Privacy Policy
How Magnus Mage handles your data — what we collect, why, and the rights you have over it.
Magnus Mage is a deep-tech product and protocol engineering firm headquartered in Lahore, Pakistan, working with clients worldwide. This Privacy Policy explains what personal data we collect when you use this website or engage our services, how we use it, and the choices and rights you have.
It applies to visitors to our website, prospective and current clients, job applicants, and anyone who contacts us. Where a specific engagement is governed by a separate data processing agreement, that agreement takes precedence over this policy for the data covered by it.
If you have any questions about this policy or how your data is handled, contact us at [email protected].
1. Information we collect#
This section describes the categories of personal data we collect — information you give us directly (such as when you fill in a contact or application form), information collected automatically (such as device and usage data), and information from third parties (such as analytics providers).
What you send us. When you use a form on this site we receive your name, work email, and whatever else that form asks for — company, region, the kind of work you are planning, an indicative budget and timeline, and your message. A job application additionally receives your links, location, right-to-work position and the CV you attach.
What your browser sends. Our servers log the IP address, user agent, requested page and timestamp of each request. We use those logs to keep the site up and to rate-limit abuse of the contact form; they are not joined to anything else and are not used to build a profile of you.
What we do not collect. No analytics, no advertising identifiers, no cross-site tracking, no cookies, and no special-category data. We never ask for payment-card details, government identifiers or passwords through this website.
2. How we use information#
We use personal data to respond to enquiries, deliver and improve our services, manage recruitment, meet legal and contractual obligations, and keep our systems secure. We do not sell personal data.
We use what you send to reply to you, scope the work you are asking about, and keep a record of the conversation so a colleague can pick it up. Job applications are used to assess your application and to contact you about it.
We use request logs to operate and secure the site — detecting abuse, enforcing rate limits and diagnosing faults.
We do not sell or share personal information, and we do not use it to advertise to you or to train models.
3. Legal bases for processing (GDPR)#
Where the GDPR applies, we rely on one or more lawful bases for each processing activity — consent, performance of a contract, compliance with a legal obligation, or our legitimate interests. This section sets out which basis applies to which activity.
Steps prior to a contract (Article 6(1)(b)). Replying to an enquiry and scoping proposed work, and assessing a job application you submitted.
Legitimate interests (Article 6(1)(f)). Keeping the site available and secure, preventing abuse of the contact form, and retaining a record of business correspondence. We have weighed these against your interests and consider them proportionate — the data is minimal and we do not profile.
Legal obligation (Article 6(1)(c)). Retaining records where tax, accounting or employment law requires it.
Consent (Article 6(1)(a)). Anything optional, such as loading a third-party booking page. Consent is asked for before the thing happens and can be withdrawn at any time.
5. Data retention#
We keep personal data only for as long as needed for the purpose it was collected, or as required by law. This section sets out our retention periods and the criteria we use to determine them.
Enquiries that do not become engagements: 24 months from last contact, then deleted.
Enquiries that become engagements: kept for the life of the engagement and 7 years afterwards, which is the period Pakistani tax and company law expects business records to be available for.
Job applications: 12 months from the decision, so we can come back to you if a suitable role opens. Tell us to delete sooner and we will.
Server logs: 90 days, then rotated out.
6. International transfers#
Because we work with global clients and providers, personal data may be transferred outside your country. Where it is, we put appropriate safeguards in place — such as standard contractual clauses — to protect it.
Magnus Mage is based in Pakistan and works with clients in the US, Europe, the Gulf and Asia, so your data may be accessed from, or stored in, a country other than your own.
Where personal data covered by UK or EU law leaves that jurisdiction, we rely on the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, together with a transfer risk assessment. Where a provider is covered by an adequacy decision, we rely on that instead. A copy of the clauses we rely on is available on request.
7. Your rights#
Depending on where you live, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. This section explains those rights and how to exercise them.
Depending on where you live you may have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to receive it in a portable format, to restrict or object to how we use it, and to withdraw consent you previously gave. Under the CCPA you may also ask us to tell you what we collected and to delete it, and you will not be treated differently for asking.
Email [email protected] and say what you want. We will confirm receipt, may ask for enough information to be sure it is really you, and will respond within 30 days — or tell you why we need longer, which we may take up to a further 60 days for a complex request.
There is no charge. If you are not satisfied with our answer you may complain to your data protection authority — in the UK the Information Commissioner's Office, in the EU the supervisory authority where you live or work.
9. Security#
As an engineering firm, security is central to how we operate. We apply appropriate technical and organizational measures to protect personal data against loss, misuse, and unauthorized access.
The site is served over TLS with HSTS, a strict Content Security Policy, and headers that block framing, MIME sniffing and cross-origin leakage. Form submissions are validated on the server, protected by a signed single-use token and rate limits, and are never written into a page. Access to the systems holding enquiry data is limited to the people who need it and protected by multi-factor authentication.
No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and tell you directly without undue delay where the risk is high.
10. Children’s privacy#
Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children. This section sets out our position and what we do if we learn we have.
This is a business website and is not directed at children. We do not knowingly collect personal data from anyone under 16, or under 13 where that is the applicable threshold.
If you believe a child has sent us personal data, email [email protected] and we will delete it.
11. Changes to this policy#
We may update this policy from time to time. When we do, we will revise the “last updated” date above and, where changes are significant, provide a more prominent notice.
We update this policy when what we do changes. The date at the top always reflects the current version.
For a change that materially affects your rights or how we use your data, we will say so prominently on this page for at least 30 days before it takes effect, and email you directly where we hold your address and the change warrants it. Continuing to use the site after a change takes effect means the updated policy applies.
12. Contact & data protection queries#
For any question about this policy, to exercise your rights, or to raise a data protection concern, contact us using the details below. We aim to respond within a reasonable timeframe and always within any statutory deadline.