations. The list is provided on the client’s request and as an annex to the DPA. Where a DPA is in place, we inform the client in advance about changes to this list, as provided in the DPA (Article 28(2) GDPR).

5. Access to client systems

To do the agreed work, a client may give us access to its repositories, servers, cloud platforms, databases, websites and CMS, domains and DNS, external APIs and other services. We distinguish the following actions:

Receiving and storing credentials — only for the agreed work, in the storage described below;
Using access — only for tasks within the agreed scope;
Viewing, copying and changing data — only to the extent the task requires; we copy production data outside the client’s systems only when necessary and agreed;
Running tests, migrations and deployments — according to the working rules agreed for the project;
Actions in the production environment — changes to production and potentially destructive actions (for example, deleting data, migrations that change data, DNS changes, disabling services) are carried out according to the rules agreed with the client for the project, including which actions require the client’s prior approval;
Connecting and disconnecting third-party integrations — only as part of the agreed work. A new integration may create new data flows to third parties chosen by the client; the client, as controller, decides on them.

We follow these principles:

Least privilege: we ask only for the rights the task needs and prefer read-only access where it is enough.
Individual accounts: where the system allows it, each team member uses a personal account rather than a shared one.
Limited scope: access is limited to the project and to the team members working on it.
Storing secrets: we keep credentials in dedicated storage for secrets, such as a password manager, and not in chats, tickets or source code.
Time-limited access: where technically possible, we ask for temporary access or access with an expiry date.
Logging and audit: where the client’s systems or our tools record actions, these records are kept according to their settings. We recommend that clients enable audit logs in their systems; we do not promise logging where it has not been set up.
Revoking access: when the work ends or at the client’s request, we stop using the access, delete the credentials from our storage and ask the client to revoke the access. We recommend that clients also change passwords and rotate keys that were shared with us.
Secure transfer: please do not send credentials by regular email or through the contact form; we will agree on a secure way to transfer them, for example, secure sharing in a password manager or a one-time encrypted link.

As controller of its systems and data, the client decides what access to grant and must have the right to grant it (see the Terms of Use). This does not reduce our own obligations under the agreements with the client and applicable law.

6. Confidentiality of client projects

Personal data is information about an identified or identifiable person. Confidential information is broader: it includes source code, trade secrets, architecture, business logic, access keys and non-public documentation, whether or not it contains personal data. Personal data is protected by data protection law; confidential information is protected by the agreements with the client (the Service Agreement and, where concluded, an NDA). Often both apply to the same material.

We process client materials to perform the agreed work, for security, testing and support, and for other purposes stated in the agreements with the client or in this Policy.
We do not use client code or confidential materials to train our own models, for public demonstrations or case studies, for sale or transfer to third parties, or for any other independent purpose, unless the client has agreed to this in writing and there is a lawful basis.
If we use information about our work for internal analytics (for example, how long typical tasks take), we use only information that does not identify people and does not disclose the client’s confidential materials.
Our engineers need to read code, data and logs to understand the project, fix errors and check results. We therefore do not promise that no person will see the data; access is limited to the team members working on the project, who are bound by confidentiality obligations.

Unexpected high-risk data

Client materials may unexpectedly contain special categories of personal data (for example, health data), data of children, financial data such as bank card numbers, identity documents, passwords or keys in logs or code, or other high-risk information. If we find such data, we:

process it only to the extent the task requires and do not copy it into AI tools or other systems unless this is necessary and agreed;
inform the client and agree on next steps, such as masking, deleting the copies we hold or changing the scope of the task;
recommend changing exposed passwords and keys;
follow the incident procedure (section 12) if the finding points to a breach.

