Privacy Policy

Expandware Corporation is the controller of the personal data described in this policy. We are incorporated in USA under File Number 123456789, issued by the Texas Secretary of State, and our registration can be verified with the regulator directly.

Where we process personal data on behalf of a client, for example inside a system we build or operate for them, that client is the controller and we act as a processor under a written data processing agreement. This policy does not govern that processing; the client agreement does.

• Registered office. 100 Congress Ave, Austin, Texas 78701, USA
• Privacy contact. legal@expandware.us
• Telephone. +92 (333) 32 11011

This policy applies to personal data we handle as a controller: visitors to this website, people who contact us about our services, personnel at client and prospective client organizations, suppliers, and candidates who write to us about work.

• It does not cover personal data we process on a client instruction under a services agreement. That is governed by the data processing agreement in place with that client.
• It does not cover third party websites we link to. Their own policies apply once you leave this site.

Information you give us

The contact form on this site collects your first name, last name, company, work email address, an optional telephone number, the topic of your inquiry, your message, and your confirmation that we may use this to reply to you. If you email us directly, we hold whatever that message contains.

The assistant in the corner of each page is different, and worth stating plainly. What you type to it is sent to a language model running on Cloudflare Workers AI, inside Cloudflare, to be answered from the published content of this site. We do not keep it. The conversation is held in your own browser, in session storage, and is gone when you close the tab. Nothing you type there reaches our database, our storage, or our analytics.

The one exception is the form the assistant offers when it cannot answer. If you choose to fill that in, it becomes an ordinary contact submission: the fields listed above, plus the conversation you had, sent so that whoever replies can read what you already asked. That is the point at which anything is written down, it happens only because you asked for it, and it carries the same consent confirmation the contact form does.

The assistant is instructed never to ask you for personal details, and you should not enter any. It has no access to any client system, any account, or any record about you.

Information collected automatically

When you request a page, our infrastructure records the path requested, the response status, the country your request was routed from, and the referring website where one exists. This is written server side, is not linked to you as an individual, and needs no consent.

Separately, this website loads Google Analytics 4 and Microsoft Clarity, and a Google Tag Manager container through which further tags can be added. Analytics measures how the site is used; Clarity records interaction with a page, excluding anything typed into the contact form. Where consent is required, these run only if you agree. The Cookie Policy sets out what each one is for, who receives it, and how to change your answer.

Information we do not collect

• We do not collect special category data, such as health, biometric, religious, or political data, through this website.
• We do not buy personal data from data brokers, and we do not enrich contact form submissions with third party datasets.
• We do not knowingly collect data from anyone under 16.

Where the EU or UK General Data Protection Regulation applies, we rely on the lawful bases set out below. Where other laws apply, the same purposes hold and the corresponding local basis applies.

We do not use your data for automated decision making that produces legal or similarly significant effects, and we do not profile you for advertising.

If you decline

Refusing the measurement described in section 3 costs you nothing. Every page, document, and form on this site works identically whether you accept or refuse, because nothing here is funded by advertising and no feature depends on knowing who you are. The only thing that changes is that we learn less about which pages were useful.

The contact form is the one place where declining has a consequence, and it is the obvious one: we cannot answer an inquiry without the address to answer it at.

We do not sell personal data, and we do not share it for cross context behavioral advertising. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, we have not sold or shared personal information in the preceding twelve months.

We share data only with the categories of recipient below, each under a written contract that limits them to our instructions.

• Infrastructure providers. Cloudflare, Inc. hosts and delivers this website and provides the anti-automation check, email routing, storage, and database services behind it.
• Professional advisers. Legal, accounting, and audit advisers, where they need the information to advise us.
• Authorities. Regulators, courts, or law enforcement where we are legally required to disclose, and after checking that the request is valid and proportionate.
• A successor. A buyer or successor entity in the event of a reorganization, merger, or sale, under confidentiality obligations.

We operate from USA and serve clients in North America, the United Kingdom, Western Europe, and the Gulf, so personal data may be transferred across borders, including to USA.

USA has not received an adequacy decision from the European Commission or the United Kingdom. Where we transfer personal data out of the EEA or the United Kingdom, we put appropriate safeguards in place before the transfer happens.

• EEA transfers. The European Commission Standard Contractual Clauses, together with a transfer impact assessment and the supplementary technical and organizational measures described in section 8.
• United Kingdom transfers. The UK International Data Transfer Agreement, or the UK Addendum to the Standard Contractual Clauses.
• Swiss transfers. The Standard Contractual Clauses as adapted for Switzerland, recognizing the Federal Data Protection and Information Commissioner as a supervisory authority.
• Other jurisdictions. Contractual protections at least equivalent to the above, agreed before any transfer takes place.

