Privacy Policy

01Who we are

This website is run by NiyoSpace Technologies (“NiyoSpace”, “we”, “us”), a web, ecommerce and mobile app development company and a sister company of Aspirant Solutions, part of the Aspirant Group.

NiyoSpace is the data controller for the personal information described in this policy. This means we decide how and why it is used.

• Registered office: [Registered office address]
• Email: disturbus@niyospace.com

02What this policy covers

This policy explains how we handle personal information when you:

• visit niyospace.com;
• email us, book a call or ask for a quote;
• become a client, or work with us on behalf of a client;
• apply to work with us or are a supplier to us.

It does not cover personal information inside the websites, stores and apps we build for clients. There, the client is in control and we act on their instructions (see section 05).

03Information we collect

Information you give us

• Contact details: your name, business email, phone number, job title, company and country.
• Project information: what you want to build, your goals, budget and timeline, and any files, designs or documents you share.
• Call and meeting notes: notes we take during discovery calls and project meetings.
• Billing details: company name, billing address, tax or VAT number and payment records. Card and bank details are handled by the payment provider, not stored by us.
• Correspondence: the emails and messages you send us.

Information collected automatically

• Server logs: like most websites, our hosting provider records technical details when you visit, such as your IP address, browser type, the pages you request and the time of the request. These are used to keep the site running and secure.
• Fonts and icons: our pages load typefaces from Fontshare and Google Fonts and icons from unpkg. To deliver these files, those providers receive your IP address and basic browser information.

We do not use analytics, advertising or tracking cookies on this website.

Information from other sources

We may receive your details from someone who refers you to us, from Aspirant Group companies, or from public business sources such as your company website or LinkedIn profile.

04How we use it

We only use personal information when we have a reason to. For visitors and clients in the European Economic Area (EEA) and the UK, the table below also shows the legal basis we rely on under the GDPR and UK GDPR.

We do not sell personal information, use it for targeted advertising, or make decisions about you based only on automated processing.

05Data in client projects

When we build, test or support a client's website, store, app or platform, we may have access to personal information about the client's own customers, users or staff. In that case the client is the controller, and NiyoSpace acts as a processor (or “service provider”). We:

• only use that data to deliver the work the client asked for;
• keep it confidential, under an NDA from day one;
• limit access to the team members who need it;
• return or delete it when the project ends, unless the law requires us to keep it;
• sign a Data Processing Agreement (DPA) on request.

If you are a customer of one of our clients, please contact that business directly about your data.

06Who we share it with

We share personal information only when needed, and only with:

• Service providers who help us run our business, such as website hosting, email, cloud storage, video calls, project management and payment providers. They may only use the data to provide their service to us.
• Aspirant Group companies, where they help deliver or support your project.
• Professional advisers such as accountants, auditors and lawyers.
• Authorities, when the law requires it or to protect our rights.
• A buyer or successor, if our business is ever reorganised, merged or sold.

We do not sell or rent personal information, and we do not “share” it for cross-context behavioural advertising, as those terms are defined under California law.

07International transfers

We work with clients in the US and Canada, the Middle East and Europe, and our team is based in India. Your information may therefore be transferred to, and stored in, countries other than your own, including India and the countries where our service providers operate.

When we transfer personal information out of the EEA, the UK or Switzerland, we use recognised safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. For transfers from other countries, we take the steps required by the local law that applies. You can ask us for a copy of the safeguards we use.

08How long we keep it

• Enquiries that do not become projects: up to 24 months after our last contact.
• Client and contract records: for the length of our relationship, then up to 7 years for tax, accounting and legal purposes.
• Client project data: as set out in the client contract, and returned or deleted at the end of the project.
• Server logs: for a short period, usually no longer than 90 days.

When we no longer need information, we delete it or make it anonymous.

09Security

We protect personal information with access controls, strong passwords and two-factor authentication on our tools, encrypted connections (HTTPS), confidentiality agreements with our team, and by giving access only to the people who need it.

No system is completely secure. If a data breach affects your personal information, we will notify you and the relevant authorities where the law requires.

10Your rights by region

Your rights depend on where you live. Wherever you are, you can always ask us what information we hold about you and ask us to correct or delete it.

European Economic Area and United Kingdom

Under the GDPR and the UK GDPR, you have the right to access, correct or delete your data; to restrict or object to how we use it; to data portability; and to withdraw consent at any time. You can also complain to your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).

United States

If you live in California or another US state with a consumer privacy law (such as Virginia, Colorado, Connecticut, Utah or Texas), you may have the right to:

• know what personal information we collect, use and disclose;
• access, correct and delete your personal information;
• opt out of the sale or sharing of personal information and targeted advertising (we do not do either);
• not be treated differently for using your rights.

In the last 12 months we have collected identifiers (such as name, email and IP address), professional information (such as job title and company), commercial information (such as project and billing records) and internet activity (server logs), for the purposes described in section 04. You may use an authorised agent to make a request for you.

Canada

Under PIPEDA and provincial laws, including Quebec's Law 25, you can access and correct your personal information and withdraw your consent, subject to legal and contractual limits. You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Middle East

If you are in the UAE, Saudi Arabia, Qatar, Bahrain or another country in the region, you have the rights given by your local data protection law. These include the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Saudi Personal Data Protection Law, Qatar's Law No. 13 of 2016 and Bahrain's Law No. 30 of 2018. They generally include the right to access, correct and delete your data, to object to certain uses, and to complain to the relevant regulator. Separate rules apply in the DIFC and ADGM free zones.

India

Under the Digital Personal Data Protection Act, 2023, you can ask for a summary of the personal data we hold about you, ask us to correct, complete, update or erase it, and nominate someone to exercise your rights. You can raise a complaint with our Grievance Officer (section 15) and, if it is not resolved, with the Data Protection Board of India.

11Making a request

To use any of your rights, email disturbus@niyospace.com with the subject “Privacy request”. Please tell us what you would like us to do.

• We may ask you to confirm your identity before we act.
• We reply within one month, or within the time your local law sets (for example, 45 days under California law). If we need longer, we will tell you why.
• Making a request is free, unless it is clearly unfounded or excessive.

12Cookies and storage

Our website does not set analytics, advertising or tracking cookies. On the home page we save one small setting in your browser's session storage so the opening animation only plays once per visit. It contains no personal information and is cleared when you close the tab.

If we add analytics, an online booking tool or other services that use cookies in the future, we will update this policy and, where the law requires, ask for your consent first.

13Children

Our services are for businesses. This website is not aimed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us their information, please contact us and we will delete it.

14Changes to this policy

We may update this policy from time to time. The date at the top of the page shows when it last changed. If we make important changes, we will let our clients know directly.

15Contact us

For any question about this policy or your personal information, please contact:

• NiyoSpace Technologies, [Registered office address]
• Email: disturbus@niyospace.com
• Grievance Officer (India): [Name], disturbus@niyospace.com
• EU / UK representative: [Name and address, if appointed]