Legal & Compliance

Privacy Policy
Data Protection & Rights

Effective Date: September 23, 2026. This Privacy Policy explains how DevNexa ("we", "us", or "our") collects, uses, protects, and discloses personal and business data in connection with our digital services. It applies globally, with specific provisions for clients in the EU/UK (GDPR), the United States (CCPA), and Pakistan (PECA 2016).

1. About This Policy

DevNexa is a registered digital agency providing web development, mobile development, AI integrations, branding, SEO, and dedicated-team staffing services to clients worldwide. This Policy governs all data we collect when you visit our website, contact us through any channel, or engage us under a Service Agreement.

By using our site or services you acknowledge this Policy. If you disagree with any part, please discontinue use and contact us at contact@devnexa.com.

2. Statutory Compliance Framework

DevNexa operates under the laws of the Islamic Republic of Pakistan and maintains compliance with:

  • Prevention of Electronic Crimes Act (PECA), 2016 — governing electronic data and communications.
  • Personal Data Protection Bill (Pakistan) — applied on a best-practice basis ahead of formal enactment.
  • General Data Protection Regulation (GDPR) — for data subjects in the European Union and United Kingdom.
  • California Consumer Privacy Act (CCPA / CPRA) — for California residents.
  • Income Tax Ordinance, 2001 & FBR regulations — governing tax records retention periods.
  • Anti-Money Laundering Act (AMLA), 2010 — for financial due-diligence on engagements.

3. Categories of Information We Collect

We collect and process the following categories:

  • Identity & Contact Data: Legal name, company name, registration numbers (NTN/CNIC/company registration), email address, and phone number.
  • Financial & Billing Data: Bank account details, IBAN/SWIFT, invoice history, and payment tokens. We do not store raw credit or debit card numbers.
  • Project & Technical Assets: Source code, database schemas, deployment keys, API credentials, automation configurations (n8n/Make), and design files shared with us for project delivery.
  • Usage & Analytics Data: IP addresses, browser type, pages visited, session duration, referral URLs, and device identifiers collected automatically when you use our website.
  • Communications Data: Records of emails, WhatsApp messages, and calls exchanged with our team in relation to service delivery.

4. How We Use Your Information

We use collected data to:

  • Deliver, manage, and improve the services you have contracted, including web, mobile, AI, and branding deliverables.
  • Issue invoices, process payments, and maintain accurate financial records as required by the FBR.
  • Communicate project updates, milestone approvals, and support responses.
  • Conduct security audits and access management to protect your technical assets.
  • Send marketing communications if you have opted in — with a clear unsubscribe link in every message.
  • Comply with legal obligations including tax audits, AML checks, and judicial orders.

5. Legal Basis for Processing (GDPR Article 6)

For clients subject to GDPR, our lawful bases are:

  • Contract Performance (Art. 6(1)(b)): Processing necessary to deliver the services you have engaged us for.
  • Legal Obligation (Art. 6(1)(c)): Tax record-keeping, AML checks, and regulatory reporting.
  • Legitimate Interests (Art. 6(1)(f)): Fraud prevention, security monitoring, and portfolio case-study creation where no NDA restricts this.
  • Consent (Art. 6(1)(a)): Marketing emails and optional analytics tracking — you may withdraw consent at any time.

6. Cookies & Tracking Technologies

Our website uses cookies and similar technologies.

Essential cookies are required for core site functionality and cannot be disabled. Analytics cookies (e.g., Google Analytics) help us understand traffic patterns — these are activated only with your consent. We do not use advertising or cross-site tracking cookies.

You can manage cookie preferences through your browser settings or our cookie consent banner at any time.

7. Data Retention & Security Safeguards

Client records, contracts, and financial documents are retained for a minimum of six (6) years following project completion, as mandated by Pakistani tax audit regulations. Technical assets (source code, credentials) are deleted within thirty (30) days of project handover and written client confirmation.

Security controls include:

  • AES-256 encryption for credentials shared via secure vault tools (Bitwarden / 1Password).
  • Mandatory Multi-Factor Authentication (MFA) on all code repositories, cloud consoles, and internal admin systems.
  • Role-based access control (RBAC) — engineers access only the repositories and environments required for their assigned deliverables.
  • Periodic third-party security audits and penetration testing of client-facing systems.
  • Encrypted, off-site database backups with a 30-day retention window.

8. Cross-Border Data Transfers

DevNexa operates with clients and sub-contractors across Pakistan, North America, the UAE, and Europe. Technical and personal data may be transferred to and processed in these jurisdictions.

For transfers of EU/UK personal data outside the EEA, we use Standard Contractual Clauses (SCCs) approved by the European Commission. A current sub-processor list is available on written request at contact@devnexa.com.

9. Third-Party Service Providers & Sub-Processors

We engage trusted sub-processors for clearly defined purposes only, including:

  • Supabase — database hosting and authentication.
  • Vercel / AWS / Google Cloud — infrastructure and deployment.
  • Stripe / Wise / PayPal — payment processing.
  • OpenAI / Anthropic — AI integration services for client deliverables.
  • Google Analytics — website usage analytics (with consent).
  • Zoom / Slack / WhatsApp Business — project communications.

10. Your Data Rights

Depending on your jurisdiction, you hold one or more of the following rights:

  • Right of Access: Receive a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete data.
  • Right to Erasure: Request deletion of data no longer required for contractual or legal purposes.
  • Right to Restrict Processing: Pause certain processing activities while a dispute is resolved.
  • Right to Data Portability: Receive your data in a structured, machine-readable format.
  • Right to Object: Object to processing based on legitimate interests or for direct marketing at any time.
  • Right to Withdraw Consent: Where processing is consent-based, withdraw it at any time without affecting prior processing.

11. Changes to This Policy

We review and update this Policy at least annually and whenever significant changes occur in our data practices or applicable law. Material changes will be communicated by a prominent notice on our website and, where required by law, by direct notification to affected clients at least thirty (30) days before the change takes effect.

12. Contact & Data Protection Officer

To exercise your rights, submit a data inquiry, or report a suspected breach, please contact:

Email: contact@devnexa.com Response time: Within 72 hours for breach notifications; within 30 days for all data subject requests.

Questions about this policy? Contact our Data Protection Officer at contact@devnexa.com