You can request a copy of the safeguards that apply to a particular transfer by writing to legal@expandware.us.

We keep personal data only as long as it serves the purpose it was collected for, or as long as a legal, tax, or limitation period requires.

We operate from secured facilities as a certified Texas Corporation under a government mandated security framework, not an internal policy of our own drafting.

• Physical. Zero phone production floors, biometric access control, and monitoring of the production environment.
• Network and endpoint. Network level data loss prevention on workstations, segmentation between service tiers, and encryption in transit.
• Access. Least privilege access, and administrative areas of this website protected at the network edge by identity aware access control rather than a password form.
• Organizational. Confidentiality obligations for personnel, technical and organizational measures aligned to SOC 2 criteria, and data processing terms with the providers we use.

No system is absolutely secure. Where a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within the period the applicable law requires, and we will notify you directly where the law requires that too.

Your rights depend on where you are. We apply the strongest applicable standard rather than the minimum, and we do not charge for a first request or discriminate against you for making one.

Do Not Track and Global Privacy Control

California law requires us to say how we respond to a Do Not Track signal, and most sites answer that they ignore it. Our answer is that the signal does not need to be read here, because refusal is already where every visit starts. Nothing on this site measures anybody until they accept, so a reader who sends Do Not Track, or the Global Privacy Control signal that has largely replaced it, and does not answer the banner is never measured. That is a property of how the site is built rather than a promise about how we behave, and it can be checked from the outside: load any page, decline or ignore the banner, and no measurement cookie is written.

If you send one of those signals and then press Accept, we treat the later and more specific choice as your answer, which is what the California regulations contemplate. The Cookie settings link in the footer changes it back at any time.

European Economic Area, United Kingdom, and Switzerland

• Access a copy of your personal data, and information about how it is used.
• Rectify data that is inaccurate or incomplete.
• Erase data where it is no longer needed or was processed unlawfully.
• Restrict processing while an issue is being resolved.
• Portability of data you gave us, in a machine readable form.
• Object to processing based on legitimate interests, including profiling.
• Withdraw consent at any time, where consent is the basis, without affecting processing before the withdrawal.

California

Under the California Consumer Privacy Act as amended, you may request to know the categories and specific pieces of personal information collected, request deletion, request correction, and limit the use of sensitive personal information. We do not sell or share personal information, so there is nothing to opt out of, and we honour Global Privacy Control signals as an opt out where they apply. You may use an authorized agent, and we will verify the request before acting.

Other United States jurisdictions

Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, have rights of access, correction, deletion, portability, and opt out of targeted advertising and sale. We conduct none of those advertising activities. Where a state provides an appeal process for a refused request, we will tell you how to use it when we respond.

Canada, Australia, and New Zealand

Under the Personal Information Protection and Electronic Documents Act in Canada, the Privacy Act 1988 and the Australian Privacy Principles, and the Privacy Act 2020 in New Zealand, you may request access to and correction of your personal information, and complain to us or to the relevant Privacy Commissioner.

Gulf Cooperation Council and wider Middle East

Under the Saudi Personal Data Protection Law, the United Arab Emirates Federal Decree Law on the Protection of Personal Data, and the data protection regulations of the Dubai International Financial Centre and the Abu Dhabi Global Market, you may request access, correction, deletion, and portability, and object to processing. Where a law in those jurisdictions requires local storage or registration for a specific engagement, that requirement is addressed in the contract for that engagement.

USA

We handle personal data in line with US law, including the Computer Fraud and Abuse Act and the data protection framework as enacted. You may contact us for access to or correction of your personal data on the same terms offered above.

Write to legal@expandware.us with the subject line Privacy Request and tell us what you want. We will acknowledge within 5 business days and respond within one month, or within the shorter period your local law requires. Where a request is complex we may extend by a further two months and will tell you why within the first month.

We may ask for information to confirm your identity. We ask for the minimum needed and use it only to verify the request.

If you are not satisfied with our response, you may complain to your supervisory authority. In the EEA that is the authority in your country of residence, place of work, or where the issue arose. In the United Kingdom it is the Information Commissioner's Office. In Switzerland it is the Federal Data Protection and Information Commissioner. We would rather you raised it with us first so we can put it right.

We update this policy when our processing changes or the law does. The effective date at the top of the page tells you which version applies. Where a change materially affects your rights, we will take reasonable steps to tell you before it takes effect.