Privacy Policy

Who is responsible for your data

Astoe Company is responsible for the information collected through this website and during the projects we build. Our contact details are at the bottom of this page, and a real person reads what arrives there.

What this website collects

Two things, and nothing else.

• What you type into the enquiry form: your name, company, email address, phone number, the type of system you are asking about, and your message.
• What any web server records automatically: your IP address, the time of the request, the page asked for, and the browser you used. This is kept short term for security and for working out why something broke.
• We run no advertising pixels, no behavioural tracking and no third party analytics on this site. Nobody is buying a profile of you from us, because there is not one.

Card and payment details

We never see your card number. When a payment is taken, the card details are entered on the payment provider's own secure page and handled entirely by them under the card industry security standards they are certified against.

What comes back to us is the outcome: whether the payment succeeded, the amount, the currency, a reference number, and the name and contact details on the order. That is what we need to raise an invoice and to process a refund, and it is all we keep.

Why we hold it

• To answer your enquiry and to quote for the work you asked about
• To deliver a project you have engaged us for, and to keep in touch while it runs
• To issue invoices and receipts, and to keep the accounting records the tax law requires
• To keep the site working and to stop the contact form being abused by bots and bulk senders

Cookies

This site sets one cookie: a session cookie that keeps the contact form's security token valid while you are filling it in, and lets us count how many messages have been sent from one browser so the form cannot be flooded. It carries no name, no email and no advertising identifier, and it ends when you close the browser.

There are no marketing cookies here and nothing to opt in to. If that ever changes, this page changes with it and you will be asked first.

Who else sees it

Only the companies we need to run the business, and only for that purpose. None of them are permitted to use your data for anything of their own, and we do not sell data to anybody, at any price.

• Our hosting provider, which stores the website and the messages sent through it
• Our email provider, which carries the enquiry to our inbox and our reply back to you
• Our payment provider, when you pay for a project
• Google Fonts and the code libraries this site loads, which receive your IP address the way any file you download from another server does
• A court, regulator or tax authority, where the law obliges us to hand something over

Data inside a system we build for you

When we build or repair a system, we often need to work with your real data: your customers, your staff, your stock, your ledgers. In that situation the data stays yours and we only act on your instructions.

We ask for test copies rather than live databases wherever the work allows it. We keep access to your accounts only while the project needs it, and we remove local copies of your data once the work is handed over. If you want written confirmation that it has been deleted, ask and we will send it.

How long we keep things

• Enquiries that do not turn into a project: up to twenty four months, then deleted
• Project correspondence and scope documents: for as long as the system is in use, so we can answer questions about why something was built the way it was
• Invoices and payment records: for the period the tax law of Pakistan requires, which is longer than we would otherwise keep them
• Server logs: a short rolling window, typically no more than ninety days

Where it is stored

On servers operated by our hosting and email providers. Some of those servers sit outside Pakistan, which is normal for any business using ordinary internet hosting, and the providers we use apply recognised security standards to the machines your data sits on.

What you can ask us to do

Write to us and we will do any of the following, free, within thirty days.

• Tell you what we hold about you and send you a copy
• Correct anything that is wrong
• Delete what we hold, unless a tax or legal rule says we must keep it
• Stop contacting you, which we will honour immediately and permanently

How it is protected

The site is served over an encrypted connection. The contact form is protected against forged submissions and against being used as a relay for bulk mail. Access to the machines that hold enquiries is limited to us and protected by unique passwords and two factor authentication where the provider offers it.

No system is beyond every attack, and anyone who tells you otherwise is selling something. What we can promise is that if data of yours is ever exposed, we will tell you plainly and quickly rather than quietly.

Children

This site is for businesses and is not directed at children. We do not knowingly collect information from anyone under eighteen. If a child has sent us something, tell us and it will be deleted.

Changes to this policy

When what we collect changes, this page changes first, and the date at the top moves with it. Any change that materially affects what we do with information already given to us will be sent to the email address we hold for you rather than left here to be discovered.

How to reach us about this

Write to us in whichever way suits you. Anything sent about a policy, a payment or a refund is answered by a person, not a queue, and normally within one working day.