7. Purposes and legal bases

We do not use consent as a universal legal basis. For each purpose we rely on the basis that fits it:

Answering requests and preparing proposals — Article 6(1)(b) GDPR (steps at your request before a contract) or Article 6(1)(f) (legitimate interests, for representatives of companies).
Concluding and performing contracts, providing the services — Article 6(1)(b) if you are the client yourself; Article 6(1)(f) for representatives and contact persons of client companies.
Processing personal data in client projects — on the client’s documented instructions (Article 28 GDPR); the client as controller is responsible for having a legal basis.
Invoicing, accounting and tax — Article 6(1)(c) (legal obligation) and Article 6(1)(b).
Security of the website, our systems and client access; preventing abuse — Article 6(1)(f).
Investigating incidents and notifying data breaches — Article 6(1)(c) (Articles 33 and 34 GDPR) and Article 6(1)(f).
Complying with legal obligations and lawful requests from authorities — Article 6(1)(c).
Handling data subject requests, complaints and legal claims — Article 6(1)(c) for requests under Articles 15–22 GDPR; Article 6(1)(f) for claims; where special categories of data are involved, Article 9(2)(f).
Website analytics (Umami, without cookies, on our own server; section 11) — Article 6(1)(f), our legitimate interest in understanding how the website is used and improving it.
Advertising — not used on this website. If we introduce it, we will update this Policy and ask for consent where the law requires it (Article 5(3) of Directive 2002/58/EC and national law).

Where we rely on legitimate interests, we have weighed them against your interests and rights; you can object to such processing (Article 21 GDPR) and ask us for more information about this assessment. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing (Article 7(3) GDPR).

8. Who receives data

We do not sell personal data and do not share it for advertising. Inside DEVOITEX, data is available only to team members who need it for their tasks. Outside DEVOITEX, the following categories of recipients may receive data, to the extent necessary:

AI model and API providers — our processors or sub-processors; for their own account, security and abuse-monitoring data, independent controllers;
Hosting, cloud and server providers — processors;
Providers of repository hosting and of development, testing and deployment tools — processors (if the client’s own accounts are used, they are the client’s providers);
Providers of email, messaging, video calls, task management, document storage, monitoring and log management — processors;
Banks, payment and accounting services — banks and payment providers usually act as independent controllers; accounting software providers act as processors;
Professional advisers (lawyers, accountants, auditors) — usually independent controllers bound by professional secrecy;
Subcontractors (individual specialists or companies that help us provide the services), if we engage them — processors or sub-processors under written confidentiality and data protection obligations and, where the DPA requires it, with the client’s prior approval;
Authorities, courts and law enforcement — only where we are legally required to disclose data or need to do so to protect our legal rights. We check that a request is lawful, disclose only what is necessary and, where the law allows, inform the client concerned.

We use processors only under contracts that meet Article 28 GDPR, pass them only the data they need and, for transfers outside the EU/EEA, apply the safeguards described in section 9. Specific providers are named in the list described in section 4.5.

9. International transfers

Our team, our service providers and their sub-processors may process data in different countries, including outside the EU/EEA, for example in the United States. Where personal data protected by the GDPR is transferred to a country outside the EU/EEA, we use one of the mechanisms provided by Chapter V GDPR:

an adequacy decision of the European Commission (Article 45 GDPR), including, for certified US companies, the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795);
standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR, Commission Implementing Decision (EU) 2021/914), together with an assessment of the law of the destination country and supplementary measures where needed;
in exceptional cases, the derogations in Article 49 GDPR.

The location of a server does not by itself determine where data is processed: data stored in one country can be accessed remotely from another, for example by the provider’s support staff, its sub-processors or our team. Our team members and subcontractors may access data from Ukraine.

For personal data that we process on a client’s behalf, transfers follow the DPA and the client’s instructions. You can ask us for information about the safeguards used and for a copy of them (with commercial details removed) using the contacts in section 18.

10. Retention and deletion

We keep personal data only as long as needed for the purpose for which it was collected, or as long as the law requires. Periods depend on the purpose, the contract, legal requirements, the provider’s settings and technical limits; they are not the same for all data.

