Privacy Policy
This Privacy Policy explains how func.tech ("func.tech", "we", "us" or "our") collects, uses, shares and protects personal data when you visit our website, contact us, do business with us as a client, partner or supplier, or apply for a job with us.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data, Law 125(I)/2018.
1. Who we are
func.tech is a software development outsourcing company registered in the Republic of Cyprus. For the processing described in this policy, func.tech is the data controller.
- Company: func.tech
- VAT number: 60249890W
- Registered office: Avenue 15, Leoforos, Arch. Makarios III Avenue 181-3030, Limassol, Lemesos 3095, Cyprus
- Office address: Antigonis, Limassol, Lemesos 3031, Cyprus
- Email: help@func.tech
- Phone: +357 99 065 903
2. Scope of this policy
This policy applies to personal data of:
- visitors to our website;
- people who contact us by email, phone or other channels;
- representatives and contact persons of our existing and prospective clients, partners and suppliers;
- job applicants and candidates.
It does not cover personal data that we process on behalf of our clients while delivering software development services. In that case our client is the controller and we act as a processor. See section 5.
3. Personal data we collect
Data you give us
- Contact data: name, job title, company, business email address, phone number.
- Communication data: the content of your messages, project briefs, meeting notes and correspondence with us.
- Contract and billing data: company details, billing address, VAT or tax number, bank details and payment history, and the names of people who sign or manage contracts.
- Recruitment data: CV, work history, education, skills, portfolio, links to professional profiles, salary expectations, interview notes and test assignment results.
Data collected automatically
- Technical data: when you visit our website, our hosting provider automatically records standard server logs, which may include your IP address, browser type, operating system, referring page, pages requested and the date and time of the request.
Data from other sources
- Publicly available business information, for example from company registers, your company website or professional networks.
- Information from recruitment agencies or job platforms when you apply through them, and references you have authorised us to contact.
We do not intentionally collect special categories of personal data (such as health data, racial or ethnic origin, or political opinions). Please do not send us such data unless we specifically ask for it and a legal basis applies.
4. How and why we use personal data
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Responding to enquiries and requests for proposals | Steps taken at your request before entering into a contract (6(1)(b)); our legitimate interest in replying to business enquiries (6(1)(f)) |
| Negotiating, concluding and performing contracts with clients, partners and suppliers, including project communication | Performance of a contract (6(1)(b)); our legitimate interest in managing relationships with the organisations whose representatives you are (6(1)(f)) |
| Invoicing, accounting, tax and other statutory obligations | Compliance with a legal obligation (6(1)(c)) |
| Recruitment: assessing applications, interviewing and making offers | Steps taken at your request before entering into a contract (6(1)(b)); our legitimate interest in hiring suitable candidates (6(1)(f)) |
| Keeping a candidate's CV for future vacancies | Your consent (6(1)(a)), which you may withdraw at any time |
| Operating, securing and troubleshooting our website and IT systems | Our legitimate interest in keeping our services available and secure (6(1)(f)) |
| Sending occasional business updates to existing business contacts | Our legitimate interest in direct marketing to business contacts (6(1)(f)), or your consent where required by law. You can opt out at any time. |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting our rights (6(1)(f)) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about this assessment. We do not use personal data for automated decision-making that produces legal or similarly significant effects on you, and we do not sell personal data.
5. Data we process on behalf of clients
While developing, testing, deploying or supporting software for our clients, our team may get access to personal data held in client systems, for example end-user data in a client's database or application. In these cases:
- the client is the data controller and decides why and how that data is processed;
- func.tech acts as a processor and processes the data only on the client's documented instructions and for the purpose of providing the agreed services;
- the processing is governed by our service agreement and a data processing agreement that meets the requirements of Article 28 GDPR;
- our personnel with access to client data are bound by confidentiality obligations;
- at the end of the engagement we return or delete client data as instructed by the client, unless the law requires us to keep it.
If you are an end user of one of our clients' products and want to exercise your data protection rights, please contact that client directly. If you contact us instead, we will forward your request to the client without undue delay.
6. Cookies
Our website does not use advertising, analytics or other tracking cookies, and does not load third-party tracking scripts. If we introduce non-essential cookies in the future, we will update this policy and ask for your consent before setting them, where consent is required.
7. Who we share personal data with
We share personal data only where necessary and only with:
- Service providers who process data on our behalf, such as website hosting, email and office software, cloud storage, communication tools, accounting and payroll providers. They act under contracts that require them to protect the data and use it only on our instructions.
- Professional advisers such as lawyers, auditors, accountants and insurers, who are bound by confidentiality.
- Our clients, where you are a candidate or team member proposed for a client project, limited to professional information relevant to that project.
- Public authorities, courts and regulators, where we are required to do so by law or need to establish, exercise or defend legal claims.
- A buyer or successor in connection with a merger, acquisition, reorganisation or sale of all or part of our business, subject to equivalent confidentiality and data protection safeguards.
8. International data transfers
Some of our service providers, clients or team members may be located outside the European Economic Area (EEA). When we transfer personal data outside the EEA, we make sure it is protected by one of the safeguards provided by the GDPR: an adequacy decision of the European Commission, Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism. You can request a copy of the relevant safeguards by contacting us.
9. How long we keep personal data
We keep personal data only for as long as necessary for the purposes it was collected for, in particular:
- Enquiries that do not lead to a contract: up to 2 years after our last communication.
- Client, partner and supplier records: for the duration of the relationship and up to 6 years after it ends, to meet accounting and tax obligations and to handle possible claims.
- Accounting and tax documents: for the period required by Cyprus law.
- Unsuccessful job applications: up to 6 months after the recruitment process ends, or up to 2 years if you consent to us keeping your CV for future vacancies.
- Website server logs: up to 90 days, unless needed longer to investigate a security incident.
When the retention period ends, we delete or anonymise the data.
10. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include encryption in transit, access control based on the principle of least privilege, multi-factor authentication, regular updates of our systems, confidentiality obligations for our staff and contractors, and careful selection of service providers. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the competent authority of a personal data breach where the law requires it.
11. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy of it;
- Rectification of inaccurate or incomplete data;
- Erasure of your data in certain circumstances;
- Restriction of processing in certain circumstances;
- Data portability, meaning to receive data you provided to us in a structured, machine-readable format, or have it transmitted to another controller;
- Object to processing based on our legitimate interests, and to object at any time to direct marketing;
- Withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, email us at help@func.tech. We will respond within one month of receiving your request. That period may be extended by two further months for complex requests, in which case we will tell you. We may ask you to confirm your identity before acting on a request. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
12. Complaints
If you have concerns about how we handle your personal data, please contact us first so that we can try to resolve them. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place. In Cyprus, the supervisory authority is the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).
13. Children
Our website and services are intended for businesses and professionals. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
14. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The current version is always available on this page, with the date of the latest update shown at the top. Where changes are significant, we will take reasonable steps to inform you.
15. Contact us
For any questions about this Privacy Policy or our handling of personal data, contact us:
- Email: help@func.tech
- Phone: +357 99 065 903
- Post: func.tech, Avenue 15, Leoforos, Arch. Makarios III Avenue 181-3030, Limassol, Lemesos 3095, Cyprus