MultiTech (“MultiTech”, “we”) is an IT and software development company based in Baku, Azerbaijan. This document explains what personal data we collect through multitech.az, through the mobile, web and desktop applications and platforms we build, host or maintain for our clients, and through the ATM, POS and kiosk systems we integrate and service; how that data is used and for how long; and the terms on which our services are provided. It applies to visitors to this website, to our clients and their authorised users, and to individuals whose data we encounter while working inside systems we deliver under contract.
01Data We Collect
We collect only the data we need in order to answer enquiries, deliver the software our clients have contracted us to build, and keep the systems we run secure. What we hold depends on how you deal with us, and a large part of it reaches us from our clients rather than directly from the person it describes.
What we collect
- Enquiry data submitted through the forms on this website: your name, company, work email address, telephone number, the service you selected and the description of the project or requirement you wrote.
- Technical data recorded automatically when you visit multitech.az: IP address, browser and device type, pages viewed, the referring page, and an approximate city-level location derived from the IP address.
- Account and usage data inside the applications and platforms we host or maintain for clients: user name and role, authentication and password-reset events, session IP address, and a record of the actions taken in the system.
- Support data: tickets, email and call notes, screenshots, crash reports, stack traces and log extracts that you or your colleagues send us while we investigate a fault or an incident.
- Client data encountered in development, test and staging environments. Where a client gives us access to live data or to a copy of it, we process that data only on the client’s instructions and only for the agreed task; wherever the work allows it, we ask for anonymised or masked data sets instead.
- Business-contact and recruitment data sent to us voluntarily, such as correspondence, tender documents and CVs submitted for a vacancy.
02How We Use Information
Personal data is processed on the basis of the performance of a contract with you or with our client, our legitimate interest in operating and securing our services, compliance with a legal obligation, or your consent where the Law of the Republic of Azerbaijan “On Personal Data” requires it. Where a client is established in the European Union or the platform is hosted there, processing is additionally governed by the data-processing agreement concluded with that client.
Purposes
- Answering enquiries, preparing estimates, proposals and contracts, and keeping a record of what was agreed with whom.
- Designing, building, testing, releasing and supporting the mobile, web and desktop applications a client has contracted us to deliver, including publishing and updating them in app stores on the client’s behalf.
- Operating and monitoring the platforms we host: availability and error monitoring, backups and restore tests, performance tuning, and incident response.
- Securing systems: access control and authentication, detection of intrusion and fraud, and audit logging of administrative actions — logs we keep because we must be able to reconstruct who changed what, and when.
- Meeting legal, accounting, tax and regulatory obligations, and establishing, exercising or defending legal claims.
- Sending operational notices about releases, maintenance windows, end-of-support dates and security issues, which a client cannot opt out of while a contract is in force. Newsletters and other marketing are sent only with prior consent, which you may withdraw at any time without affecting the service you receive.
03Terminal & Payment Data
ATM, POS and kiosk systems that MultiTech integrates, deploys or services process payment data on behalf of the acquiring bank, payment operator or merchant, who remains the data controller. MultiTech acts as processor: we handle cardholder data only on the controller’s instructions and only under the relevant service contract. Our practice in this area is aligned to the PCI DSS control framework and to the requirements each bank imposes on its service providers; MultiTech does not claim to hold a PCI DSS certification or any other certificate.
Controls we apply
- Card data is encrypted at the point of capture by the PIN entry device or the payment application, and MultiTech does not operate systems that store cardholder data in clear text.
- Terminal diagnostics, application logs and support exports exclude the full primary account number (PAN), the PIN and the CVV; where a technical trace would otherwise contain a card number, it is truncated or masked before it leaves the device.
- PIN blocks and encryption keys are managed by the terminal and the bank’s host system. Our engineers have no access to clear-text PINs and do not receive cardholder authentication data.
- Field engineers work under access agreements and confidentiality undertakings, and every service visit is logged with the device identifier, the date and time, the work performed and the identity of the engineer.
- Remote access to a terminal fleet is granted per task, uses named accounts with multi-factor authentication, and is recorded so the controller can review it.
- Transaction records are retained by the controller. MultiTech keeps only the data the service contract requires for fault diagnosis and deletes it securely at the end of that period.
05Subprocessors & Integrations
Delivering software means relying on a limited set of providers. We engage a subprocessor only where it is needed to run a service; where a provider handles personal data for us we require a written processing agreement or equivalent contractual terms, and we remain answerable to our client for what that provider does. We do not sell personal data and we do not share it for anyone else’s marketing. Beyond the categories below, data is disclosed only when a lawful request from a competent authority obliges us to.