Requests and prospective clients: 12 months after the last contact, if no cooperation follows.
Contracts and client data: for the duration of the cooperation and then 3 years after it ends.
Accounting and tax documents: 5 years after the end of the calendar year to which the documents relate, unless applicable law requires a longer period.
Source code and project materials: for the duration of the work and 30 days after it ends, unless otherwise agreed with the client; then deleted or returned to the client as agreed with them, unless the law requires us to keep certain records.
Credentials and secrets: deleted from our storage immediately after the task or project ends or access is revoked.
Security logs and web server logs: 30 days for web server logs, 12 months for security logs; longer only while an incident is being investigated.
Data at AI providers: according to the terms of the specific provider and the service settings; this may differ from our own periods (section 4.4).
Backups: up to 90 days after the data is deleted from active systems. Until backups are overwritten according to the rotation cycle, deleted data may remain in them; during that time we do not use it for any purpose.
Personal data processed on behalf of a client: at the end of the services, deleted or returned at the client’s choice, unless the law requires storage (Article 28(3)(g) GDPR), as set out in the DPA.

When data is to be deleted, we delete active copies in our systems; backups and log entries are deleted when their retention period ends; copies at our service providers are deleted using the deletion functions and settings they provide, according to their terms. On request we confirm to the client what has been deleted or returned. We do not promise immediate and irreversible deletion from all systems at once, because backup cycles, logs and provider terms may require some time.

11. Cookies and similar technologies

Cookies: the website itself does not set cookies.
Local storage: if you switch the theme, your choice (light or dark) is stored in your browser under the name dvx-theme. This is strictly necessary to provide a function you explicitly requested, so it does not require consent (Article 5(3) of Directive 2002/58/EC). You can delete it by clearing the site data in your browser.
Language setting: if you choose a language with the language switcher, your choice is stored in your browser under the name dvx-lang, in the same way as the theme. It is used only so that the website remembers your language and is not sent to us. If you open an English page with no stored choice and your browser language is Norwegian, the website shows the same page in Norwegian; this is decided in your browser from its language setting, not from your country or IP address, and nothing is sent to us. You can delete the choice by clearing the site data in your browser.
Analytics: we count visits with Umami, an analytics tool that runs on our own server. It does not set cookies and does not store IP addresses. It records the pages you open, the site you came from, browser, operating system, device type, screen size, language and approximate location derived from the IP address. It also counts when the contact form is sent or the email link is clicked, without anything you enter in the form. We use this data only in aggregate to improve the website, do not share it with third parties and do not use it to identify you.
Advertising and pixels: not used on this website. If we introduce them, we will update this Policy, ask for consent before using non-essential technologies where the law requires it and let you withdraw consent as easily as you gave it.

12. Security and incidents

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR):

access to data and systems only for team members who need it, with the least necessary rights;
personal accounts and multi-factor authentication where the service supports it;
storing credentials in dedicated storage and not in source code, chats or tickets;
keeping software and dependencies up to date;
an encrypted connection (HTTPS) to the website; contact form data is protected from public access, and the number of submissions is limited;
backups where appropriate for the data and the system;
monitoring and logging where they have been set up.

No method of transmission or storage is completely secure, and we cannot guarantee that incidents will never occur. If we become aware of a security incident, we contain it, assess its impact, investigate the causes and document it (Article 33(5) GDPR). Then:

if the incident affects personal data that we process on a client’s behalf, we notify the client without undue delay (Article 33(2) GDPR) and help it meet its own obligations;
if we are the controller, we notify the competent supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people’s rights and freedoms (Article 33(1) GDPR), and notify the affected people without undue delay if the risk is high (Article 34 GDPR);
if the incident affects a client’s confidential information or access, we inform the client as provided in the agreements with it.

