Privacy Policy

Expandware Private Limited is the controller of the personal data described in this policy. We are incorporated in Pakistan under Corporate Unique Identification Number 0351555, issued by the Securities and Exchange Commission of Pakistan, and our registration can be verified with the regulator directly.

Where we process personal data on behalf of a client, for example inside a system we build or operate for them, that client is the controller and we act as a processor under a written data processing agreement. This policy does not govern that processing; the client agreement does.

• Registered office. House No 2, Street No 1, Garden Town, Girls College Road, Bahawalpur 63100, Punjab, Pakistan
• Privacy contact. legal@expandware.com
• Telephone. +92 (333) 32 11011

This policy applies to personal data we handle as a controller: visitors to this website, people who contact us about our services, personnel at client and prospective client organisations, suppliers, and candidates who write to us about work.

• It does not cover personal data we process on a client instruction under a services agreement. That is governed by the data processing agreement in place with that client.
• It does not cover third party websites we link to. Their own policies apply once you leave this site.

Information you give us

The contact form on this site collects your first name, last name, company, work email address, an optional telephone number, the topic of your enquiry, your message, and your confirmation that we may use this to reply to you. If you email us directly, we hold whatever that message contains.

Information collected automatically

When you request a page, our infrastructure records the path requested, the response status, the country your request was routed from, and the referring website where one exists. This is written server side, is not linked to you as an individual, and needs no consent.

Separately, this website loads Google Analytics 4 and Microsoft Clarity, and a Google Tag Manager container through which further tags can be added. Analytics measures how the site is used; Clarity records interaction with a page, excluding anything typed into the contact form. Where consent is required, these run only if you agree. The Cookie Policy sets out what each one is for, who receives it, and how to change your answer.

Information we do not collect

• We do not collect special category data, such as health, biometric, religious, or political data, through this website.
• We do not buy personal data from data brokers, and we do not enrich contact form submissions with third party datasets.
• We do not knowingly collect data from anyone under 16.

Where the EU or UK General Data Protection Regulation applies, we rely on the lawful bases set out below. Where other laws apply, the same purposes hold and the corresponding local basis applies.

We do not use your data for automated decision making that produces legal or similarly significant effects, and we do not profile you for advertising.

If you decline

Refusing the measurement described in section 3 costs you nothing. Every page, document, and form on this site works identically whether you accept or refuse, because nothing here is funded by advertising and no feature depends on knowing who you are. The only thing that changes is that we learn less about which pages were useful.

The contact form is the one place where declining has a consequence, and it is the obvious one: we cannot answer an enquiry without the address to answer it at.

We do not sell personal data, and we do not share it for cross context behavioural advertising. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, we have not sold or shared personal information in the preceding twelve months.

We share data only with the categories of recipient below, each under a written contract that limits them to our instructions.

• Infrastructure providers. Cloudflare, Inc. hosts and delivers this website and provides the anti-automation check, email routing, storage, and database services behind it.
• Professional advisers. Legal, accounting, and audit advisers, where they need the information to advise us.
• Authorities. Regulators, courts, or law enforcement where we are legally required to disclose, and after checking that the request is valid and proportionate.
• A successor. A buyer or successor entity in the event of a reorganisation, merger, or sale, under confidentiality obligations.

We operate from Pakistan and serve clients in North America, the United Kingdom, Western Europe, and the Gulf, so personal data may be transferred across borders, including to Pakistan.

Pakistan has not received an adequacy decision from the European Commission or the United Kingdom. Where we transfer personal data out of the EEA or the United Kingdom, we put appropriate safeguards in place before the transfer happens.

• EEA transfers. The European Commission Standard Contractual Clauses, together with a transfer impact assessment and the supplementary technical and organisational measures described in section 8.
• United Kingdom transfers. The UK International Data Transfer Agreement, or the UK Addendum to the Standard Contractual Clauses.
• Swiss transfers. The Standard Contractual Clauses as adapted for Switzerland, recognising the Federal Data Protection and Information Commissioner as a supervisory authority.
• Other jurisdictions. Contractual protections at least equivalent to the above, agreed before any transfer takes place.

You can request a copy of the safeguards that apply to a particular transfer by writing to legal@expandware.com.

We keep personal data only as long as it serves the purpose it was collected for, or as long as a legal, tax, or limitation period requires.