Who we rely on
- Google Maps, used to show the office location on the Contact page.
- Email and web hosting providers located in Azerbaijan or the European Union, which carry form submissions and run this website and the platforms we operate.
- Cloud platforms and managed database, storage and monitoring services used to host client applications. The hosting region is fixed in each client contract, and where data is hosted in the European Union the provider’s GDPR terms apply in addition to Azerbaijani law.
- The Apple App Store and Google Play, where MultiTech publishes or updates a mobile application on a client’s behalf. The store account holder and the application’s own privacy notice govern the data end users give that application.
- Error-tracking, source-control and issue-tracking tools used by our engineering team, which can contain log extracts, screenshots or test data taken from a client’s system.
- Payment networks, acquiring banks and payment operators, to the extent required to complete transactions and to keep the terminals we service in working order.
06Your Rights & Data Retention
You have rights over your personal data under the Law of the Republic of Azerbaijan “On Personal Data” and, where the processing falls within its scope, under the GDPR. Write to [email protected] and we will answer within 30 days; if we have to verify your identity first, we will ask only for what is necessary to do so. Where the data sits in a client’s system and MultiTech is only the processor, we pass your request to that client and support them in answering it.
Your rights
- Access: ask what data we hold about you, where it came from and who it has been shared with.
- Correction: have inaccurate or incomplete data put right.
- Deletion: ask us to erase data we no longer have a lawful basis or a contractual reason to keep.
- Objection and restriction: object to processing we carry out on the basis of legitimate interest, and ask us to pause processing while a dispute is examined.
- Withdrawal of consent: withdraw marketing or analytics consent at any time, without affecting anything lawfully done before the withdrawal.
- Complaint: raise the matter with us first, and with the competent supervisory authority in Azerbaijan if our answer does not satisfy you.
How long we keep data
- Enquiry and form data: 24 months after the last contact, unless a contract follows, in which case it becomes part of the project record.
- Contract, invoicing and accounting records: the statutory retention period under Azerbaijani tax and accounting legislation.
- Platform and application logs: 12 months, unless the client contract sets a different period.
- Support tickets and diagnostics: for the term of the support agreement and 12 months after it ends.
- Access to client development and test environments: withdrawn when the engagement ends, and copies of client data held for the work are deleted or returned as the contract requires.
07Terms of Service
These terms govern the use of multitech.az and of the information published on it. Software development, maintenance, hosting and terminal services are delivered under a signed master agreement, a statement of work and, where applicable, a service-level agreement; where those documents differ from this page, they prevail.
Website and proposals
- The content of this website — service descriptions, technology lists and project examples — is informational. It is not an offer and it is not a warranty of any particular result.
- Prices, scope and timelines discussed by email or in a presentation are indicative; a proposal binds MultiTech only once it has been signed by both parties.
- Service levels, response and resolution times, support hours, penalties and limits of liability are defined in each client’s SLA and master agreement, not on this page.
- You may not copy the text, layout or code of this site for commercial reuse, or use the MultiTech name and marks without our written permission.
Deliverables, source code and intellectual property
- Intellectual property in custom deliverables — application source code, database schema, build and deployment scripts, and the project documentation prepared specifically for a client — transfers to that client on final payment of the agreed fee, and the materials are handed over together with it.
- Until final payment, the client holds a licence to use the delivered work for evaluation and acceptance testing only.
- MultiTech retains all rights to the pre-existing tools, internal libraries, frameworks, templates and know-how used to produce the deliverable, and grants the client a perpetual, non-exclusive licence to use them as embedded in the delivered work.
- Third-party and open-source components remain under their own licences. We list the significant ones at handover, and the client’s use of the deliverable is subject to those licences.
- Delivered work is accepted against the acceptance criteria in the statement of work. Defects reported during the warranty period stated in the agreement are corrected at no additional charge, while new requirements, third-party API changes and changes in the client’s own environment are handled as change requests.
- These terms are governed by the laws of the Republic of Azerbaijan. Disputes that cannot be settled by negotiation are heard by the competent courts of Baku.
08Changes to This Document
We review this document at least once a year, and whenever our services, our subprocessors or the applicable law change materially.
How changes are handled
- The version number and the date at the top of this page always identify the text currently in force.
- Editorial corrections are published without notice; changes that affect how we process personal data, or the terms on which services are delivered, are announced before they take effect.
- Clients under contract are notified by email at the address stated in their agreement and, where a change concerns a platform we host for them, by a notice inside that platform.
- Where a change requires consent, we ask for that consent separately. We do not treat continued use of this website as agreement to a material change.
- Earlier versions are kept on file and can be requested from [email protected].