Last Updated: November 29, 2025
Company Name: NY SOFTWARE & IT
Date of Incorporation: November 29, 2025
Primary Jurisdiction: United States of America – State of Florida – Miami

1. Introduction and Scope

This Privacy Policy (the “Policy”) is issued by NY Software & IT (“Company,” “we,” “us,” or “our”) and is intended to describe, in extensive and detailed legal terms, how the Company collects, accesses, uses, processes, stores, protects, transfers, and discloses Personal Data and other information in connection with all of its business operations. This includes, without limitation, our websites, client portals, applications, custom-developed software, managed IT services, consulting services, cloud-related services, cybersecurity services, technical support, and any other services offered now or in the future (collectively, the “Services”).

This Policy applies broadly to all individuals and entities that interact with the Company in any capacity, including but not limited to website visitors, prospective clients, customers, end users, representatives of client organizations, vendors, contractors, and business partners. The scope of this Policy is intentionally broad to ensure comprehensive coverage and to limit ambiguity regarding the Company’s privacy practices.

This Policy is designed to comply with applicable privacy and data protection laws, including United States federal and state laws and international frameworks, while at all times preserving the maximum level of protection and limitation of liability for the Company as permitted by law. Nothing in this Policy shall be interpreted as creating obligations beyond those required by applicable law or expressly agreed to in writing.

2. Company Identification

NY Software & IT is a technology and information services company founded on November 29, 2025, and organized under the laws of the State of Florida, United States, with principal operations in Miami, Florida. The Company provides a broad range of information technology services, including managed IT services, custom software development (including C# development), web development of varying complexity, infrastructure support, and related professional services.

The Company operates primarily as a business-to-business service provider, although certain Services may be accessed by individual users. All Personal Data processed by the Company is handled in accordance with this Policy and applicable contractual agreements.

For purposes of privacy-related inquiries, data protection requests, or regulatory communications, the Company may be contacted at nelsongarcia@nysoftwareit.com. Communications sent to this address will be reviewed and responded to in accordance with applicable law, subject to reasonable verification and response timelines.

3. Definitions

For purposes of this Policy, “Personal Data” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual. This includes, without limitation, information defined as personal data, personal information, or personally identifiable information under applicable law.

“Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, restriction, erasure, or destruction.

Capitalized terms not otherwise defined herein shall have the meanings assigned to them under applicable data protection laws or the Company’s Terms and Conditions, as applicable.

4. Applicability of This Policy

This Policy applies globally to all Personal Data processed by or on behalf of the Company in connection with the Services, regardless of the location of the data subject. Certain rights and obligations described in this Policy apply only to individuals located in specific jurisdictions, such as the European Economic Area (“EEA”), the United Kingdom, or the State of California.

Where local law provides additional rights or imposes additional obligations, the Company will comply with such requirements to the extent applicable. However, the Company reserves the right to apply jurisdiction-specific provisions only to the extent required by law.

Nothing in this Policy is intended to grant rights or impose obligations beyond those required by applicable law. The Company expressly disclaims any interpretation of this Policy that would expand its legal responsibilities beyond statutory or contractual requirements.

5. Categories of Personal Data Collected

The Company may collect and process various categories of Personal Data depending on the nature of the interaction and the Services provided. These categories may include identifiers such as names, email addresses, phone numbers, and business contact information; professional and employment-related information; billing and transactional data; and communications exchanged with the Company.

In addition, the Company may collect technical and usage information, including IP addresses, device identifiers, browser types, operating systems, access logs, and interaction data, for purposes of security, analytics, and service optimization.

The Company does not intentionally collect sensitive personal data unless strictly necessary to provide Services or comply with legal obligations. Where such data is processed, it is subject to enhanced safeguards and contractual limitations.

6. Sources of Personal Data

Personal Data may be collected directly from individuals through forms, communications, or service usage; automatically through the operation of the Company’s systems and technologies; from clients or employers in the context of providing Services; from third-party service providers; or from publicly available sources.

The Company limits collection to data that is reasonably necessary for legitimate business purposes. Data obtained from third parties is processed in accordance with this Policy and applicable agreements.

The Company disclaims responsibility for the accuracy of Personal Data provided by third parties or clients acting on behalf of data subjects.

7. Purposes of Processing

The Company processes Personal Data for a variety of legitimate business purposes, including but not limited to providing, maintaining, and improving the Services; managing client relationships; billing and accounting; providing customer support; ensuring system security; complying with legal and regulatory obligations; and protecting the Company’s rights and interests.

Personal Data may also be used for internal business operations, analytics, quality assurance, and service development. Processing is limited to purposes that are reasonably related to the Company’s business activities.

The Company does not sell Personal Data in the traditional sense and does not use Personal Data for purposes incompatible with those described herein without appropriate notice or consent where required by law.

