Privacy Policy

Last Updated: September 10, 2025

Introduction

At MyTyTech Labs ("we," "our," or "us"), we are committed to protecting the privacy, security, and confidentiality of all data entrusted to us by our clients and their downstream customers. As a custom software and AI implementation company serving clients across diverse industries, we recognize that data privacy is fundamental to building trust and delivering exceptional service.

This policy outlines our comprehensive approach to data protection, our commitment to regulatory compliance, and the rights of individuals whose data we may process in the course of our business operations.

1. Scope and Application

This policy applies to:

All personal and business data collected, processed, or stored by MyTyTech Labs
Data provided by clients in connection with custom software and AI development projects
Downstream customer data that may be processed through our solutions
Information collected through our website, communications, and business operations
All employees, contractors, and third parties acting on behalf of MyTyTech Labs

2. Types of Information We Collect

Given the custom nature of our services, the categories of data we process vary by client and project. We may handle:

Client and Business Information

Company details, contact information, and business identifiers
Project specifications, requirements, and technical documentation
Communications and correspondence related to our services
Billing and payment information

End-User and Downstream Data

Personal data of client customers or users (as defined by each project)
Transactional, behavioral, or operational data flowing through implemented systems
Analytics and usage data from deployed solutions
Any sensitive or regulated data categories as specified in individual agreements

Website and Communication Data

Website visitors' IP addresses, browser information, and usage analytics
Contact form submissions and inquiry information
Marketing communication preferences and engagement data

3. Data Ownership and Permitted Use

Default Position

All business data and related information processed by MyTyTech Labs in connection with our services remain the exclusive property of our clients, unless otherwise expressly agreed in writing.

Permitted Use (When Applicable)

MyTyTech Labs may only use client data for product improvement, analytics, research, or other purposes if (and only if) the client provides explicit, written consent specifying such usages. Any permitted uses will be governed by additional, project-specific agreements or addenda.

Anonymization and Aggregation

Where mutually agreed, MyTyTech Labs may retain and use anonymized and aggregated data for benchmarking, research, or product development, provided that no client or end-customer can be identified from such data.

4. How We Use Information

We process data exclusively for legitimate business purposes, including:

Service Delivery: To design, develop, implement, and maintain custom software and AI solutions
Client Communication: To respond to inquiries, provide support, and communicate project updates
Quality Assurance: To test, debug, and optimize implemented solutions
Security Monitoring: To detect and prevent security threats and unauthorized access
Legal Compliance: To meet regulatory, legal, and audit requirements
Business Operations: To manage billing, contracts, and administrative functions

No Unauthorized Disclosure

MyTyTech Labs does not sell, rent, trade, or otherwise disclose client data or downstream customer information to third parties except as described below.

Permitted Disclosures

We may share information only in the following circumstances:

Client Authorization: With explicit written permission from the data owner
Service Providers: With vetted subprocessors and vendors under strict contractual obligations (detailed in Section 6)
Legal Requirements: When required by law, court order, or government regulation
Business Transfers: In connection with mergers, acquisitions, or asset sales (with prior notification)
Emergency Protection: To protect the safety and security of individuals or systems

6. Subprocessors and Third-Party Management

Subprocessor Approval

All vendors, third parties, or subprocessors with potential access to client data are:

Pre-approved by clients where contractually required
Subject to written agreements with equal or greater privacy and security standards
Regularly audited and monitored for compliance

Current Categories of Subprocessors

Cloud infrastructure providers (AWS, Google Cloud, Azure)
Development and testing tools
Communication and collaboration platforms
Payment processing services

A complete list of active subprocessors is available upon client request and updated as changes occur.

