1. Introduction

ONLYJS Technology Ltd ("OnlyJS", "we", "us" or "our") is committed to protecting the privacy of visitors to our websites (including main.baraaas.info, consultancy.baraaas.info/en, and technology.baraaas.info – collectively, the "Websites"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Websites or otherwise interact with us. It also outlines your rights under the EU General Data Protection Regulation (GDPR) and other applicable data protection laws. We process personal data only in accordance with this Policy and applicable law.

2. Data Controller and Contact Information

ONLYJS Technology Ltd (the "data controller") is a company organized under the laws of [Country] with registered address at [Company Address]. If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise your data protection rights, you may contact us at: privacy@baraaas.info (or Contact Form on our Websites). We have not appointed a formal Data Protection Officer (DPO) as we are not legally required to do so, but we do have a data protection team responsible for overseeing GDPR compliance.

3. Scope

This Privacy Policy applies to personal data collected through our Websites and related services. It does not cover any third-party websites or services that may be linked on our Websites. We encourage you to review the privacy policies of any third-party sites you visit.

4. Personal Data We Collect

We only collect limited personal data necessary to provide our services and respond to inquiries. The types of personal data we collect include:

4.1. Contact Information

When you submit a contact or inquiry form on our Websites, we collect personal identifiers such as your name, business email address, company name, job title, and any other information you choose to provide in the message. This data is provided directly by you and is used to correspond with you regarding your inquiry or request.

4.2. Browsing Information (Cookies and Analytics)

When you visit our Websites, we automatically collect certain technical information through the use of cookies and similar technologies. This may include your device's IP address, browser type, operating system, referring URLs, and information about how you interact with our site (e.g. pages visited, time spent). We use Google Analytics and similar third-party tools to gather usage data about our site's performance and visitor interactions. Where required by law, we obtain your consent before setting non-essential cookies (see our Cookie Policy for details). Such analytics data may be considered personal data (e.g., IP address or unique IDs in cookies) and is handled in accordance with GDPR requirements.

4.3. No Special Categories

We do not intentionally collect any sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health information, genetic or biometric data, etc.) through our Websites. We ask that you do not provide this type of information in any free-form contact fields. We also do not knowingly collect personal data from children. Our Websites are intended for business use by adults; if you are under 16 (or the applicable age of consent in your jurisdiction), please do not submit personal information.

5. How We Use Your Personal Data

We will only use your personal data for specified, explicit and legitimate purposes. In particular, OnlyJS uses the personal data collected for the following purposes:

5.1. To Respond to Inquiries and Provide Services

If you contact us via a contact form, email, or other means, we will use your provided information (e.g. name, email, company, title) to communicate with you, answer your questions, provide the information or consultation you requested, or take steps at your request prior to potentially entering into a contract (for example, discussing our consultancy or technology services). This use is necessary for us to address your inquiry and is based on our legitimate interest in responding to potential business clients or, where applicable, on the performance of pre-contractual steps requested by you.

5.2. Analytics and Improvements

We process certain data about your visits to our Websites (via cookies and similar technologies) to analyze usage trends and performance of our online content. This helps us understand which pages or services are of most interest and allows us to improve our Websites and services. We anonymize or pseudonymize analytics data wherever feasible. The legal basis for using analytics cookies is your consent, which you give via our cookie consent banner (except for cookies strictly necessary for the site's core functionality, which run based on our legitimate interest in ensuring the site works properly).

5.3. Site Functionality and Security

We may use technical information (like IP addresses and browser user-agent information) to maintain the security and integrity of our Websites, prevent fraud or abuse, debug and fix errors, and ensure the proper display of content. This processing is based on our legitimate interests in safeguarding our systems and providing a safe experience to users. For example, we may log access information and monitor for unusual activities to detect and block malicious use.

5.4. Legal Compliance

In some cases, we may need to process personal data to comply with a legal obligation, such as retaining certain business records for tax or accounting purposes, or disclosing information if lawfully required by authorities (e.g., in response to a court order). In such cases, the legal basis for processing is compliance with a legal obligation to which OnlyJS is subject.