8. Legal Bases for Processing (GDPR)

For data subjects subject to the GDPR, the Company relies on one or more lawful bases for processing Personal Data, including contractual necessity, legitimate interests, compliance with legal obligations, and consent where applicable.

Legitimate interests may include providing and improving Services, ensuring security, preventing fraud, and conducting business operations. The Company has conducted balancing assessments where required to ensure that such interests do not override the rights of data subjects.

Where processing is based on consent, such consent may be withdrawn at any time, subject to legal and contractual limitations.

9. HIPAA Disclaimer and PHI Handling

The Company is not a “Business Associate” as defined under HIPAA unless expressly agreed to in writing through a valid and executed Business Associate Agreement (“BAA”). Absent such agreement, the Company assumes no obligations or liabilities under HIPAA.

Clients are solely responsible for determining whether information constitutes Protected Health Information (“PHI”) and for ensuring compliance with HIPAA and related laws. The Company expressly disclaims responsibility for PHI improperly included in systems or Services not designed for HIPAA compliance.

Even where a BAA is in place, the Company’s obligations are strictly limited to those expressly set forth in the BAA and applicable law, and no additional obligations shall be implied.

10. GDPR Rights and Limitations

Data subjects may have rights of access, rectification, erasure, restriction, portability, and objection under the GDPR. The Company will respond to valid requests in accordance with applicable law.

The Company reserves the right to deny or limit requests where permitted by law, including where requests are manifestly unfounded, excessive, or would adversely affect the rights of others or the security of systems.

Requests must be submitted through appropriate channels and are subject to identity verification and reasonable response timelines.

11. CCPA / CPRA Rights

California residents may have rights to know what Personal Information is collected, to request deletion, and to opt out of certain data practices, subject to statutory exceptions.

The Company may require verification of identity before responding to requests and may deny requests where permitted by law.

The Company will not discriminate against individuals for exercising their rights under applicable California law.

12. FIPA and State Privacy Laws

The Company implements reasonable administrative, technical, and physical safeguards to protect Personal Data in accordance with the Florida Information Protection Act (FIPA) and other applicable state privacy laws.

Compliance measures are designed to reduce risk while maintaining operational efficiency and legal defensibility.

The Company’s obligations under state privacy laws are limited to the extent required by such laws.

13. Cookies and Tracking Technologies

The Company uses cookies and similar technologies to enable core functionality, analyze usage, enhance security, and improve user experience.

Users may control cookie settings through browser preferences; however, disabling cookies may affect functionality.

The Company disclaims responsibility for third-party tracking technologies embedded in external services.

14. Third-Party Processors and Partners

The Company may engage third-party service providers and strategic partners, including Microsoft, Pax8, and NinjaOne, to support the delivery of Services.

Each third party operates under its own privacy practices, and the Company does not control or assume responsibility for their independent actions.

Engagement of third parties does not constitute endorsement or transfer of liability.

15. International Data Transfers

Personal Data may be transferred to and processed in the United States and other jurisdictions where the Company or its service providers operate.

Where required by law, appropriate safeguards such as contractual clauses are implemented.

Data subjects acknowledge that data protection laws may differ between jurisdictions.

16. Data Retention

Personal Data is retained only for as long as necessary to fulfill the purposes described in this Policy or to comply with legal obligations.

Retention periods vary depending on data type, contractual requirements, and legal considerations.

The Company may retain certain data for dispute resolution, compliance, and enforcement purposes.

17. Data Security

The Company employs reasonable administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, or loss.

No system is completely secure, and the Company does not guarantee absolute security.

The Company disclaims liability for security incidents beyond its reasonable control.

18. User Responsibilities

Users and clients are responsible for ensuring that data provided to the Company is lawful, accurate, and appropriately authorized.

Users must maintain the confidentiality of credentials and access mechanisms.

The Company is not responsible for unauthorized access resulting from user negligence.

19. Limitation of Liability (Privacy)

To the maximum extent permitted by law, the Company shall not be liable for indirect, incidental, consequential, or punitive damages arising out of privacy-related matters.

Any liability shall be limited as provided in the applicable Terms and Conditions or service agreement.

This limitation applies regardless of the legal theory asserted.

20. Indemnification

Users and clients agree to indemnify, defend, and hold harmless the Company from claims arising out of their misuse of the Services or violation of applicable privacy laws.

Indemnification obligations survive termination of the relationship.

The Company reserves the right to control the defense of any indemnified claim.

21. Changes to This Policy

The Company may modify this Policy at any time in its sole discretion.

Changes become effective upon publication.

Continued use of the Services constitutes acceptance of the revised Policy.

22. Governing Law and Jurisdiction

This Policy is governed by the laws of the State of Florida, without regard to conflict-of-law principles.

Any disputes shall be resolved exclusively in courts located in Florida.

23. Contact Information

For privacy-related inquiries, requests, or complaints, contact: nelsongarcia@nysoftwareit.com

© 2026 NY SOFTWARE & IT. ALL RIGHTS RESERVED.