What we do
with your data.

Last updated 2026-10-14. How QNN Solutions and its group companies handle information from this website and from engagements, across every market we operate in — Pakistan, Oman and the United States.

What we collect

This website collects very little. There are no advertising trackers, no third-party analytics cookies and no marketing pixels on it.

Information you send us

• Your name, work email, organization, the service you selected and the message you wrote, when you submit an enquiry form
• Anything else you choose to include in that message, including optional contact times
• Your conversation and requirements brief when you agree to use the sales guide. A submitted enquiry can include that conversation so you do not have to explain everything again

Information collected automatically

• Our hosting provider processes network and request information to serve and protect the site. Provider retention is governed by its terms
• Cookie-free daily counts of page views, referring domains and approximate countries. Our application does not store raw IP addresses, full referring URLs or individual visitor profiles in these counts, and respects browser Do Not Track and Global Privacy Control signals
• Short-lived hashed network identifiers are used to limit abusive requests
• Google Fonts receives network information when supplying fonts. Website scripts and the 3D library are served from this site

The engagement builder on the Ways to work page runs entirely in your browser. Your answers are not sent to us unless you choose to send them as a brief.

How we use it

• To respond to your enquiry and to scope the work you asked about
• To send you a proposal, and to follow up about that proposal
• To keep our own systems secure and working

We do not sell your information, we do not share it with advertisers, and we do not add you to a marketing list because you sent an enquiry. If we ever want to send you something unrelated to your enquiry, we will ask first.

Why we are allowed to hold it

Where the UK or EU GDPR applies, we rely on:

• Legitimate interests — responding to a business enquiry you sent us
• Performance of a contract — delivering work you have engaged us for
• Legal obligation — records we are required to keep, such as tax and accounting records

Where another regime applies, the equivalent basis is your request to be contacted, the contract between us, or a legal duty. We do not rely on consent for marketing you did not ask for, because we do not do it.

Your rights, market by market

We operate in Pakistan, Oman and the United States, and apply one standard everywhere: we collect little, keep it only as long as we need it, never sell it, and hand it back or delete it when you ask. Your specific rights and the regulator you can complain to depend on where you are.

United States

Where state privacy law applies — California's CCPA as amended by the CPRA, and the equivalent laws in Virginia, Colorado, Connecticut, Utah, Texas and other states — you may ask us to tell you what we hold, correct it, delete it, and provide a portable copy. You may also opt out of the sale or sharing of personal information and of targeted advertising.

We do not sell or share personal information, and we do not run targeted advertising, so there is nothing to opt out of — but the request route is the same as any other: email us and we will confirm in writing. We will not discriminate against you for exercising any of these rights.

Oman

The Personal Data Protection Law (Royal Decree 6/2022) applies, regulated by the Ministry of Transport, Communications and Information Technology. You may request access, correction and erasure, and withdraw consent.

Pakistan

Rights and obligations depend on applicable Pakistani law and any sector-specific requirements. Enquiries from Pakistan use the same privacy-request route as enquiries from other markets. Ask us about access, correction, deletion or a particular contractual data requirement.

International transfers

Our delivery teams are in Pakistan, so information you send us is likely to be accessed from there, and from the other countries where group companies operate. Our email and productivity platform is Microsoft 365, which stores data in Microsoft's regional data centres.

• From the United States: processing may happen in Pakistan and Oman under our contractual protections, and we say so plainly rather than burying it.
• From the UK or EU: where a client there engages us, transfers run under the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, with a transfer risk assessment.
• For engagements with a data residency requirement: we keep processing and monitoring data inside the cloud region your policy specifies, and say so in the agreement.

If your organization needs a data processing agreement, standard contractual clauses or a specific residency arrangement, tell us at scoping and we will sign one as part of the engagement.

Who else sees it

Your enquiry may be shared inside the group where another company is better placed to deliver the work — Prime Edge, Astrobot Academy or Hassan & Sons. Where that happens, we tell you in writing before the introduction.

We also use a small number of service providers who process information on our behalf: our email and productivity provider, our hosting provider, and, where relevant to an engagement, the cloud platform your work runs on. Each is bound by its own contractual terms.

When connected, Groq processes sales-guide messages to produce AI replies and Resend processes enquiry acknowledgements and owner notifications. Without those connections, the guide uses a rules-based flow and enquiries are still saved. The chat asks for agreement before starting. Do not share confidential documents, credentials or sensitive personal information. Groq retention depends on the configured account settings; see its data information.

We do not transfer your information to anyone else without your instruction, unless we are legally required to.

Data we access during an engagement

Managed IT, monitoring and security work often means access to systems that hold your data and your customers' data. That access is governed by the engagement agreement, not by this page. In practice:

• Access is the minimum needed to deliver the agreed scope, and is granted by you through your own process
• Named individuals hold named accounts; we do not use shared credentials
• Access is reviewed during the engagement and removed at the end of it
• Monitoring and log data is retained for the period agreed in your contract, in the location agreed in your contract
• We never ask for credentials through this website, by email or by message

How long we keep it

• Enquiries and their email records: retained for follow-up and reviewed by the team for removal when no longer needed. Contact us to request deletion
• Standalone chat sessions older than 30 days are removed during the next sales-desk maintenance run. A conversation attached to a submitted enquiry remains with that enquiry
• Client records: for the life of the relationship, plus the period required by tax and company law
• Hosting and optional AI provider logs: according to the provider's settings and terms, rather than a retention period controlled by this website

Making a request

To exercise any right listed above, email us with "Privacy request" in the subject line and tell us what you want. We will confirm receipt, verify that the request is genuinely yours, and respond within the statutory period — 30 days under UK and EU GDPR, 45 days under the California CCPA, and as soon as practicable elsewhere.

There is no charge. You can make the request yourself or through an authorised agent, and you do not need to use a form or a particular wording.

Cookies

After you agree to start chat, an essential, HTTP-only session cookie keeps your conversation together for up to seven days. Private owner sign-in may also use authentication cookies supplied by the hosting platform. We do not store enquiry details in browser local storage.

Page-view measurement is cookie-free and uses aggregate counts, not advertising profiles. The service you select may appear in the contact URL. The guide records requests it cannot confirm for owner review. It does not train itself, approve a new service, close a deal or confirm a booking. Only an answer explicitly approved by the owner is published to the FAQ.

Contact

Questions about this page, or a request about your information: info@qnnsolutions.com, with "Privacy request" in the subject line.

We have not appointed a statutory data protection officer, as we are not required to. Privacy requests are handled by the group's delivery lead, and we will name the responsible person in our reply.

If you need a UK or EU representative under Article 27 for a specific engagement, raise it at scoping and we will put the arrangement in place before work starts.

This page is written to be clear and accurate rather than exhaustive. If your organization requires a formal data processing agreement, we will sign one as part of the engagement.

See also the terms and copyright page.