We operate from secured facilities as a certified Special Technology Zone Enterprise under a government mandated security framework, not an internal policy of our own drafting.

• Physical. Zero phone production floors, biometric access control, and monitoring of the production environment.
• Network and endpoint. Network level data loss prevention on workstations, segmentation between service tiers, and encryption in transit.
• Access. Least privilege access, and administrative areas of this website protected at the network edge by identity aware access control rather than a password form.
• Organisational. Confidentiality obligations for personnel, technical and organisational measures aligned to SOC 2 criteria, and data processing terms with the providers we use.

No system is absolutely secure. Where a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within the period the applicable law requires, and we will notify you directly where the law requires that too.

Your rights depend on where you are. We apply the strongest applicable standard rather than the minimum, and we do not charge for a first request or discriminate against you for making one.

Do Not Track and Global Privacy Control

California law requires us to say how we respond to a Do Not Track signal, and most sites answer that they ignore it. Our answer is that the signal does not need to be read here, because refusal is already where every visit starts. Nothing on this site measures anybody until they accept, so a reader who sends Do Not Track, or the Global Privacy Control signal that has largely replaced it, and does not answer the banner is never measured. That is a property of how the site is built rather than a promise about how we behave, and it can be checked from the outside: load any page, decline or ignore the banner, and no measurement cookie is written.

If you send one of those signals and then press Accept, we treat the later and more specific choice as your answer, which is what the California regulations contemplate. The Cookie settings link in the footer changes it back at any time.

European Economic Area, United Kingdom, and Switzerland

• Access a copy of your personal data, and information about how it is used.
• Rectify data that is inaccurate or incomplete.
• Erase data where it is no longer needed or was processed unlawfully.
• Restrict processing while an issue is being resolved.
• Portability of data you gave us, in a machine readable form.
• Object to processing based on legitimate interests, including profiling.
• Withdraw consent at any time, where consent is the basis, without affecting processing before the withdrawal.

California

Under the California Consumer Privacy Act as amended, you may request to know the categories and specific pieces of personal information collected, request deletion, request correction, and limit the use of sensitive personal information. We do not sell or share personal information, so there is nothing to opt out of, and we honour Global Privacy Control signals as an opt out where they apply. You may use an authorized agent, and we will verify the request before acting.

Other United States jurisdictions

Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, have rights of access, correction, deletion, portability, and opt out of targeted advertising and sale. We conduct none of those advertising activities. Where a state provides an appeal process for a refused request, we will tell you how to use it when we respond.

Canada, Australia, and New Zealand

Under the Personal Information Protection and Electronic Documents Act in Canada, the Privacy Act 1988 and the Australian Privacy Principles, and the Privacy Act 2020 in New Zealand, you may request access to and correction of your personal information, and complain to us or to the relevant Privacy Commissioner.

Gulf Cooperation Council and wider Middle East

Under the Saudi Personal Data Protection Law, the United Arab Emirates Federal Decree Law on the Protection of Personal Data, and the data protection regulations of the Dubai International Financial Centre and the Abu Dhabi Global Market, you may request access, correction, deletion, and portability, and object to processing. Where a law in those jurisdictions requires local storage or registration for a specific engagement, that requirement is addressed in the contract for that engagement.

Pakistan

We handle personal data in line with Pakistani law, including the Prevention of Electronic Crimes Act 2016 and the data protection framework as enacted. You may contact us for access to or correction of your personal data on the same terms offered above.

Write to legal@expandware.com with the subject line Privacy Request and tell us what you want. We will acknowledge within 5 business days and respond within one month, or within the shorter period your local law requires. Where a request is complex we may extend by a further two months and will tell you why within the first month.

We may ask for information to confirm your identity. We ask for the minimum needed and use it only to verify the request.

If you are not satisfied with our response, you may complain to your supervisory authority. In the EEA that is the authority in your country of residence, place of work, or where the issue arose. In the United Kingdom it is the Information Commissioner's Office. In Switzerland it is the Federal Data Protection and Information Commissioner. We would rather you raised it with us first so we can put it right.

We update this policy when our processing changes or the law does. The effective date at the top of the page tells you which version applies. Where a change materially affects your rights, we will take reasonable steps to tell you before it takes effect.