Privacy Policy

1. Introduction and scope

This Privacy Policy explains how CYSTEM X LLP ("Cystem X", "we", "us" or "our") collects, uses and protects personal data in connection with this website, cystemx.com, and the business inquiries submitted through it. It applies to anyone who visits this website and to anyone who submits information through our contact form at /contact/.

This Privacy Policy does not apply to personal data Cystem X may receive outside this website, for example during a signed client engagement, which is governed by the relevant contract. By browsing this website or submitting the contact form, you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not submit personal data to us through this website.

2. Who we are

The data controller responsible for the personal data described in this Privacy Policy is:

CYSTEM X LLP
Opposite Sadar Police Station, Jalal Pur Ring Road
Gujrat, Punjab 50700, Pakistan
Phone: +92 (301) 070-0324

CYSTEM X LLP is a limited liability partnership registered in Pakistan, trading as "Cystem X", and operates as an enterprise technology company providing cybersecurity, artificial intelligence, cloud, software engineering, data and managed services to enterprise, government and defense clients worldwide. We do not publish a public email address for this website. The fastest and most reliable way to reach us about this Privacy Policy, or about any personal data we hold about you, is through our contact form.

3. What personal data we collect

We collect personal data only when you choose to provide it, principally through the contact form on our Contact page. Depending on which fields you complete, this may include:

• Your full name
• Your work email address
• Your phone number
• Your company or organization name
• Your job title
• Your country
• The content of your message
• Inquiry metadata you select, such as inquiry type, services of interest, deployment environment, preferred engagement model and project timeline

We also store a single cookie, cx_consent, which records whether you have granted or denied non-essential cookies on this website. We use Google Analytics to understand overall site traffic and page usage in aggregate. Whether it runs for you depends on your own choice in the cookie banner and, until you choose, on where you are visiting from: for visitors in the EU/EEA, Iceland, Liechtenstein, Norway, the UK or Switzerland, Google Analytics does not run unless you click "Allow all"; for visitors elsewhere, it runs by default but can be turned off at any time by clicking "Deny non-essential". Your explicit choice in the banner, once made, is honored immediately and overrides this regional default for the rest of your visit, enforced through Google Consent Mode rather than just a visual setting. We do not install advertising or cross-site tracking cookies or scripts of any kind, with or without consent. Our hosting infrastructure may generate routine technical server logs, such as IP address and browser type, but we do not currently use those logs to build profiles of visitors.

This website also links to our profiles on LinkedIn (linkedin.com/company/cystemx) and Facebook (facebook.com/cystemx). Visiting those platforms is governed by their own privacy policies, which fall outside the scope of this Privacy Policy.

4. How and why we use your information

We use the personal data described above to:

• Respond to your inquiry and route it to the right specialist within our team
• Operate the resulting contact relationship, including follow-up communication about your request
• Maintain internal records of business inquiries
• Comply with applicable legal, regulatory or contractual obligations

For visitors to whom the EU General Data Protection Regulation (GDPR) applies, we process this data on the following legal bases under GDPR Article 6: your consent, given when you submit the contact form's privacy consent checkbox; our legitimate interest in responding to business inquiries and operating our website; and, where your inquiry concerns a possible future contract with Cystem X, the performance of pre-contractual steps you have requested. For all other visitors, we apply the same practice as good faith: we use your information only for the purpose you gave it to us, and never repurpose it without telling you.

5. Legal framework

Pakistan does not yet have a single, comprehensive national data protection statute in force in the way the European Union has the GDPR. A draft Personal Data Protection Bill has been under development and legislative consideration for several years, including review at the federal cabinet level, and as of our most recent review in late 2026 it had not been passed by both houses of Pakistan's Parliament and notified in the official Gazette as an enacted Act. We will update this section if and when that status changes.

In the meantime, Cystem X's handling of personal data is informed by the laws currently in force in Pakistan, including: the Prevention of Electronic Crimes Act (PECA) 2016, as amended in 2025, which addresses electronic crimes, unauthorized access to data and related offenses; the Electronic Transactions Ordinance (ETO) 2002, which governs electronic documents, records and transactions; the Punjab Consumer Protection Act 2005, which applies to consumer-facing practices in Punjab, where Cystem X is headquartered; and the Contract Act 1872, which governs the contractual aspects of any agreement, including the consent you give through this website.

Because Cystem X serves clients across many jurisdictions, including the European Union, the United Kingdom and other regions with established data protection regimes, we voluntarily apply data handling practices aligned with internationally recognized standards, including the GDPR, throughout this Privacy Policy, even in areas where Pakistani law does not yet mandate them. Where a stricter standard applies under the law of your own jurisdiction, we aim to honor that standard for your data.

