Privacy Policy

This Privacy Policy describes how Decoding IT ("we", "us", or "our") collects, uses, stores, and protects personal information in connection with our IT Service Management (ITSM) platform and related services, including automated notifications delivered via WhatsApp Business.

We operate across multiple regions and are committed to protecting your privacy in accordance with applicable data protection laws in each jurisdiction where we operate:

1. Information We Collect

We may collect the following categories of personal data:

• Identity data: Full name, staff ID, job title
• Contact data: Email address, WhatsApp-registered mobile phone number
• Ticket / service request data: Ticket ID, category, priority, assignment details, status updates, and timestamps
• Usage data: Delivery status of notifications, message read receipts as reported by WhatsApp
• Technical data: IP address and device type when accessing our web portal

2. How We Collect Your Information

• Directly from you or your employer when your account is created in our ITSM system
• Automatically when you interact with our platform or when service tickets are created or updated
• Via the WhatsApp Business API when notifications are sent to and delivered through your registered number

3. How We Use Your Information

We use your personal data for the following purposes:

• Service notifications: Sending real-time alerts about ticket creation, assignment, status changes, and resolution via WhatsApp Business
• Account management: Creating and managing staff and customer accounts in the ITSM platform
• Platform operation: Delivering and improving our IT service management services
• Audit and compliance: Maintaining logs of service activity for operational purposes
• Support: Responding to queries or issues related to the platform

4. Legal Basis for Processing

We process your personal data under one or more of the following grounds, as applicable in your jurisdiction:

🇴🇲 Oman (Royal Decree No. 6/2022)

• Contractual necessity: Processing required to deliver the ITSM services your organisation has subscribed to
• Legitimate interests: Sending service notifications directly related to your use of the platform
• Consent: Where required, we obtain explicit consent before sending WhatsApp communications

🇦🇪 UAE (Federal Decree-Law No. 45/2021)

• Contractual performance: Processing necessary to fulfil the service agreement with your organisation
• Legitimate interests: Operational notifications that serve a clear and proportionate purpose
• Consent: Obtained for communications beyond the scope of the service contract

🇮🇳 India (DPDPA 2023)

• Consent: We obtain your free, informed, and specific consent before processing personal data for WhatsApp notifications
• Legitimate uses: Processing for purposes reasonably expected in the context of the employment or service relationship

5. WhatsApp Business — Third-Party Disclosure

Our notification service is powered by the Meta WhatsApp Business API. When we send a WhatsApp message to you, your phone number and message content (ticket reference and relevant details) are transmitted to Meta Platforms, Inc. and processed in accordance with Meta's own Privacy Policy, available at https://www.whatsapp.com/legal/privacy-policy.

By receiving WhatsApp notifications from us, you acknowledge that your data is subject to Meta's terms in addition to ours.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We may share your data with:

• Meta Platforms, Inc.: Solely for delivering WhatsApp notifications via the Business API
• Service providers: Trusted third-party vendors who assist in operating our platform, bound by confidentiality and data processing obligations
• Legal authorities: Where required by applicable law in Oman, UAE, India, or a valid court or regulatory order
• Your employer / organisation: Your employer (as our subscribing customer) may access ticket and activity data related to your account

7. Cross-Border Data Transfers

As we serve customers across Oman, UAE, and India, your personal data may be processed in a country other than where it was collected. We ensure such transfers are made with appropriate safeguards including:

• Data processing agreements with third-party providers
• Compliance with transfer provisions under each applicable law
• Use of servers and infrastructure subject to adequate security standards

8. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy or as required by applicable law:

• Active account data: retained for the duration of the service relationship
• Ticket records and notification logs: retained for up to 2 years after the ticket is closed
• WhatsApp message logs: retained for up to 90 days for delivery audit purposes

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted transmission (HTTPS/TLS) for all data in transit
• Access controls restricting data to authorised personnel only
• Regular security assessments of our systems
• Secure storage of credentials using industry-standard encryption

10. Your Rights

Depending on your country of residence, you may have the following rights regarding your personal data:

🇴🇲 Oman

• Right to access, correct, and delete your personal data
• Right to object to processing based on legitimate interests
• Right to opt out of WhatsApp notifications at any time

🇦🇪 UAE

• Right to access and correct your personal data
• Right to request deletion where no legal obligation requires retention
• Right to data portability and restriction of processing
• Right to withdraw consent at any time without affecting prior lawful processing

🇮🇳 India

• Right to access information about personal data being processed
• Right to correction and erasure of inaccurate or unnecessary personal data
• Right to grievance redressal — we will respond to complaints within 30 days
• Right to nominate an individual to exercise rights on your behalf
• Right to withdraw consent at any time

To exercise any of these rights, please contact us using the details in Section 13.

11. Grievance Officer (India — DPDPA 2023)

In accordance with the Digital Personal Data Protection Act, 2023, we have appointed a point of contact for data-related grievances from users in India:

• Contact: Decoding IT — Data Grievance
• Email: privacy@decodingit.com
• Response time: Within 30 days of receiving a grievance

12. Cookies and Tracking

Our web portal may use cookies to maintain session state and improve user experience. We do not use tracking or advertising cookies. You can control cookie behaviour through your browser settings.

13. Children's Privacy

Our services are intended for business use by adults. We do not knowingly collect personal data from individuals under the age of 18. Under India's DPDPA 2023, we do not process personal data of children without verifiable parental consent.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or via the platform. The "Last Updated" date at the top of this page reflects the most recent revision.

15. Contact Us

For questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact us:

• Company: Decoding IT
• Email: privacy@decodingit.com
• Website: https://decodingit.com
• Regions served: Sultanate of Oman  |  United Arab Emirates  |  India