Other Purposes: We will only use your personal data for additional purposes if we obtain your consent or if otherwise permitted or required by law. We do not use the data collected via our Websites for marketing newsletters or unsolicited communications, and we do not engage in automated decision-making or profiling with your data.

We ensure that we have an appropriate legal basis under GDPR for each purpose we use personal data. Typically, the bases we rely on are consent (for analytics cookies or any situation where you have a choice), legitimate interests (for responding to inquiries and maintaining website functionality, after considering any impact on your rights), or legal obligation (when compliance with law is required). If we rely on legitimate interests, we have balanced those interests against your rights and freedoms to ensure no undue harm. You always have the right to contact us to clarify the legal basis for any specific processing.

6. Cookies and Similar Technologies

Cookies are small text files placed on your device to store information. Our Websites use cookies and similar technologies as described in our separate Cookie Policy (see Document 2 below for full details). In summary:

We use essential cookies that are necessary for our Websites to function (for example, to remember your cookie preferences or enable core features). These do not require your consent.
We also use analytics cookies (such as Google Analytics cookies) to collect information on how visitors use our site. These cookies (e.g., _ga, _gid from Google) help us count visitors and understand usage patterns. They may collect information like your IP address and generate a pseudonymous identifier to distinguish users. We have configured Google Analytics to anonymize IP addresses where possible. Analytics cookies are not deployed without your consent. When you first visit our site, you will see a cookie consent banner where you can choose to accept or reject non-essential cookies.
You have full control over cookie usage. You can withdraw your consent at any time by adjusting your cookie settings on our site (via the cookie consent tool) or by clearing cookies in your browser. Our Cookie Policy provides information on how to manage cookies via browser settings and how to opt out of Google Analytics tracking if you prefer.

For more information, please read our Cookie Policy, which is incorporated by reference into this Privacy Policy. By using our Websites with cookies enabled, you are agreeing to our use of cookies as described.

7. Disclosure of Personal Data to Third Parties

We do not sell or rent your personal data. However, we may share personal data with selected third parties for the purposes outlined above, under appropriate safeguards and only when necessary:

7.1. Service Providers (Processors)

We use trusted third-party service providers to perform certain business operations on our behalf. This includes our website hosting provider (which may process IP addresses and contact form submissions on its servers), email service providers (to send and receive communications), analytics providers like Google Analytics (Google LLC/Google Ireland, which processes usage data as our analytics tool), and IT support or other technical services. These third parties only process personal data under our instructions and strictly for the purposes we specify, and we have data processing agreements in place with them as required by GDPR.

7.2. Within Our Corporate Group

If OnlyJS Technology Ltd is part of a group of companies, we may share data with our affiliates or subsidiaries (for example, the consultancy or technology divisions operating under the OnlyJS name) as needed to respond to your requests or provide services. All group entities follow the same privacy and security practices. (If applicable, insert details of any group companies here.)

7.3. Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our business or assets, personal data we hold may be transferred to the acquiring entity or successor. In such cases, we will ensure the confidentiality of the transfer and provide notice before your data is subject to a different privacy policy.

7.4. Legal Requirements and Safety

We may disclose personal data if required to do so by law or legal process (for example, in response to a subpoena or court order), or to comply with requests from governmental authorities. We may also disclose data if we believe in good faith that such action is necessary to (a) fulfill a legal obligation, (b) protect and defend our rights or property, (c) prevent or investigate possible wrongdoing in connection with the Websites or our services, (d) ensure the personal safety of users or the public, or (e) protect against legal liability.

Whenever we share your information with third parties, we only do so to the extent necessary and with appropriate contractual and security safeguards in place to protect your data. Third parties who process data on our behalf are not permitted to use your data for their own purposes.

