Privacy Policy

3.1 Enquiry and Contact Form Data

When you submit our website contact form or reach out directly, we collect:

• Full name and job title
• Company or organisation name
• Business email address
• Country of residence or headquarters
• Phone number
• Planned India launch date
• Expected team size in India
• Your message, project description, or enquiry

3.2 Service Delivery Data

When we provide consulting and operational services, we may collect and process:

• Corporate identification documents (incorporation certificates, PAN, TAN, GST/VAT documents)
• Director and officer details (name, address, nationality, identification numbers)
• Employee details for GCC setup and payroll (name, email, designation, compensation)
• Financial information for compliance and invoicing (bank details, tax identification numbers)
• Executed contracts, agreements, and correspondence
• Workspace and vendor agreements

3.3 Communication Data

Records of your communications with us including emails, calls, video meeting notes, and correspondence throughout our engagement.

3.4 Technical and Usage Data

When you visit our website, we automatically collect:

• IP address and approximate geographic location
• Browser type, version, and language settings
• Device type and operating system
• Pages visited, time spent, and navigation path
• Referring website or traffic source
• Cookie identifiers (see Section 11)

3.5 Marketing and Preference Data

Where you have consented to receive updates, or where permitted by applicable law, we retain your communication preferences and marketing interaction history.

5.1 GDPR and UK GDPR (EU and UK Residents)

5.2 India — DPDPA 2023

Processing is based on your consent as a Data Principal, and/or is necessary for the performance of a contract, or for compliance with legal obligations under Indian law. We provide a clear notice of the purposes of processing at or before the point of data collection.

5.3 Singapore — PDPA

Processing is based on consent and contractual necessity as permitted under the PDPA. Where we rely on deemed consent or legitimate interests as permitted under the PDPA, we ensure the processing does not adversely affect your interests.

5.4 Australia — Privacy Act

Processing is conducted with your consent and/or as reasonably necessary for our business functions, in accordance with the Australian Privacy Principles.

5.5 USA — CCPA (California)

We collect personal information for the business purposes described in this Policy. We do not sell or share personal information for cross-context behavioural advertising. California residents have the right to opt-out of any future sale of their personal information at any time.

5.6 Canada — PIPEDA

Processing is based on your knowledge and consent, except where collection without consent is permitted or required under PIPEDA.

7.1 Service Delivery Partners

In the course of providing our services, we work with vetted professional partners including Chartered Accountants, law firms, HR consultants, payroll providers, workspace operators, IT vendors, and recruitment agencies. We share only the minimum data necessary for each specific service, and all partners are subject to confidentiality obligations.

7.2 Technology and Cloud Service Providers

7.3 Legal and Regulatory Disclosure

We may disclose personal data when required to do so by applicable law, court order, regulatory direction, or governmental authority. We will notify you of any such disclosure request to the extent permitted by law.

7.4 Professional Advisors

We may share data with our own legal counsel, accountants, and insurers where necessary, subject to professional confidentiality obligations.

7.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business assets, your personal data may be transferred as part of that transaction. We will provide reasonable prior notice and ensure the receiving party is bound by privacy obligations no less protective than this Policy.

8.1 Data Flowing Into India (from international clients)

When clients outside India share personal data with us, that data is received and processed in India. We act as a Data Fiduciary under the DPDPA 2023 and apply all required protections.

8.2 Data Flowing Out of India (to cloud providers)

We use cloud-based service providers (HubSpot, Google, Calendly) whose infrastructure may be located outside India. Transfers are made in accordance with the transfer mechanisms notified by the Central Government under the DPDPA 2023.

8.3 For EU and UK Residents (GDPR / UK GDPR)

Where we transfer personal data of EU or UK residents to countries outside the EEA or UK, we ensure appropriate safeguards are in place including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreements (IDTAs) where applicable
• Adequacy decisions by the European Commission where available
• Data Processing Agreements with all processors

GDPR Representative Notice: As a firm established outside the EU/UK without a physical EU/UK presence, we are assessing our obligations under GDPR Article 27 / UK GDPR Article 27 regarding appointment of a local representative. EU/UK residents may contact us directly at connect@theexpansionhq.com in the meantime.

8.4 Singapore — PDPA Transfer Limitation Obligation

Transfers of personal data outside Singapore are conducted ensuring the receiving jurisdiction or organisation provides a standard of protection comparable to the PDPA.

8.5 Australia — Privacy Act

Where we disclose personal information to overseas recipients, we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles.

10.1 GDPR and UK GDPR (EU and UK Residents)

• Right of Access — Request a copy of your personal data we hold
• Right to Rectification — Request correction of inaccurate or incomplete data
• Right to Erasure ('Right to be Forgotten') — Request deletion in certain circumstances
• Right to Restriction — Request that we limit how we process your data
• Right to Data Portability — Receive your data in a structured, machine-readable format
• Right to Object — Object to processing based on legitimate interests or for direct marketing
• Right not to be subject to solely automated decisions with significant effects
• Right to withdraw consent at any time without affecting prior lawful processing
• Right to lodge a complaint with your national supervisory authority

10.2 DPDPA 2023 (India)

• Right of Access — Obtain a summary of personal data processed and processing activities
• Right to Correction and Erasure — Correct inaccurate or incomplete data; request erasure on withdrawal of consent
• Right to Grievance Redressal — Raise grievances with our Grievance Officer (see Section 16)
• Right to Nominate — Nominate another individual to exercise your rights in the event of your incapacity or death
• Right to Withdraw Consent — At any time, without affecting prior lawful processing

10.3 Singapore (PDPA), Australia, USA (CCPA) and Canada (PIPEDA)

Residents of Singapore, Australia, California, and Canada have rights of access, correction, deletion, portability (where applicable), and the right to withdraw consent and complain to their relevant national authority. Contact us to exercise any such right.

10.4 Response Timelines

To exercise any of the above rights, email connect@theexpansionhq.com with subject line 'Privacy Rights Request' and specify your jurisdiction and the right you wish to exercise. We may request identity verification before processing requests.

Grievance Officer — India DPDPA 2023

As required under the Digital Personal Data Protection Act 2023, we have designated the following individual as our Grievance Officer:

Supervisory Authorities

You have the right to lodge a complaint with the relevant data protection authority in your jurisdiction: