The Privacy Policy
1. Who We Are
Magna Software is a software development and technology services company. In this Privacy Policy, ‘we’, ‘us’, ‘our’ or ‘Magna Software’ refers to Magna Software Ltd.
| Our Details | |
|---|---|
| Company Name | Magna Software Ltd |
| Role under GDPR | Data Controller (employee and client contact data) | Data Processor (client end-user data) |
| Contact Email | contact@magnasoftware.co.uk |
| Data Protection Lead | Ali Abdullah — Cybersecurity Analyst / Privacy Lead |
| Website | www.magnasoftware.co.uk |
| Supervisory Authority | Information Commissioner's Office (ICO) | ico.org.uk | 0303 123 1113 |
2. What This Policy Covers
This Privacy Policy explains how Magna Software collects, uses, stores, shares, and protects personal data relating to:
- Our employees and contractors (including remote workers based in Pakistan)
- Job applicants
- Clients and client contacts
- Website visitors
- Any other individuals whose personal data we process as a Data Controller
- Important — Remote Workers in Pakistan: Magna Software employs staff who work remotely from Pakistan. The transfer of personal data to Pakistan is a third-country transfer under UK GDPR. We use the UK International Data Transfer Agreement (UK IDTA) to ensure all such transfers are lawful and provide equivalent protection. See Section 9 for full details.
3. Personal Data We Collect and Why
We do not make decisions based solely on automated processing that would have a significant legal or similarly significant effect on you.
We only collect personal data that is necessary for a specific, identified purpose. The table below sets out what data we collect, why, and the legal basis under UK GDPR Article 6.
| Our Details | Data Collected | Purpose | Legal Basis |
|---|---|---|---|
| Employee & Contractor Data | Name, address, DOB, NI number, bank details, salary, tax code, sickness records, performance data, emergency contacts | Managing employment, payroll, legal compliance | Art.6(1)(b) Contract | Art.6(1)(c) Legal Obligation | Art.9(2)(b) Employment Law |
| Remote Worker Data (Pakistan) | Device details, VPN logs, working hours, IP address (business use) | Secure remote working, employment management across borders | Art.6(1)(b) Contract | Art.6(1)(f) Legitimate Interest |
| Job Applicants | Name, email, CV, interview notes, references, right-to-work documents | Assessing employment suitability | Art.6(1)(b) Contract | Art.6(1)(f) Legitimate Interest |
| Client Contacts | Name, job title, email, phone, company, contract info, billing details | Managing client relationships and service delivery | Art.6(1)(b) Contract | Art.6(1)(f) Legitimate Interest |
| Website Visitors | Name, email, company, marketing preferences | Sending relevant communications | Art.6(1)(a) Consent | Art.6(1)(f) Legitimate Interest |
| IT Support / Helpdesk | Name, device details, issue description (may contain incidental personal data) | Providing technical support | Art.6(1)(b) Contract |
4. Special Category Data
Certain categories of personal data require additional protection under UK GDPR Article 9. Magna Software processes:
- Health and sickness data — for statutory sick pay and reasonable adjustments (Article 9(2)(b) — Employment Law)
- Disability information — for workplace accommodations under the Equality Act 2010
- Health data is stored separately from standard HR records. Access is strictly restricted to HR Manager and Managing Director only. This data is never shared with line managers without explicit employee consent.