8. International Data Transfers

OnlyJS Technology Ltd is based in [the United Kingdom/Specify Country]. Depending on your location and the location of our service providers, your personal data may be transferred to and processed in countries outside of your own. In particular, if you are located in the European Economic Area (EEA) or another region with data protection laws, please note:

Intra-group Transfers: If we transfer personal data from the EEA to our company or affiliates in a country that the European Commission has not deemed to have an "adequate" level of data protection (such as the UK, if the UK's adequacy decision were to lapse in the future), we will ensure an appropriate legal mechanism is in place, such as the European Commission's Standard Contractual Clauses (SCCs), to safeguard the data.
Service Providers in Other Countries: Some of our external processors are located outside the EEA. For example, data collected via Google Analytics may be processed by Google on servers in the United States. The U.S. is currently not considered to have an adequate data protection level by the EU, so we rely on appropriate safeguards for such transfers. Google is bound by SCCs and other measures to protect data. We have reviewed that Google Analytics provides data transfer addendums in line with GDPR requirements, and we have enabled features like IP anonymization to reduce data exposure.
Safeguards: In all cases of international transfer, we ensure that adequate safeguards as required by GDPR (Art. 46) are in place to protect your personal information. These may include SCCs, an adequacy decision by the European Commission (e.g., transfers to countries that are officially recognized as having equivalent data protection laws), or binding corporate rules where applicable. We also assess on a case-by-case basis any additional technical or organizational measures needed in light of potential government access in destination countries (per the Schrems II ruling).
Your Rights in Transfers: If your data is transferred internationally, you may request a copy of the relevant transfer safeguard (e.g., a copy of the contractual clauses) by contacting us. We will not transfer your personal data to third parties in other countries without ensuring appropriate privacy protections are in place.

9. Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes we collected it for, including any legal or reporting requirements. In general:

9.1. Contact Form Data

Personal data you provide through contact or inquiry forms (such as your name, email, company, etc. and the content of your inquiry) will be retained for as long as is necessary to respond to your request and for a reasonable period thereafter. Typically, we may keep inquiry data for up to [12 months] after our last correspondence on the matter, in case further follow-up is needed or to establish a business relationship. If the inquiry leads to a contractual relationship, your data may be kept longer in accordance with our client records retention policies. If not, we will delete or anonymize the data after the retention period.

9.2. Analytics Data

Data collected via analytics cookies is retained as long as necessary for analysis purposes. We have set our Google Analytics data retention period to [14 months] (or the minimum allowed) for user-level and event-level data associated with cookies and identifiers. Aggregated reports do not contain personally identifiable data and may be kept longer for internal analysis.

9.3. Web Server Logs

If our web servers automatically log IP addresses and visits for security, those logs are generally rotated and deleted within [90 days] unless we need to retain them longer for investigation of security incidents.

We periodically review the personal data we hold and erase or anonymize data that is no longer needed. If we anonymize data (so it can no longer be associated with any individual), we may use such data without further notice to you.

In some cases, we may need to retain certain information for longer periods if required by law (for example, records of communications may be kept under applicable business correspondence laws or to defend against legal claims). In all cases, when we no longer have a legitimate need to retain your personal information, we will securely delete or destroy it.

10. Data Security

OnlyJS takes data security seriously. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, for example:

10.1. Technical Measures

Use of encryption (HTTPS/TLS) to protect data in transit on our Websites, firewalls and network security controls, regular software updates and patch management to address vulnerabilities, and access control mechanisms to ensure only authorized personnel can access personal data. Personal data submitted through our contact forms is transmitted securely and stored in protected systems. We also utilize security monitoring to detect and respond to any malicious activities.

10.2. Organizational Measures

OnlyJS restricts access to personal data to employees and contractors who need the information to perform their job duties (principle of least privilege). All staff are trained on data protection and are bound by confidentiality obligations. We have internal policies (see our Data Protection Policy) that guide proper handling and safeguarding of personal information. If we use third-party processors, we ensure they also employ adequate security measures.