13. Your rights

Under the GDPR you have the right to:

access your personal data and receive a copy of it (Article 15);
have inaccurate data corrected (Article 16);
have data erased (Article 17);
restrict processing (Article 18);
receive the data you provided to us in a structured, machine-readable format and have it transmitted to another controller, where processing is based on consent or a contract and carried out by automated means (Article 20);
object to processing based on legitimate interests (Article 21(1)), and object at any time to direct marketing (Article 21(2));
withdraw consent at any time, where processing is based on consent (Article 7(3));
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22); we do not make such decisions;
lodge a complaint with a supervisory authority, in particular in the EU/EEA country where you live or work or where the alleged infringement took place (Article 77).

These rights are subject to conditions and exceptions set by law; for example, we may refuse to delete data that we must keep by law (Article 17(3) GDPR). If other data protection laws apply to our processing of your data, you may have rights under those laws, and we will handle your request in accordance with them.

How to make a request. Write to support@devoitex.com. If we have reasonable doubts about your identity, we may ask for information needed to confirm it (Article 12(6) GDPR), and we will not ask for more than necessary. We answer within one month of receipt; for complex or numerous requests this period may be extended by two further months, and we will tell you about the extension and the reasons within the first month (Article 12(3) GDPR). Requests are free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse to act (Article 12(5) GDPR).

Data in client systems. If we process your data on behalf of a client (for example, you are a user of a client’s website), the client decides on your request as controller. Please contact the client. If you contact us, we will forward your request to the client or tell you whom to contact, and we will help the client respond as agreed in the DPA (Article 28(3)(e) GDPR).

14. Children and special categories of data

Our services are intended for businesses and professionals; the website is not intended for children. We do not knowingly collect children’s personal data through the website. If we learn that we have received such data through the website without a lawful basis, we will delete it.

We do not ask for special categories of personal data (Article 9 GDPR), such as health data, and we ask you not to send them through the contact form. Such data, as well as data of children, may nevertheless be present in client databases, logs or documents. We process it only as a processor on the client’s instructions, to the extent the task requires, with the measures described in section 6. If a project is intended to process such data, this must be agreed separately in the DPA, with appropriate measures; the client may need to carry out a data protection impact assessment (Article 35 GDPR), and we will assist with it as agreed (Article 28(3)(f) GDPR).

15. Third-party services and links

The website and our work may involve services, websites, repositories and platforms of third parties, such as code hosting or cloud services. They process data under their own privacy policies and terms, and we recommend reading them.

In client projects, the client chooses many services for its own systems (for example, its hosting, payment provider or analytics in its product). The relationship between such services and the client is governed by their terms with the client. We are responsible for our own actions, including how we configure such services on the client’s instructions and which providers we choose for our own work. Nothing in this Policy limits our obligations under applicable law.

16. Related documents

This Policy describes how we process personal data. Other matters are governed by separate documents:

Terms of Use — use of the website and general rules of our cooperation;
Service Agreement and the approved proposal — scope, price, responsibilities and liability for the work;
a non-disclosure agreement (NDA), where concluded — confidentiality of business information beyond personal data;
a data processing agreement (DPA) — our processing of personal data on the client’s behalf under Article 28 GDPR, including sub-processors and international transfers;
the list of providers (section 4.5);
the rules for access and secrets and the incident response procedure agreed for a project — practical rules for working with the client’s systems.

If the website starts using non-essential cookies or similar technologies, we will also publish a separate Cookie Policy.

17. Changes to this Policy

The effective date and the date of the last update are shown at the top of this page. We publish each new version on this page. If we make material changes, for example new purposes of processing or new categories of recipients, we will inform clients by email or through the communication channels used in our cooperation before the changes take effect, where this is required. We will provide previous versions on request.

18. Contact

Questions and requests about personal data: support@devoitex.com or the contact form.
Postal address: 106/2 Holosiivskyi Avenue, apt. 50, Kyiv 01001, Ukraine.
Contact for data protection questions: support@devoitex.com.

Clients can also send questions about a specific project to their contact person at DEVOITEX.