This policy outlines how XPACE Technologies collects, uses, and protects your information across our digital ecosystem.
By using our services, you acknowledge that you have read and understood this Privacy Policy.
Our commitment to protecting and respecting your privacy
XPACE Technologies ("XPACE," "we," "us," or "our") is committed to protecting and respecting your privacy. In today's digital-first world, trust is built on transparency, accountability, and security.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you:
By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy and agree to the data practices described herein. This policy is designed to align with applicable global data protection regulations, including:
Types of data we collect for secure, reliable, and high-quality services
When you contact us, request a proposal, download resources, register for events, or apply for a role at XPACE Technologies, we may collect:
When you interact with our websites or platforms, we may automatically collect:
IP address, browser type, operating system, device identifiers
Pages viewed, time spent on pages, navigation paths, and interaction logs
Used to enhance user experience, analyze performance, and remember preferences (refer to our Cookie Policy for details)
While delivering services such as Cloud Solutions, AI Implementations, ERP, IoT, or Custom Software Development, XPACE may process data on behalf of its clients.
Important Distinction:
In such cases, XPACE acts as a Data Processor, and the client remains the Data Controller. All processing is conducted strictly in accordance with applicable contracts, including our Master Services Agreement (MSA) and Data Processing Addendum (DPA).
Legitimate business purposes for data processing
We process personal and technical data only for legitimate business purposes, including:
Designing, deploying, operating, and improving our software solutions and consulting services
Responding to inquiries, RFPs, proposals, invoices, service updates, and customer support requests
Sharing newsletters, insights, case studies, and event invitations (only where consent has been provided)
Using anonymized and aggregated data to enhance system performance and AI-driven capabilities
Detecting, preventing, and responding to fraud, cyber threats, and unauthorized access
Meeting obligations related to taxation, corporate governance, export controls, and regulatory reporting
We do not use client or proprietary business data for public or external model training without explicit written consent. Any internal analysis or improvement activities rely on anonymized or aggregated data only.
When and how we share your information
We may share information only in the following circumstances:
Third-party vendors supporting our operations (e.g., cloud hosting, CRM, billing, payment processing). These providers are contractually obligated to maintain confidentiality and security.
Limited data sharing within XPACE group entities to ensure seamless global service delivery.
Where disclosure is required by law, regulation, court order, or lawful government request.
In the event of a merger, acquisition, restructuring, or asset sale, information may be transferred as part of the business continuity process.
Global operations with data protection safeguards
As a global IT consulting and technology company, XPACE Technologies may process and store data in multiple jurisdictions.
Standard Contractual Clauses (SCCs) Protection
For individuals located in the European Economic Area (EEA), data transfers outside the EU are conducted using Standard Contractual Clauses (SCCs) or other legally approved safeguards to ensure continued protection of personal data.
Special considerations for advanced technologies
Secure AI-enabled solutions
Where XPACE provides AI-enabled solutions (such as automation, analytics, or intelligent applications):
Enterprise-grade security controls
XPACE Technologies applies enterprise-grade security controls to safeguard information, including:
AES-256 encryption for data at rest and TLS 1.3 for data in transit
Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA)
Secure development practices, monitoring, and incident response protocols
Security controls aligned with industry-recognized information security standards
While we continuously strengthen our security posture, no digital system can be guaranteed 100% secure.
Control over your personal information
Subject to applicable laws, you may exercise the following rights:
Obtain confirmation and a copy of your personal data
Correct inaccurate or incomplete information
Request deletion of data, subject to legal retention requirements
Limit how your data is processed
Receive your data in a structured, commonly used format
Withdraw consent for marketing communications at any time
Requests may be submitted to our Data Protection Officer (DPO)
How long we keep your information
We retain data only for as long as necessary to fulfill legitimate business and legal purposes:
Retained for the duration of the agreement plus up to 7 years for compliance and audit purposes
Retained until opt-out or after 24 months of inactivity
Get in touch with our privacy team
Attn: Data Protection Officer
Office No. 406, 4th floor, Ceasers tower, Shahra-e-Faisal, opposite ayesha bawany school, Fowler Lines Karachi, Pakistan
For urgent privacy concerns or data breach notifications, please contact our 24/7 security team.
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.
You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