10.3. Data Breach Procedures

Despite our best efforts, no system can be 100% secure. We have a Data Breach Policy and incident response plan in place (see Document 8 below). In the event of any personal data breach, we will follow all applicable laws for notification and mitigation, including informing affected individuals and authorities when required. We also continually evaluate and improve our security practices to adapt to new threats.

If you have reason to believe that your interaction with us or your data may no longer be secure (for example, if you suspect a vulnerability on our site), please notify us immediately using the contact information provided above.

11. Your Rights as a Data Subject

If you are in the EU/EEA or otherwise subject to GDPR (or similar data protection laws), you have certain rights regarding your personal data. ONLYJS Technology Ltd is committed to upholding these rights. Subject to the conditions and exceptions set out in applicable law, these rights include:

11.1. Right of Access

You have the right to request confirmation of whether we are processing your personal data, and if so, to request a copy of the personal data we hold about you, as well as information about how we use it. This is commonly known as a Data Subject Access Request. We will provide the information in a commonly used electronic form if you make the request electronically, unless you request otherwise.

11.2. Right to Rectification

You have the right to request that we correct or update any personal data that is inaccurate or incomplete. We will promptly make the necessary corrections upon verification.

11.3. Right to Erasure

You have the right to request that we delete your personal data ("right to be forgotten") in certain circumstances – for example, if the data is no longer necessary for the purposes it was collected, or if you withdraw consent and no other legal basis for processing exists. We will securely erase your data upon request, provided we do not have a compelling reason or legal obligation to retain it.

11.4. Right to Restrict Processing

You have the right to request that we limit the processing of your personal data in certain scenarios, such as while we verify the accuracy of your data after you contest its accuracy, or if you object to our processing based on legitimate interests. When processing is restricted, we will still store your data but not use it further until the restriction is lifted (except in limited circumstances as permitted by law).

11.5. Right to Object

You have the right to object to our processing of your personal data where that processing is based on our legitimate interests (or those of a third party). In such a case, we will cease processing your data unless we have compelling legitimate grounds that override your interests, rights and freedoms, or if we need to continue processing for the establishment, exercise or defense of legal claims. You also have the right to object at any time to processing of your personal data for direct marketing purposes; however, as noted, we currently do not process your data for direct marketing without your consent.

11.6. Right to Data Portability

For data you have provided to us and that we process by automated means based on your consent or for performance of a contract, you have the right to request a copy of such data in a structured, commonly used, machine-readable format (for example, CSV or JSON), and you have the right to transmit that data to another controller where technically feasible.

11.7. Right to Withdraw Consent

If we are processing any of your personal data based on your consent (for example, if you consented to analytics cookies), you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing that was done before withdrawal, and it won't affect processing that is based on another legal basis. If you withdraw consent for cookies, for instance, we will stop the data collection from those cookies on future visits.

12. Third-Party Links

Our Websites may contain links to other websites or embedded content operated by third parties (for example, an industry partner's site or a social media profile). Please be aware that this Privacy Policy does not apply to those third-party websites. We are not responsible for the content or privacy practices of such sites. We encourage you to review the privacy policies of any third-party sites or services before providing any personal information to them.

13. Changes to this Privacy Policy

We may update or revise this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make material changes, we will post the updated policy on our Websites and update the "Last Updated" date. In some cases, we may also notify you (for example, via a notice on our homepage or via email if you have provided it) about significant changes. Your continued use of our Websites after any such update constitutes acceptance of the changes. We encourage you to periodically review this page for the latest information on our privacy practices.

14. Contact Us

If you have any questions, comments, or concerns about this Privacy Policy or our data practices, or if you wish to exercise your rights, please contact us as follows:

By Email: privacy@baraaas.info

By Mail: ONLYJS Technology Ltd, [Attn: Privacy Team], [Company Address], [City], [Postal Code], [Country].

We will gladly assist you and do our best to address your concerns. Your privacy is important to us, and we commit to resolving any issues to the best of our ability. (End of Privacy Policy)

Hangi Konuda Yardımcı Olabiliriz?