1. Introduction

Xpanair (“we”, “our”, or “us”) is a B2B consulting firm dedicated to helping Pakistani SMEs expand into international markets. We are committed to protecting the privacy and personal data of all individuals who interact with our website and services.

This Privacy Policy explains how we collect, use, store, and protect your information when you visit xpanair.com or engage with our services. By using our website or entering into a service agreement with us, you agree to the terms of this policy.

2. Information We Collect

2.1 Website Visitors

When you visit our website, we may automatically collect the following information:

• IP address and approximate geographic location
• Browser type and version
• Pages visited and time spent on each page
• Referring website or source
• Device type and operating system

2.2 Contact and Inquiry Data

When you submit a contact form, book a discovery call, or reach out to us directly, we collect:

• Full name
• Business email address
• Company name and industry
• Phone number (if provided)
• Content of your message or inquiry

2.3 Client Data (Service Contracts)

When you engage Xpanair as a client, we collect additional information necessary to deliver our services:

• Business registration documents and company details
• Director and owner identity information
• Financial and banking information (where required for compliance setup)
• Target market and product/service information
• Correspondence and communication records
• Signed agreements and contracts

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiries and provide information about our services
• To deliver contracted consulting and market entry services
• To perform compliance checks and regulatory research on your behalf
• To communicate important updates related to your engagement with us
• To improve our website and service offerings
• To maintain accurate business and legal records
• To comply with applicable laws and regulatory obligations

We do not use your personal information for automated decision-making or profiling.

4. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform services under a signed agreement
• Legitimate interests: Responding to inquiries and improving our services
• Legal obligation: Maintaining records as required by applicable law
• Consent: Where you have explicitly agreed to specific processing activities

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information to third parties. We may share your data only in the following circumstances:

• With trusted service providers who assist in delivering our services (e.g., legal advisors, compliance consultants, technology platforms) — all bound by confidentiality obligations
• With regulatory or government bodies where required by law or for the purpose of market entry registration
• With your explicit consent for any other purpose

All third parties who receive your data are required to handle it in accordance with applicable data protection standards.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Website visitor data: Up to 12 months
• Inquiry and contact data: Up to 24 months from last contact
• Client data (active engagement): Duration of the contract plus 5 years for legal and compliance purposes

After the applicable retention period, data is securely deleted or anonymised.

7. Data Security

We take reasonable technical and organisational measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. These measures include:

• Secure server infrastructure with restricted access
• Encrypted data transmission (SSL/TLS) on our website
• Access controls limiting data to authorised personnel only
• Regular review of our data handling practices

While we take all reasonable precautions, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.

8. Your Rights

You have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your data where it is no longer necessary
• Objection: Object to processing based on legitimate interests
• Restriction: Request that we limit how we use your data
• Portability: Receive your data in a structured, machine-readable format

To exercise any of these rights, please contact us using the details provided in Section 11. We will respond to all requests within 30 days.

9. Cookies and Tracking

Our website may use cookies and similar tracking technologies to improve your browsing experience and understand how visitors use our site. These may include:

• Essential cookies: Required for the website to function correctly
• Analytics cookies: Help us understand website traffic and usage patterns

You can control cookie settings through your browser. Disabling cookies may affect some website functionality. We do not use cookies for advertising or cross-site tracking.

10. International Data Transfers

Xpanair operates primarily from Pakistan and serves clients expanding into international markets including the UAE, UK, Germany, and other regions. Where data is transferred across borders, we ensure appropriate safeguards are in place in accordance with applicable data protection laws.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

Xpanair

Email: privacy@xpanair.com

Website: xpanair.com

Pakistan

12. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on our website with a revised date. We encourage you to review this policy periodically.

Continued use of our website or services after any update constitutes your acceptance of the revised policy.