Privacy Policy

1. Who We Are

For personal information collected through this website and in the course of enquiries and sales conversations, X-istech is the “data controller” (in India, the “data fiduciary”). When we process personal data on a client's behalf while delivering a project or staffing engagement, we act as that client's “processor” and handle the data only on the client's documented instructions, under the terms of our agreement with them.

You can reach us at info@x-istech.com, or by post at X-istech, Pune, Maharashtra, India.

2. Information We Collect

Information you give us. When you complete the contact form, request a proposal, apply to work with us, or write to us, we collect what you choose to share:

• your name, work email address and company name;
• your country, the service you are interested in, your estimated budget and timeline;
• the details of your project or hiring need, and anything else you include in your message or attachments;
• the content of our email, call and meeting correspondence, including notes we take.

Information collected automatically. When you visit this website, our servers and hosting provider record technical data such as your IP address, browser and device type, operating system, language, the pages you view, the page that referred you, and the date and time of your visit. We use this to deliver the site, keep it secure and understand how it is used.

Cookies. The public pages of this website do not require you to log in. We use only the cookies that are necessary for the site to function (for example, a secure session cookie for our own administrators), and we may use privacy-respecting analytics cookies or similar technology to understand aggregate site usage. See section 4.

Information from client work. If you hire us, we will also handle the project materials you give us, such as source code, designs, content, access credentials and user data in systems we are asked to work on. That information is covered by your project agreement and any data processing terms we sign with you, as well as by this policy.

We do not knowingly collect sensitive personal information (such as government identifiers, financial account numbers, health data or biometric data) through this website, and ask that you do not send it to us through the contact form.

3. How We Use Information, and Our Legal Bases

We use personal information only for purposes we can justify. Where laws such as the EU or UK GDPR apply, the legal basis for each purpose is shown in brackets.

• To respond to your enquiry, prepare proposals, and take steps you ask for before entering into a contract (contract, or our legitimate interest in running our business).
• To deliver, manage and support projects and staffing engagements you have engaged us for (contract).
• To operate, secure and improve this website and our services, including preventing spam, fraud and abuse (legitimate interests).
• To send you occasional updates about our work, where you have asked for them or we are otherwise permitted to; you can opt out at any time (consent or legitimate interests, depending on your location).
• To meet legal, tax, accounting and regulatory obligations, and to establish, exercise or defend legal claims (legal obligation, legitimate interests).

We do not sell your personal information. We do not “share” it for cross-context behavioural advertising, and we do not use it to make decisions about you that have legal or similarly significant effects through automated means alone.

4. Cookies and Analytics

Cookies are small text files stored on your device. We keep our use of them to a minimum:

• Strictly necessary cookies keep the site working and secure, for example the session cookie used when our own team signs in to the site's admin area. These do not need consent.
• Analytics. If we enable analytics, we use it only to understand aggregate usage (which pages are visited, how visitors reach the site). Where the law requires your consent first, we will ask for it, and we will not load non-essential cookies until you agree.

You can block or delete cookies in your browser settings; some parts of the site may not work as intended if you do. You can also enable the “Global Privacy Control” or “Do Not Track” signals in your browser, which we treat as an opt-out where applicable law requires it.

5. How We Share Information

We share personal information only where needed and with appropriate protections:

• Service providers who help us run the website and our business, such as hosting and content delivery, email and communications tools, project-management and file-sharing platforms, and accounting and legal advisers. They may process data only on our instructions and under confidentiality and data protection terms.
• Our own team and carefully vetted contractors, strictly on a need-to-know basis and bound by confidentiality obligations, where they work on your enquiry or project.
• Professional advisers, regulators, courts and law enforcement, where we are required by law or legal process, or need to protect the rights, property or safety of X-istech, our clients or others.
• A successor or prospective buyer, if X-istech is involved in a merger, acquisition or sale of assets, in which case we will make sure personal information remains protected and tell you if its handling materially changes.

We do not sell personal information, and we do not share it with third parties for their own marketing.

6. International Transfers

X-istech is based in India, and our service providers may operate in other countries, so your personal information may be transferred to, stored in and accessed from countries outside your own, including countries whose data protection laws differ from yours.

When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on an appropriate safeguard, such as the European Commission's Standard Contractual Clauses (with the UK addendum where relevant), or another mechanism recognised by law, together with additional technical and organisational measures where appropriate. You can request a copy of the relevant safeguards by contacting us.

7. Data Security

We use reasonable technical and organisational measures to protect personal information, including encrypted connections (HTTPS) on this website, access controls limited to people who need the data, strong authentication for administrative access, and confidentiality obligations for our team and contractors.

No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to affect you, we will notify you and the relevant authorities as required by applicable law.

8. How Long We Keep Information

We keep personal information only for as long as we need it for the purposes in this policy, and then delete or anonymise it.

• Enquiries that do not lead to a project: generally up to 24 months after our last contact, so we can follow up on a conversation or reply if you come back.
• Client and engagement records: for the length of the engagement and then for the period required for tax, accounting, contractual and legal-claims purposes, which is commonly up to eight years.
• Website server logs: typically for a short period, generally not longer than 12 months.
• Marketing preferences: until you opt out, after which we keep only enough information to honour your opt-out.

Project materials held on a client's behalf are returned or deleted at the end of the engagement in line with the client's instructions and our agreement.

9. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights over your personal information:

• access: to ask whether we hold your information and receive a copy of it;
• correction: to have inaccurate or incomplete information corrected;
• deletion: to ask us to erase your information, subject to legal exceptions;
• restriction and objection: to ask us to limit, or to stop, certain processing, including processing based on our legitimate interests or used for direct marketing;
• portability: to receive your information in a commonly used, machine-readable format and have it transmitted to another provider where feasible;
• withdrawing consent: where we rely on your consent, to withdraw it at any time, without affecting processing that took place before;
• not being discriminated against for exercising a privacy right, and, for residents of certain US states, to know the categories of personal information collected, to correct it, and to opt out of any “sale” or “sharing” (which, as noted above, we do not do);
• lodging a complaint with your local data protection authority, for example the Information Commissioner's Office in the UK or your national supervisory authority in the EU, or the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

To exercise any right, email info@x-istech.com. We may need to verify your identity before acting on a request, and we will respond within the time required by the applicable law (generally within 30 days, or sooner where the law specifies). You may also appoint an authorised agent to submit a request on your behalf.

To stop marketing emails, use the unsubscribe link in any message or contact us directly.

10. Children's Privacy

This website and our services are directed at businesses and professionals and are not intended for children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

11. Third-Party Links

This website may link to third-party websites and services, such as social profiles, code repositories or client sites. We are not responsible for their content or privacy practices, and we encourage you to read their policies.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technology or legal requirements. The latest version is always on this page with its effective date. If we make a material change, we will take reasonable steps to let you know, for example by a notice on the site or an email to existing clients.

13. Contact Us

Questions, requests or concerns about this Privacy Policy or how your information is handled can be sent to info@x-istech.com. Please put “Privacy” in the subject line so it reaches the right person quickly.