Privacy policy

01Introduction and scope

1. This privacy policy explains how Creta System, the company that provides SnapDocx (“we”, “us” or “our”), collects, uses, shares and protects personal information.
2. It applies to:
   1. visitors to this website;
   2. people who contact us or ask for a demo;
   3. contacts at our customers, and the staff users they give access to SnapDocx; and
   4. applicants who complete a form that runs on SnapDocx, to the limited extent described in the Our role section.
3. It does not cover how a collecting organisation uses applicant information for its own purposes. That organisation’s own privacy notice, shown before an applicant submits, covers that.
4. Words with capital letters, such as “Form” and “Customer Data”, have the meanings given in our Terms and conditions.

02Who we are

Where Data Protection Law requires it, we will appoint a data protection officer or a local representative and publish their contact details in this section.

03Our role: controller or processor

Data protection law distinguishes between a controller, who decides why and how personal information is used, and a processor, who handles it on the controller’s behalf. Our role depends on who you are:

As a processor, we handle applicant information only on the collecting organisation’s documented instructions, under a data processing agreement. We do not use it for our own purposes.

04Information we collect

Website visitors and people who contact us

Customers and staff users

Applicants, on behalf of collecting organisations

05How we use information, and our legal bases

1. Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can object at any time, as described in the Your rights section.
2. We will not use personal information for a new purpose that is incompatible with those above without telling you first and, where the law requires, asking for your consent.

06ID Images and text recognition

Identity documents need extra care. When an applicant chooses to upload a photo of their CNIC, we commit to the following:

1. The ID Image is used only to read details for that applicant’s own Form, and for the collecting organisation’s staff to compare a reading with the confirmed answers.
2. The applicant selects the part of the photo that shows the card. Only that part is sent for reading.
3. Text recognition runs within the SnapDocx service. We do not send ID Images to any third-party text-recognition or artificial intelligence provider.
4. We do not use ID Images, or any applicant information, to train machine-learning models.
5. We do not use ID Images for facial recognition or any other form of biometric identification.
6. Every Suggestion is labelled and checked by the applicant, who can correct it or type the value instead. The applicant can choose to type all their details and upload no photo at all.
7. A staff reading of an ID Image does not change the answers the applicant confirmed.
8. ID Images are deleted on the schedule the collecting organisation sets, which can be a set number of days after the applicant confirms, and separately from the rest of the application.
9. The confirmation screen shows only a reference number, never the applicant’s name or CNIC number. Processing and error lists show references only.
10. Access to ID Images is limited to signed-in staff of the collecting organisation, and to our personnel only where strictly necessary for support or security, under confidentiality obligations.

07Automated decision-making

We do not make any decision that has legal or similarly significant effects on a person based solely on automated processing. Text recognition only produces Suggestions, which applicants check and confirm. The collecting organisation decides what happens to an application, and our Terms require it to apply meaningful human review.

08Who we share information with

1. The collecting organisation. Its signed-in staff can see an applicant’s submission and its files.
2. Service providers. Companies that help us run SnapDocx, such as hosting, infrastructure, email delivery, support and billing providers. They act only on our instructions, under written contracts that require confidentiality and security. A list of our subprocessors is available on request.
3. Professional advisers. Lawyers, auditors and insurers, where needed and under a duty of confidentiality.
4. Authorities. Where the law requires it, or where needed to protect someone’s safety or rights. We review every request, challenge requests that are unlawful or too broad, disclose only the minimum required, and tell the affected customer unless the law prevents us.
5. A buyer or successor. If our business is reorganised, merged or sold, information may transfer to the new owner, who must continue to protect it as this policy describes.
6. Others, with your consent or at your direction.

We do not sell personal information. We do not share it for advertising, and we do not allow third parties to track you on this website.

09International transfers

1. Our servers and service providers may be located outside the country where information was collected.
2. When we transfer personal information across borders, we take the steps Data Protection Law requires. These may include transferring only to countries recognised as providing adequate protection, using standard contractual clauses approved by the European Commission or the UK equivalent, or relying on other lawful safeguards.
3. You can ask us for details of the safeguards we use by contacting info@cretasystem.com.

10How long we keep information

When a customer’s contract ends, we delete their Customer Data as set out in our Terms and conditions. We review our retention periods regularly.