5. How Long We Keep Your Data
We do not keep personal data longer than necessary. Detailed retention periods are documented in our Data Retention Policy (MAGNA-GDPR-RET-001). Key periods:
| Data Type | Retention Period |
|---|---|
| Employee HR records | Duration + 6 years post-employment |
| Payroll records | 6 years from end of tax year |
| Duration + 6 years | contact@magnasoftware.co.uk |
| Right-to-work documents | 2 years post-employment |
| Client contracts | 7 years from contract end |
| Website enquiries | 2 years from enquiry date |
| Remote worker access logs (Pakistan) | 12 months rolling |
| Unsuccessful job applicant records | 6–12 months after recruitment process closes |
6. Who We Share Your Data With
We only share personal data where necessary and with appropriate safeguards. Key recipients:
| Recipient | Data Shared |
|---|---|
| Payroll provider (UK) | Name, NI number, salary, bank details |
| Pension provider (UK) | Name, salary, contribution amounts |
| HMRC | PAYE, NI contributions reporting |
| Occupational health provider | Health data (with employee consent) |
| Cloud hosting provider (AWS EU) | Client/application data |
| Microsoft 365 | Work emails and collaboration data |
| Pakistan-based remote workers | Secure access to company systems and project data under controlled remote-working arrangements |
7. How We Keep Your Data Secure
Magna Software implements technical and organisational measures in line with ISO 27001 and ISO 27701:
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- Multi-factor authentication on all systems
- Role-based access control
- Full-disk encryption on company devices (including Pakistan-based worker devices)
- VPN mandatory for all remote access
- Annual penetration testing and vulnerability assessments
- Documented incident response and data breach notification procedure
8. Your Rights Under UK GDPR
You have 8 rights under UK GDPR. Contact contact@magnasoftware.co.uk to exercise any:
| Right | What It Means |
|---|---|
| Right of Access (SAR) | Request a copy of all data we hold about you within one month. This may be extended by up to two additional months for complex or numerous requests. |
| Right to Rectification | Request correction of inaccurate data |
| Right to Erasure | Request deletion where no legal basis remains |
| Right to Restrict Processing | Pause processing during a dispute |
| Right to Data Portability | Receive data in a structured, machine-readable format |
| Right to Object | Object to processing based on legitimate interests |
| Rights re Automated Decisions | Not be subject to solely automated significant decisions |
| Right to Withdraw Consent | Withdraw consent at any time without penalty |
| Right to Lodge a Complaint | Lodge a complaint with the Information Commissioner's Office (ICO) |
9. International Data Transfers — Pakistan
- Pakistan is not currently recognised by the UK as providing an adequate level of data protection. Magna Software implements UK International Data Transfer Agreements (UK IDTAs), documented Transfer Risk
- Assessments (TRAs), and supplementary technical and organisational safeguards for applicable international transfers.
| Transfer Detail | Information |
|---|---|
| Destination Country | Islamic Republic of Pakistan |
| Adequacy Decision | NO — Pakistan does not have UK adequacy status |
| Transfer Mechanism | UK International Data Transfer Agreement (UK IDTA) — ICO-approved, in force from 21 March 2022 |
| IDTA Parties | Magna Software Ltd (UK Data Exporter) | Each Pakistan-based worker (Data Importer) |
| Data Transferred | Employee HR data (own), client project data, internal business data |
| Additional Safeguards | VPN mandatory | Device encryption | Remote wipe capability | Access logs 12 months | No local data storage | Annual IDTA review |
| Your Rights | All UK GDPR rights (Section 8) apply in full — even though you work from Pakistan |
10. Cookies
Our website uses cookies and similar tracking technologies. You can manage your preferences via our Cookie Consent Banner when you first visit our website.
| Cookie Type | Purpose & Legal Basis |
|---|---|
| Strictly Necessary | Required for website functionality and security. These cookies are exempt from consent requirements under PECR. |
| Analytics / Performance | Google Analytics — understand visitor behaviour | Legal basis: Consent |
| Functional | Remember your preferences | Legal basis: Consent |
11. Data Breaches
In the event of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, we will:
- Notify the ICO within 72 hours of becoming aware
- Notify affected individuals if the breach is likely to result in a high risk
- Take immediate steps to contain and remediate the breach
12. Changes to This Policy
We review this Privacy Policy annually and when significant changes occur. Material changes will be notified by email before implementation.
13. How to Contact Us
We review this Privacy Policy annually and when significant changes occur. Material changes will be notified by email before implementation.
| Contact Type | Details |
|---|---|
| General Privacy Enquiries | contact@magnasoftware.co.uk |
| Subject Access Requests | contact@magnasoftware.co.uk — include full name and identifying detail |
| Data Breach Report | contact@magnasoftware.co.uk |
| Complaint to Supervisory Authority | ico.org.uk | 0303 123 1113 |
Discuss your project
React JS
Kubernetes
Node JS
Kotlin
Windows Connector
Azure
Ubuntu
Wordpress
Python
Jenkins
Ngnix
Docker
ELK
Micro Services
Android
AWS
IOS
JAVA
