Privacy Policy

1. Who we are and what this policy covers

Almware Ltd. ("Almware", "we", "us" or "our") operates the AlmOps website at almops.com, Solution Builder and customer portal, and provides discovery, software development, managed hosting and support services. We are the controller of personal data handled for our own website, accounts, enquiries, billing and business administration.

This policy covers visitors, prospective customers, account holders, customer representatives and people who contact us. It complements our Terms of Service.

Where we process personal data inside a customer's application on that customer's instructions, the customer normally acts as controller and we act as processor. The relevant service agreement and data processing agreement govern that processing; this website policy does not replace them. Requests about such data should first be directed to the customer responsible for the application.

2. Information we handle

• Enquiries and project requests: your name, email, company, phone number if supplied, messages, business requirements, answers, selected features and files submitted through forms, Solution Builder, the customer portal, email or another agreed channel.
• Accounts and authentication: profile details, email verification, password hashes where a local password is used, linked sign-in identities and session and security records. If you sign in with Google, we receive the verified email and identity information needed to link or create your account; we do not receive your Google password.
• Customer administration: business contact details, proposals, contracts, invoices, payment status and support correspondence when you enter a business relationship with us.
• Technical and security information: IP address, browser and device information, requested pages, access times, authentication events and diagnostic records needed to operate and protect the service.

Please share only information needed for your enquiry. Do not send passwords, payment card details, special-category personal data or another person's confidential information unless we have agreed an appropriate secure channel and a lawful purpose.

Submitted requirements and files

When you submit a request or upload a file, we receive and process that content to understand your workflow, analyse requirements, prepare a proposal and carry out the agreed project. Drafts and project records may be stored so you and authorised team members can continue work and review its history.

We may use AI-assisted tools to analyse the information you submit, organise requirements, suggest questions, prepare specifications and support development and testing. Relevant content may be processed by approved providers for these purposes, subject to applicable confidentiality and data protection terms. Do not include unnecessary personal data or secrets in a request or attachment.

Content submitted through your organisation's project may also be accessible to its authorised users and representatives. You must have permission and a lawful basis to provide information about other people. Where we process that information on your organisation's instructions, the applicable data processing agreement governs our role.

3. Purposes and legal bases

• Responding and preparing a proposal: steps you request before a contract, or our legitimate interest in communicating with a business representative.
• Accounts and project access: contract performance where you are a party, and legitimate interests in authenticating authorised users, managing project requests and keeping accounts secure.
• Delivering an agreed service: contract performance where you are a party, and legitimate interests in administering services and communicating with your organisation.
• Invoicing and records: legal obligations, including accounting and tax requirements.
• Security and claims: legitimate interests in protecting systems, investigating misuse and establishing or defending legal claims.
• Optional marketing: consent where required. You may withdraw consent or object to direct marketing at any time.

We consider the effect on your rights when relying on legitimate interests. Reading this policy is not consent to optional processing. Information needed to answer a request or fulfil a contract is voluntary to provide, but without it we may be unable to respond or deliver the requested service.

AI-assisted analysis supports our team and your project decisions. It does not replace your approval of scope or our review of delivery. We do not make decisions about you with legal or similarly significant effects based solely on automated processing.

4. Cookies and browser storage

We use necessary cookies and related storage to maintain authenticated sessions, protect requests and support essential service functions. Customer portal sessions expire after 30 days unless ended or revoked earlier. These functions do not depend on consent to optional tracking.

Our first-party activity journal records public page views, navigation, selected calls to action and external transitions. It uses a random browser identifier in the almops_visitor cookie, which expires 365 days after the last accepted activity. This journal operates independently of optional analytics preferences. Records include available technical and referral information, such as IP address, browser, language, time zone, screen size, country and campaign parameters. Form contents, passwords and authentication tokens are excluded. Browser history may be linked to your account after successful sign-in; the browser identifier itself does not establish your identity.

Optional analytics, marketing technologies and external media requiring consent are used only after the required consent is obtained. Where such tools are offered, their notice and consent controls explain the choices and how to change them. You can also manage cookies in your browser, although blocking necessary cookies may prevent sign-in or other service functions.

Customer applications and third-party sign-in providers may have their own cookie notices.

5. Recipients and international transfers

Information may be accessible to authorised Almware staff and contractors and, as necessary, providers supporting hosting, storage, email, authentication, customer support, accounting, payment processing and AI-assisted analysis or development. Their access must be limited to the relevant purpose and subject to appropriate confidentiality and data protection obligations.

Project-specific hosting, integrations and AI tools follow the agreed service and data processing terms. We limit the information shared with providers to what is needed for the relevant task. Third-party sign-in and payment providers also process information under their own privacy notices.

We may disclose information where legally required, to professional advisers, to address security incidents or to protect legal rights. A corporate reorganisation may involve transferring relevant business records subject to applicable data protection requirements. We do not sell personal data.

If processing involves a country outside the European Economic Area, we use an applicable lawful transfer mechanism, such as an adequacy decision or standard contractual clauses with additional safeguards where necessary. You can request information about safeguards relevant to your data.

6. Retention and security

We retain account information while an account is active and as necessary afterwards for security, legal obligations or claims. Requirements, uploaded files, drafts and project history are retained for the enquiry or service relationship and any agreed handover or retention period. For correspondence, retention depends on whether an enquiry remains active, leads to a contract or is needed for a dispute.

Customer and financial records are retained for the relationship and the applicable statutory or legal-claims period. Operational and security logs are limited to the period needed for their purpose. Backup copies may remain until the relevant backup cycle expires, subject to appropriate access restrictions.

We remove or anonymise information when its purpose and applicable retention obligations end. A legal hold may require longer retention. Ask us for the retention criteria applicable to a particular record.

We use proportionate organisational and technical safeguards. Customer-specific access, backup, hosting and incident arrangements are set out in the relevant agreement. No internet service can promise absolute security.

7. Your rights and complaints

Subject to applicable conditions, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You can always object to direct marketing. Withdrawing consent does not affect earlier lawful processing.

Email support@almware.com with your request. We may ask for proportionate information to verify your identity. We normally respond within one month; if a lawful extension is needed, we will explain it.

You may complain to a competent supervisory authority, including the Cyprus Commissioner for Personal Data Protection, or the authority where you live or work. You do not have to contact us first.

8. External services and children

Links to external websites, applications or services take you to environments with their own privacy terms. Review those terms before submitting information.

AlmOps is intended for business users, not children. We do not knowingly collect children's personal data through this website. Contact us if you believe a child has sent us personal information so we can assess and remove it where appropriate.

9. Changes and contact

We update this policy as our services and data practices change. The date above identifies the current version. Where required, we will give additional notice of material changes.

Almware Ltd.
Nicosia, Cyprus
Privacy: support@almware.com
General enquiries: hello@almops.com