Privacy Policy

In short

• We collect what you send us through the consultation form, what a website needs to run safely, and a count of visits made without cookies.
• We use it to answer your enquiry. We do not send marketing, sell data or share it for anyone else’s marketing.
• We count visits without cookies and without storing your IP address, so we can see which pages are read and where visitors come from. The site uses no advertising or tracking cookies.
• An enquiry that does not lead to work is deleted 12 months after our last contact with you.
• You can ask to see, correct or delete your data at any time by writing to info@xpandrix.com.

1. Who is responsible

This website and the enquiries sent through it are run jointly by the companies named under “Who we are” on this page, one in the United Arab Emirates and one in Sweden. Together they decide how that data is used, which makes them joint controllers under Article 26 of the EU General Data Protection Regulation (GDPR).

You do not need to work out which company to contact. Every request about your data goes to one address, info@xpandrix.com, and reaches both companies, and you can exercise your rights against either of them.

2. What we collect

When you send the consultation form, we collect:

• your name and email address;
• your company, if you give it;
• the service you are interested in, if you choose one;
• your message;
• the language of the page you wrote from, which page the form was on, and when you sent it.

When we reply, we also keep our email correspondence with you, and the people handling your enquiry may add internal notes to it, such as when they last spoke to you.

To keep the form from being abused, the server holds your IP address in its memory for up to one minute. It is never stored with your enquiry. Like any web server, ours also keeps technical logs of requests (IP address, time, page and browser type) for a short period, to keep the site secure and working.

When you visit the site, we count the visit: the page you read and its language, the website or campaign you came from, the type of device and browser you use, and moments such as sending an enquiry, pressing “Start a project”, tapping a phone number or email address, opening a client’s website or switching language. We do not store your IP address or put anything in your browser. To count a person once a day, the server turns the IP address and the browser’s name into a code, using a key that changes every day and is then deleted, so visits on different days cannot be linked and the code cannot be traced back to you. If your browser asks websites not to track you, we do not count your visit. The statistics stay on our own server and are shared with no one.

We do not use advertising or social media trackers, and we do not buy or receive data about you from anyone else.

3. Why we use it, and on what legal basis

• To answer your enquiry and discuss a possible project. Our legal basis is our legitimate interest in replying to people who contact us about our services (GDPR Article 6(1)(f)). Where you contact us as an individual about an agreement with you, it is also a step you have asked us to take before entering into a contract (Article 6(1)(b)).
• To keep the website secure and working. Our legal basis is our legitimate interest in running a safe website.
• To understand how the website is used and make it better. Our legal basis is our legitimate interest in knowing which pages are read and where visitors come from (GDPR Article 6(1)(f)).
• If you become a client, to carry out the work and keep the records that accounting and tax law require. Our legal bases are the contract with you (Article 6(1)(b)) and our legal obligations (Article 6(1)(c)).

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), we process your data because it is needed for the steps you ask us to take before a possible contract. We do not use your data for marketing, and we make no automated decisions about you.

4. Who we share it with

Your data is seen only by the people in the two companies, in the United Arab Emirates and Sweden, who handle enquiries, and by the service providers we need to run the site:

• our hosting provider, which stores the website and its enquiries on servers in Stockholm, Sweden;
• our email hosting provider, which carries our correspondence with you.

Both act only on our instructions. We share data with authorities only when the law requires it. We never sell your data.

5. Transfers outside the EU

Enquiries are stored in Sweden. Colleagues in our Dubai company read them from the United Arab Emirates, which is outside the European Economic Area and does not have an adequacy decision from the European Commission. For that access we use the Commission’s standard contractual clauses, which bind the recipient to protect your data to the EU standard. You can ask for a copy at info@xpandrix.com.

If you are in the United Arab Emirates, your data is stored in Sweden, where the GDPR applies, one of the most comprehensive data protection laws in the world.

6. How long we keep it

• An enquiry that does not lead to work is deleted 12 months after our last contact with you.
• Each new enquiry is also sent by email to info@xpandrix.com so we see it straight away, and is deleted there on the same schedule.
• Visit statistics are deleted 13 months after the visit.
• If you become a client, we keep what the engagement needs for as long as it lasts, and our accounting records for as long as accounting and tax law requires.
• Server logs are kept for a short period and then deleted by our hosting provider.

7. Your rights

You can ask us, at any time and free of charge:

• for a copy of the personal data we hold about you;
• to correct anything that is wrong or incomplete;
• to delete your data;
• to restrict how we use it while a question about it is resolved;
• to stop using it where we rely on our legitimate interest (you can object at any time);
• to give you the data you gave us in a machine-readable format.

Write to info@xpandrix.com. We reply within one month, and tell you if a complex request needs longer. We may ask you to confirm your identity first.

8. Complaints

If you think we have handled your data wrongly, please tell us first at info@xpandrix.com, so we can put it right. You also have the right to complain to a supervisory authority: in Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se; elsewhere in the EU, the authority where you live or work; in the United Arab Emirates, the federal data protection authority.

9. Security

The site is served over an encrypted connection. Enquiries can be read only by named staff, each signing in individually to the site’s administration. If a breach puts your data at risk, we report it to the supervisory authority within 72 hours where the law requires, and tell you directly if the risk to you is high.

10. Cookies

The site stores only what it needs to work, and nothing that tracks you. The Cookie Policy lists every item.

Read the Cookie Policy

11. Changes to this policy

When we change this policy, the date at the top changes with it. If a change affects how we use data you have already sent us, we will tell you by email before it applies.