Privacy Policy

Servlution Pvt. Ltd. ("Servlution", "we", "us", or "our") is committed to protecting the privacy and personal data of our clients, engineers, candidates, website visitors, and business partners. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the rights you have over it.

This Policy applies to all data processed through servlution.net, our client portal, engineer network, and any related services we provide. By using our services or submitting information to us, you acknowledge that you have read and understood this Policy.

We operate in accordance with the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and applicable data protection laws in the jurisdictions where we do business.

We collect information you provide directly, information generated when you use our services, and information from third parties where legally permitted.

• Contact details: name, email address, phone number, company, job title, and business address.
• Business information: company website, service interests, budget, project scope, and technical requirements.
• Candidate and engineer data: resume, certifications, employment history, right-to-work documentation, and identity verification records.
• Authentication data: hashed passwords, session tokens, two-factor authentication secrets, and passkey credentials.
• Usage and telemetry: IP address, user agent, session activity, and application logs.
• Communication records: emails, support tickets, chat logs, and consultation notes.

We use personal data only for lawful, clearly defined purposes:

• Deliver and operate the services you have engaged us to provide.
• Match candidates and engineers to client engagements.
• Respond to enquiries, process quote requests, and manage contractual relationships.
• Operate, secure, and monitor our platform, including incident detection and fraud prevention.
• Comply with legal, tax, and regulatory obligations in each jurisdiction we operate in.
• Send service notices, security alerts, and (with consent) marketing communications.

We do not sell personal data. We do not use automated decision-making that produces legal effects without human review.

Where GDPR applies, we rely on the following legal bases:

• Contract: processing necessary to deliver services you have engaged us for.
• Legitimate interests: securing our platform, preventing fraud, improving our services, and communicating with business contacts.
• Consent: marketing communications and cookies that require consent.
• Legal obligation: tax records, anti-money-laundering checks, and lawful requests from authorities.
• Vital interests: protecting life or safety in emergencies.

You may withdraw consent at any time where consent is the basis for processing.

We share personal data only with parties who help us deliver our services and only under written agreements that require confidentiality and security controls:

• Sub-processors: cloud hosting, email delivery, ticketing, monitoring, and CRM providers.
• Professional advisers: auditors, legal counsel, and accountants bound by privilege.
• Clients: where required for a specific engagement and with the subject's knowledge.
• Authorities: when required by law, valid court order, or to protect legal rights.

A current list of sub-processors is available on request from legal@servlution.net.

Servlution operates across Europe, Asia, the Middle East, and the Americas. Personal data may be transferred to and processed in countries outside the European Economic Area (EEA).

When we transfer personal data outside the EEA, we rely on the European Commission's Standard Contractual Clauses, adequacy decisions where available, and supplementary technical measures including encryption in transit and at rest.

Where an engineer or candidate is located in a different jurisdiction than the client engagement, we ensure that appropriate safeguards are in place before any transfer occurs.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected and to comply with legal obligations.

• Client engagement records: retained for the duration of the contract plus seven years for tax and audit purposes.
• Candidate and engineer records: retained for the duration of active network membership plus two years.
• Lead and enquiry records: retained for twenty-four months from the last interaction.
• Security logs: retained for twelve months unless under active investigation.

Where data is no longer needed, it is securely deleted or anonymised.

Subject to applicable law, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data where no legal basis for retention applies.
• Restriction: limit how we process your data while a complaint is investigated.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact legal@servlution.net. We will respond within thirty days. You also have the right to lodge a complaint with your local supervisory authority.

We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction.

• Encryption of data in transit (TLS 1.3) and at rest.
• Role-based access controls, least-privilege principles, and multi-factor authentication.
• Continuous monitoring, anomaly detection, and audit logging.
• Regular third-party security assessments and penetration testing.
• Documented incident response procedures with defined notification timelines.

Our controls are aligned with ISO 27001 and SOC 2 frameworks. No system is perfectly secure; we continuously review and improve our defences.

We use cookies and similar technologies to operate our platform, remember your preferences, and analyse usage.

• Strictly necessary cookies: required for authentication, session management, and security. These cannot be disabled.
• Analytics cookies: help us understand how the platform is used. Deployed only with consent.
• Marketing cookies: used to measure the effectiveness of campaigns. Deployed only with consent.

You can manage cookies through your browser settings and our cookie preference center. Disabling strictly necessary cookies will prevent you from using the platform.

Our platform may link to or integrate with third-party services such as payment processors, analytics providers, and identity verification vendors. These providers have their own privacy policies, and we are not responsible for their practices.

Where we integrate a third-party service on behalf of a client, we ensure that a Data Processing Agreement is in place before any personal data is shared.

Our services are directed to businesses and professional users. We do not knowingly collect personal data from anyone under sixteen. If you believe we have inadvertently collected data from a minor, contact legal@servlution.net and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. Material changes will be communicated by email to registered users and posted on this page with a revised "Last updated" date.

Continued use of our services after a change constitutes acceptance of the updated Policy.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data:

Servlution Pvt. Ltd. — Data Protection Office Putalisadak-31, Kathmandu, Nepal Email: legal@servlution.net Phone: +977-1-4243520, 4243521

If you are located in the European Union, you may also lodge a complaint with the data protection authority in your country of residence.