Cookie Policy
This website asks for your consent before setting any cookie that is not strictly necessary. Here is exactly what is set, who gets it, and how to change your answer.
The company making these commitments
- Legal entity
- Expandware Private Limited
- Registration
- SECP Corporate Unique Identification Number 0351555, verify with the regulator
- Registered office
- House No 2, Street No 1, Garden Town, Girls College Road, Bahawalpur 63100, Punjab, Pakistan
- Contact
- legal@expandware.com
1. The short version
Two kinds of storage are involved. The first is strictly necessary to deliver something you asked for, and is set without consent because European and United Kingdom rules permit that. The second is measurement and marketing, and is set only if you agree to it.
Where consent is required, you are asked before anything in the second category is set, by a banner from CookieYes, our consent management platform. You can change your answer at any time, and section 7 explains how.
Server side measurement runs regardless and always has. It is written as each page is served, stores nothing on your device, and identifies no one.
2. What a cookie is
A cookie is a small file a website asks your browser to store and send back on later requests. Related technologies include local storage and pixels. Cookies that are strictly necessary to deliver a service you asked for can be set without consent under European and United Kingdom rules; anything else requires your prior agreement.
3. What this site actually sets
| Name and provider | Purpose | Who gets it | Lifetime |
|---|---|---|---|
| Cloudflare Turnstile challenge storage | Confirms a contact form submission came from a person rather than an automated script. Set only on pages carrying the form, and only while the check runs. | Visitors who submit the contact form | Short lived, cleared when the check completes |
| Consent record, CookieYes | Remembers the answer you gave the cookie banner, so you are not asked again on every page. Strictly necessary: without it your choice cannot be honoured. | Every visitor who answers the banner | Up to one year |
| Google Analytics 4 | Tells us which pages are read, which routes into the site work, and which do not. It links one page view to the next within a visit, which is the part server side measurement cannot do. | Google LLC, as our processor | Up to two years, and removed when you withdraw consent |
| Microsoft Clarity | Records how a page is used: where a pointer moves, what is clicked, how far a page is scrolled. It is used to find parts of the site that do not work, and it is a recording of the page rather than of you. | Microsoft Corporation, as our processor | Up to one year, and removed when you withdraw consent |
| Other tags in our Google Tag Manager container | The container can carry further measurement or marketing tags. Any that are added appear in this table before they are switched on. | Named here when in use | Varies by tag |
| CF_Authorization, Cloudflare Access | Session for the administration area at /admin, which is restricted to named Expandware personnel. | Expandware staff only. It is never issued to a public visitor. | Session, per the access policy |
The first three are strictly necessary: to protect a service you are actively using, to remember your consent answer, and to authenticate an internal user. None of those three profiles you or follows you across websites. The fourth is the category you are asked about, and it does not load unless you say yes.
4. What this site does not set
- Nothing in the measurement or marketing category before you agree to it. Declining leaves those tags unloaded rather than loaded and ignored.
- No social media embeds that would set third party cookies.
- No fingerprinting, and no attempt to identify you across devices.
- No third party fonts. Our typeface is served from this domain, so no font vendor sees your request.
- We do not sell or share your personal information, and we run no advertising on this site.
5. How measurement works
Two measurements run, and they are different in kind.
The first needs no consent and always runs. When a page is served, our infrastructure records the path requested, the response status, the country the request was routed from, and the referring website where one exists. That record is written on the server. Nothing is stored on your device, no identifier is assigned to you, and one visit cannot be linked to another. It cannot tell us who you are, and we could not identify you from it if we tried.
The second is Google Analytics 4 and Microsoft Clarity. Analytics measures how the site is used across a visit, which the server side record cannot do because it cannot link one page view to the next. Clarity records interaction with a page, so we can see where a layout defeats people rather than guessing.
Clarity is a recording of a page, not of a person. It captures pointer movement, clicks, and scrolling. It does not capture what you type, and the contact form fields are excluded from what it records. Neither tool is used to build a profile of you, and neither is used for advertising.
6. Third party services
Cloudflare, Inc. provides the hosting, delivery, security, and anti automation services behind this site, and processes request data as our processor under a data processing agreement. Cloudflare Turnstile is used specifically because it verifies a person without the behavioural profiling that a conventional challenge relies on.
Google LLC provides Google Tag Manager, the container through which tags load, and Google Analytics 4. Microsoft Corporation provides Clarity. Both act as our processors for the data those tools collect. CookieYes Limited provides the consent banner and records the answer you give it.
If you follow a link to another website, that site sets its own cookies under its own policy.
7. Controlling storage in your browser
Where a banner has been shown to you, your answer can be changed whenever you like, through the cookie settings link in the footer of every page. Withdrawing consent is as easy as giving it, and takes effect immediately.
You can also block or delete cookies in your browser settings at any time. Blocking the strictly necessary ones may prevent the contact form check from completing or your consent answer from being remembered, in which case you can email legal@expandware.com directly instead.
8. Regional position
- European Economic Area. Under the ePrivacy Directive as implemented locally, storage that is not strictly necessary needs your prior consent. That is what the banner is for. Analytics and session recording load only after you accept, and refusing leaves them unloaded rather than loaded and told to behave.
- United Kingdom. The same position under the Privacy and Electronic Communications Regulations.
- California and other US states. We do not sell or share personal information, and we run no cross context behavioural advertising, so there is no opt out to offer. A Global Privacy Control signal needs no special handling here, because nothing in the measurement category loads for anybody until they accept.
- If we add a tag. Anything new appears in the table in section 3 before it is switched on, and it joins the category you are asked about rather than the strictly necessary list. The two things that decide whether a tag needs consent are what it does and where you are, never how convenient it would be for us.
Questions about this document go to legal@expandware.com, or use the contact form. We answer policy questions from procurement and security teams as a matter of course.