11How we protect information

We use technical and organisational measures designed to protect personal information, including:

• two-step sign-in for all staff users, using an authenticator app;
• role-based access: owner, admin or reviewer;
• encryption of information in transit between your browser and SnapDocx;
• a recorded history of downloads of generated files;
• references rather than names or CNIC numbers in operational views;
• confidentiality obligations and need-to-know access for our own personnel; and
• regular review of these measures.

No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security. Customers are responsible for keeping their staff users’ sign-in details secure.

12Personal data breaches

1. We keep procedures for detecting, investigating and responding to personal data breaches.
2. Where we act as a processor, we notify the affected customer without undue delay after becoming aware of a breach, and give them the information they need to meet their own obligations.
3. Where we act as a controller, we notify the relevant authority and affected individuals when Data Protection Law requires it. Under the EU and UK GDPR, we notify the authority within 72 hours of becoming aware of a notifiable breach, where feasible.

13Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• have inaccurate or incomplete information corrected;
• have your information deleted;
• restrict how we use your information;
• object to our use of your information, including for direct marketing;
• receive your information in a portable format;
• withdraw any consent you have given, at any time;
• not be subject to decisions based solely on automated processing; and
• complain to a data protection authority.

1. To exercise a right, email info@cretasystem.com with the subject “Privacy request”. Applicants should contact the collecting organisation, as explained in the Applicants section.
2. We may need to confirm your identity before acting on a request. An authorised agent may make a request for you if they provide proof of their authority.
3. We respond within one month. If a request is complex or we receive many requests, we may extend this by up to two further months and will tell you why. Where local law sets a shorter period, we follow it.
4. Exercising your rights is free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, and we will explain why.
5. We will not treat you differently for exercising your rights. We may keep some information where the law requires us to, and we will tell you if so.
6. Withdrawing consent does not affect the lawfulness of anything we did with your information before you withdrew it.

14Additional information for the EEA, UK and Switzerland

1. If the EU GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your information, we are the controller of the information described in the Our role section for website visitors, enquiries, customer contacts and staff users.
2. Your rights include those under Articles 15 to 22 of the GDPR: access, rectification, erasure, restriction, data portability, objection, and rights relating to automated decision-making.
3. You may complain to the data protection authority in the country where you live or work, or where you believe an infringement took place. In the UK, this is the Information Commissioner’s Office. We would appreciate the chance to address your concern first, so please contact us before you complain.

15Requests from applicants

1. If you completed a Form, the collecting organisation controls your information. Please send requests to access, correct or delete it to that organisation. Its contact details are in the privacy notice shown with the Form.
2. If you contact us instead, we will forward your request promptly to the collecting organisation, where we can identify it, and tell you that we have done so. We help collecting organisations respond to requests as our data processing agreement requires.
3. For your privacy, we cannot act on an applicant’s request directly without the collecting organisation’s instructions, except where the law requires us to.

16Children’s information

1. This website and the staff workspace are not directed at children, and we do not knowingly collect personal information from children for our own purposes.
2. A collecting organisation that uses a Form to collect information about a child is responsible for doing so lawfully, including obtaining any required parental consent.
3. If you believe a child has given us personal information, contact info@cretasystem.com and we will delete it where appropriate.

17Marketing and communications

1. We never send marketing messages to applicants.
2. We may send business contacts information about SnapDocx where the law allows. Every marketing email includes a way to unsubscribe, and you can also opt out by emailing info@cretasystem.com.
3. Service messages, such as security alerts, billing notices and changes to our terms, are part of the Service and continue while an account is active.

18Cookies

This website uses one strictly necessary cookie to remember your cookie choices. Read our cookie policy for details, or change your choice at any time on the cookie consent page.

19Other websites

This website may link to websites run by others. Their privacy practices are their own responsibility, and we encourage you to read their privacy notices.

20Changes to this policy

1. We update this policy when our practices or the law change. The version number and effective date at the top of this page show the current version.
2. If we make a significant change, we will tell customers by email at least 30 days before it takes effect, where practicable, and highlight the change on this page.

21Contact and complaints

If you have a question about this document, contact us:

If you are not satisfied with our response, you have the right to complain to your data protection authority.