Data Protection & Privacy Notice (UK GDPR)

Last updated: 29 October 2026

This Notice is issued by WEBTAY INTERNATIONAL LTD ("WebTay", "we", "us") in compliance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018") to inform individual users, customers, and partners of our data processing practices.

Legal Status Note: This document represents a working draft tailored for WEBTAY INTERNATIONAL LTD as a UK private limited company under UK GDPR and DPA 2018. It should be reviewed by qualified legal counsel for cross-border transaction compliance where international data transfers occur.

1. Data Controller Details

Legal Entity: WEBTAY INTERNATIONAL LTD
Company Number: 17531079 (England and Wales)
Director: Ilyas Korcan
Registered Office: Suite 11329 5 Brayford Square, London, United Kingdom, E1 0SG
Website: webtaysoft.com
Email: [email protected]
Telephone (Support Line): +90 535 673 7444

2. Categories of Personal Data Processed

We collect and process the following categories of personal information:

  • Identity Information: First name, surname, company/trading name.
  • Contact Information: Email address, telephone number, billing address.
  • Customer Transaction Data: Orders, quotations, licence allocations, and software deployment history.
  • Financial Records: Invoices, transaction reference numbers, and payment status (full payment card details are never stored by us).
  • Technical & Log Data: IP addresses, timestamps, browser types, and authentication access logs.

3. Lawful Bases and Purposes of Processing

Under Article 6 of the UK GDPR, data processing is conducted strictly pursuant to lawful grounds:

  • Contractual Necessity: Delivering ordered software packages, managing user accounts, executing bespoke development agreements, and providing customer support.
  • Legal Obligation: Maintaining statutory financial records, tax accounting, and complying with lawful disclosures.
  • Legitimate Interests: Securing server environments, preventing fraud, and optimising software reliability.
  • Consent: Sending commercial communications or setting non-essential cookies where explicit consent has been granted.

4. Data Sharing and International Transfers

Personal data is strictly shared on a need-to-know basis with vetted third parties including payment processing partners, cloud infrastructure hosts, and accounting consultants under data processing agreements. Where data is transferred outside the United Kingdom, appropriate safeguards (such as UK International Data Transfer Agreements or adequacy regulations) are implemented.

5. Retention Periods

Personal data is retained only for the duration necessary to satisfy the initial business purpose and statutory record-keeping periods under UK law (typically 6 years for financial transaction records). Once retention thresholds elapse, data is securely erased or anonymised.

6. Your Statutory Rights

Subject to statutory conditions under the UK GDPR, you have the right to:

  • Request access to your personal data (Subject Access Request).
  • Request correction of inaccurate or incomplete records.
  • Request deletion (erasure) of your personal data where retention grounds do not apply.
  • Restrict or object to specific processing activities based on legitimate interests.
  • Request data portability in a machine-readable format.
  • Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. Submitting Data Subject Requests

To exercise any of your statutory rights, please send your written request accompanied by verification of your identity to our data protection desk via email at [email protected] or by post to our registered office in London. Requests are processed free of charge within one calendar month.