6. Cookies

This website sets one strictly necessary cookie, cx_consent, which simply remembers the choice you make in our cookie banner (granted or denied) for one year, using the SameSite=Lax setting. This cookie does not track you across sites or sessions. We also use Google Analytics, which sets its own cookies to measure site usage in aggregate: for visitors in the EU/EEA, Iceland, Liechtenstein, Norway, the UK or Switzerland, it does not load unless you click "Allow all"; for visitors elsewhere, it loads by default but you can stop it at any time by clicking "Deny non-essential", enforced through Google Consent Mode rather than just a visual setting. We do not use advertising or other tracking cookies or scripts, with or without consent. You can review or change your choice at any time using the "Cookie preferences" link in the footer of every page. For full detail, see our Cookie Policy.

7. How we share your information

We do not sell personal data, and we do not share it with third parties for their own marketing purposes. We may share personal data with:

• Service providers strictly necessary to operate this website or respond to your inquiry, for example a hosting provider or an email delivery service, if and when such integrations are put in place
• Professional advisors, where necessary to obtain their advice
• Law enforcement, courts or regulators, where required by applicable law or a valid legal process
• A successor organization, in the event of a merger, acquisition or sale of all or part of Cystem X's business, subject to the same confidentiality commitments described in this Privacy Policy

As of today, no third-party integrations are wired into this website beyond the hosting infrastructure that serves it; the contact form runs on the front end only and does not yet transmit data anywhere. This Privacy Policy describes how submissions will be handled once the form is connected to our systems: reviewed by the Cystem X team solely to respond to your inquiry.

8. International data transfers

Cystem X is headquartered in Gujrat, Punjab, Pakistan, and our team operates primarily from Pakistan. If you are located in the European Union, the European Economic Area, the United Kingdom or elsewhere outside Pakistan, any personal data you submit to us will be transferred to, and processed in, Pakistan, and may also be processed in other locations where Cystem X or its personnel and service providers operate. We take reasonable steps to protect your data wherever it is processed, consistent with the commitments described in this Privacy Policy, and we limit access to personal data to the people within our organization who need it to respond to you.

9. Data retention

We keep contact form submissions for as long as necessary to respond to your inquiry, and for a reasonable period afterward for record-keeping purposes. In most cases, this means we do not keep inquiry data for longer than 24 months after our last contact with you, unless a longer retention period is required by law, is necessary to establish or defend a legal claim, or reflects an ongoing business relationship, such as an active client engagement. When data is no longer needed, we delete it or render it anonymous.

10. Your rights

Depending on the law that applies to you, including the GDPR for residents of the EU, EEA and UK, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data (rectification)
• Request deletion of your data (erasure)
• Request that we restrict how we use your data
• Receive a copy of your data in a portable format
• Object to certain uses of your data
• Withdraw your consent at any time, where our use of your data is based on consent, without affecting the lawfulness of use before you withdrew it

To exercise any of these rights, contact us through our contact form, select the inquiry type that best describes your request, and describe what you would like us to do. We will respond within a reasonable time. If you believe we have not handled your request appropriately, you may also have the right to lodge a complaint with a data protection authority in your jurisdiction, where one exists.

11. Children's privacy

This website is a business-to-business website directed at enterprise, government and defense professionals. It is not directed at, and we do not knowingly collect personal data from, children under the age of 18. If you believe a child has provided personal data to us through this website, please contact us through our contact form so that we can remove it.

12. Data security

We take reasonable technical and organizational measures to protect the personal data you share with us. These include serving this website exclusively over encrypted HTTPS connections, limiting access to submitted inquiries to personnel who need it, and collecting only the data necessary to respond to your request. Our practices are aligned with widely recognized security principles, though we do not claim any specific security certification. No method of transmission or storage is completely secure, but we are committed to handling your data responsibly and updating our practices as our systems evolve.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our website or applicable law. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of this website after an update constitutes acceptance of the revised Privacy Policy.

14. Contact us

If you have questions about this Privacy Policy, or you would like to exercise any of the rights described above, please contact us:

CYSTEM X LLP
Opposite Sadar Police Station, Jalal Pur Ring Road
Gujrat, Punjab 50700, Pakistan
Phone: +92 (301) 070-0324
Online: use our contact form

We do not publish a public email address for this website. The contact form is the fastest and most reliable way to reach us.