7. Data Security and Technical Safeguards

Security Framework

MyTyTech Labs employs industry-standard technical and organizational measures to protect all data:

Technical Controls

Encryption: All data encrypted in transit (TLS 1.2+) and at rest (AES-256)
Access Controls: Multi-factor authentication and role-based access restrictions
Network Security: Firewalls, intrusion detection, and secure network architecture
Monitoring: Continuous security monitoring and threat detection systems
Vulnerability Management: Regular security assessments and penetration testing

Organizational Controls

Employee Training: Regular security and privacy training for all staff
Background Checks: Security screening for personnel with data access
Incident Response: Documented procedures for security incident management
Data Minimization: Processing only data necessary for contracted services
Segregation: Strong isolation between different client environments and data

8. Compliance and Regulatory Alignment

Flexible Compliance Framework

Our processes and documentation can be aligned with client-specified regulatory frameworks, including:

GDPR (General Data Protection Regulation)
CCPA (California Consumer Privacy Act)
HIPAA (Health Insurance Portability and Accountability Act)
SOC 2 (Service Organization Control 2)
PCI DSS (Payment Card Industry Data Security Standard)
Industry-specific regulations as required by client sectors

Compliance Documentation

Upon request, we provide detailed documentation of our technical and organizational measures, compliance certifications, and audit reports.

9. Data Retention and Deletion

Retention Principles

Necessity: Data is retained only as long as necessary for the purposes outlined or as required by law
Client Direction: Retention periods are defined in individual client agreements
Secure Deletion: Upon expiration or client request, data is securely destroyed using industry-standard methods

Data Subject Rights

When processing personal data on behalf of clients, we support the fulfillment of individual rights including access, rectification, erasure, portability, and restriction of processing.

10. International Data Transfers

When client data is transferred outside the country of origin, we ensure appropriate safeguards through:

Adequacy Decisions: Transfers to countries with adequate data protection laws
Standard Contractual Clauses: EU-approved model clauses for international transfers
Binding Corporate Rules: Internal policies ensuring consistent global protection
Client Consent: Explicit approval for specific transfer arrangements

11. Incident Response and Breach Notification

Incident Management

In the event of a data security incident:

Immediate Assessment: We assess the scope and nature of the incident within 24 hours
Client Notification: Affected clients are notified promptly with full incident details
Remediation: We implement immediate containment and remediation measures
Investigation: We conduct thorough investigation and provide detailed reports
Prevention: We implement measures to prevent similar future incidents

Regulatory Notification

We assist clients in meeting their regulatory notification obligations where applicable.

12. Individual Rights and Client Responsibilities

For Personal Data Processing

Individuals whose personal data we process on behalf of clients have rights that may include:

Access to their personal data
Correction of inaccurate information
Erasure of personal data
Restriction of processing
Data portability
Objection to processing

Client Responsibilities

Our clients are responsible for:

Providing clear instructions regarding data processing
Ensuring lawful basis for data processing
Handling individual rights requests (with our assistance)
Maintaining accurate and up-to-date contact information

13. Individualized Agreements and Customization

Project-Specific Terms

For each engagement, we execute tailored agreements that address:

Specific data categories and processing purposes
Industry regulations and compliance requirements
Security controls and audit rights
Data subject rights and responsibilities
Incident response procedures

Data Processing Addenda

Detailed Data Processing Addenda (DPA) are provided with comprehensive technical and organizational measures documentation.

14. Transparency and Audit Rights

Client Transparency

We provide:

Clear documentation of data handling practices
Regular reports on security controls and compliance
Access to audit reports and certifications
Detailed technical and organizational measures documentation

Audit Cooperation

We cooperate fully with client-initiated audits and assessments, including on-site reviews where appropriate.

15. Policy Updates and Changes

Update Process

This policy is reviewed and updated regularly to reflect:

Changes in applicable laws and regulations
Evolution of our business practices
Industry best practices and standards
Client feedback and requirements

Notification

Material changes to this policy will be communicated to clients and stakeholders through:

Direct notification to active clients
Publication on our website with effective date
Updates to relevant contractual agreements

16. Contact Information

General Inquiries

For privacy questions, data requests, compliance inquiries, or to exercise your rights:

Email: support@mytytechlabs.com
Phone: +1 (669) 250-6451
Website: www.mytytech.com

17. Governing Law

This policy and our data processing practices are governed by the laws and regulations applicable to the jurisdiction specified in the relevant client contract. Any disputes arising from this policy will be resolved in accordance with the dispute resolution procedures and governing law outlined in that contract.

MyTyTech Labs is committed to the highest standards of data protection and privacy. We continuously invest in security technologies, training, and processes to ensure the confidentiality, integrity, and availability of all data entrusted to us.

Privacy