Privacy Policy

Privacy Policy

for Expandware Corporation (USA) & Expandware Private Limited (Pakistan)

1. Scope and Identification of Data Controllers

This Privacy Policy applies to personal and technical data collected by Expandware Corporation (Austin, TX, USA) and Expandware Private Limited (Bahawalpur and STZA Tech Zone, Lahore, Pakistan) (collectively, “Expandware”, “we”, “us”, or “our”).

We operate as a Data Controller regarding direct customer, client contact, and website visitor information, and as a Data Processor or Service Provider regarding customer systems, client datasets, and managed enterprise workloads governed under Master Services Agreements.

2. Categories of Information Collected

We collect information necessary to deliver high-performance managed IT services, technical consulting, and cybersecurity operations:

  • Directly Provided Information: Corporate contact details (name, business email address, phone number, job title, and enterprise entity affiliation).
  • System & Infrastructure Telemetry: IP addresses, browser fingerprinting, network ingress logs, system performance metrics, and firewall events collected during network administration.
  • Project & Operational Data: Configuration metadata, API specifications, and architectural documentation shared during service execution.

3. Methods and Touchpoints of Data Collection

Data is collected through direct interactions on our website forms (such as consultation requests and technical inquiries), automated telemetry generated when interacting with our network bastions, and authorized diagnostic tools deployed during technical onboarding.

4. Legal Bases for Processing Personal Data

In compliance with the General Data Protection Regulation (GDPR), UK Data Protection Act, and California Consumer Privacy Act (CCPA/CPRA), Expandware processes personal data under the following lawful bases:

  • Performance of a Contract: Fulfilling our obligations under Master Services Agreements, Statements of Work, and technical support retainers.
  • Legitimate Interests: Protecting enterprise network security, preventing cyber threats, enhancing platform stability, and conducting business communications.
  • Legal & Regulatory Compliance: Adhering to applicable taxation, accounting, export control, and audit mandates.

5. Purpose and Utilization of Collected Data

Information gathered by Expandware is utilized strictly for authorized enterprise objectives:

  • Provisioning, maintaining, and monitoring managed cloud and IT infrastructure.
  • Operating our 24/7/365 Security Operations Center (SOC) and resolving technical incidents.
  • Communicating technical advisories, service updates, and billing statements.
  • Enforcing platform security policies and defending against unauthorized intrusion.

6. Data Segregation and Multi-Tenant Isolation

Expandware enforces strict multi-tenant isolation and cryptographic data segregation across all cloud and storage environments. Client production databases, source code repositories, and operational credentials are segregated using dedicated VPCs, role-based access control (RBAC), and multi-factor authentication.

7. Sub-Processors and Enterprise Cloud Infrastructure

Expandware partners only with tier-1, SOC 2 Type II and ISO 27001 certified cloud infrastructure and tooling providers. Primary sub-processors include Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform, and enterprise security telemetry aggregators. All sub-processors are bound by stringent Data Processing Agreements (DPAs).

8. Cross-Border Transfers and International Compliance

When data is transferred internationally between our United States operations, Pakistan engineering centers, and client locations, Expandware implements standard contractual clauses (SCCs) and zero trust encrypted transit via TLS 1.3 to guarantee data protection equivalence across all jurisdictions.

9. Data Retention and Secure Disposal Protocols

Personal and technical data is retained solely for the duration necessary to fulfill the operational purposes described herein or as mandated by statutory compliance guidelines. Upon contract termination, client proprietary data is securely archived or cryptographically purged using NIST 800-88 compliant data destruction standards.

10. Technical, Organizational, and Physical Security Safeguards

Expandware enforces comprehensive defense-in-depth safeguards:

  • AES-256 cryptographic encryption for all stored records and sensitive configurations.
  • Enforced hardware-token multi-factor authentication (MFA) across all administrative portals.
  • Continuous 24/7 automated vulnerability scanning and third-party audit verification.
  • Physical biometric access controls at our engineering centers.

11. Global Privacy Rights (GDPR, CCPA/CPRA, and International Rights)

Depending on your jurisdiction, you possess specific legal rights regarding your personal data:

  • Right of Access & Portability: Request copies of personal records held by Expandware.
  • Right to Rectification: Request correction of inaccurate or incomplete information.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of personal records where statutory retention mandates do not apply.
  • Right to Opt-Out: Expandware does not sell or share personal information for third-party commercial marketing.

12. Cookie Telemetry and Tracking Governance

Our website utilizes essential technical cookies necessary for session security, navigation, and performance caching. We do not deploy invasive third-party ad trackers. Analytical telemetry is collected in anonymized or aggregated format solely to assess platform usability.

13. Children's Privacy Protection

Expandware provides strictly B2B enterprise technology services and solutions. We do not knowingly solicit, collect, or process information from individuals under eighteen (18) years of age.

14. Data Protection Officer and Contact Protocols

For questions regarding this Privacy Policy, data subject access requests (DSARs), or to exercise your privacy rights, please contact our Data Protection and Compliance team at legal@expandware.com or our technical operations desk at support@expandware.com.