GDPR & Data Processing

Roles

When you contact us or subscribe to our updates, NETREX INC acts as data controller. When we build, host or operate systems on your behalf, we act as data processor under your instructions and a signed Data Processing Agreement.

Lawful bases

• Contract performance for delivery of agreed services.
• Legitimate interests for business communications with existing clients.
• Consent for marketing communications and non-essential cookies.
• Legal obligation for tax, accounting and statutory record keeping.

International transfers

Where personal data leaves the EEA or UK, we rely on adequacy decisions or the European Commission Standard Contractual Clauses combined with a transfer impact assessment and supplementary technical measures such as encryption and pseudonymisation.

Your rights

• Access, rectification and erasure of your personal data.
• Restriction of and objection to processing.
• Data portability in a structured, machine-readable format.
• Withdrawal of consent at any time.
• Complaint to your local supervisory authority.

Exercising your rights

Send requests to privacy@netrexinc.com. We verify identity and respond within one calendar month, extendable by two months for complex requests with notice to you.

Regional legal framework

NETREX applies this policy through the contract, delivery location and data flows relevant to each engagement. Requirements can differ by jurisdiction, industry and client role, so the signed agreement and applicable law take priority over this general policy.

• United Arab Emirates: UAE federal laws and relevant free-zone requirements, including applicable personal data protection, electronic transactions, cybercrime, employment and commercial rules.
• Pakistan: applicable data, electronic transactions, employment, tax and company requirements, together with sector-specific directions where they apply.
• United Kingdom: UK GDPR, Data Protection Act 2018, PECR, Equality Act 2010, Bribery Act 2010 and Modern Slavery Act 2015 where applicable.
• Germany and the European Economic Area: GDPR, ePrivacy requirements, accessibility rules and applicable German commercial and employment obligations.
• United States: applicable federal and state privacy, consumer protection, accessibility, employment, anti-bribery and breach-notification requirements determined by the engagement and affected individuals.
• Canada: PIPEDA and applicable provincial privacy, consumer, employment and electronic communications requirements.
• Australia: Privacy Act 1988, Australian Privacy Principles, Spam Act 2003, consumer law and applicable workplace requirements.
• Saudi Arabia: Personal Data Protection Law, electronic transaction, cybercrime, employment and commercial requirements where the engagement is in scope.
• Singapore: Personal Data Protection Act, Computer Misuse Act, anti-spam and applicable employment and commercial requirements.

Accountability and evidence

• A named engagement owner is responsible for applying contractual and policy controls.
• Material decisions, approvals, access changes and incidents are documented in the relevant project records.
• Personnel receive instructions appropriate to their role, and access is reviewed when responsibilities change.
• Supplier and sub-processor obligations are assessed according to the service, information handled and delivery location.
• Records are retained only for operational, contractual or legal needs and disposed of through controlled processes.

Review, questions and escalation

This document is reviewed at least annually and after a material legal, operational or security change. Questions, evidence requests or concerns may be sent to info@netrexinc.com for routing to the appropriate NETREX owner.

This public document describes our operating approach and is not legal advice, a certification statement or a replacement for a signed client agreement. NETREX obtains specialist advice where a project creates jurisdiction-specific obligations outside the agreed delivery scope.