Privacy Policy

1. Information We Collect

InfionX Pte Ltd ("InfionX", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what information we collect when you visit www.infionx.com or contact us, how we use it, and your rights under applicable law.

Information You Provide Directly

• Full name, company name, email address, phone number
• Service enquiry details and budget ranges
• Messages and correspondence submitted via our contact form
• Information provided during discovery calls or meetings

Information Collected Automatically

• IP address and approximate geolocation
• Browser type, version, and operating system
• Pages visited, time spent, and navigation paths
• Referring website or search query
• Device type (desktop, mobile, tablet)

Legal Basis for Processing (GDPR)

We process your personal data under one or more of the following legal bases:

• Legitimate interests — responding to enquiries, improving our website
• Contract performance — engaging with prospective and existing clients
• Consent — analytics and marketing cookies (where you opt in)
• Legal obligation — retaining records as required by applicable law

2. Contact Forms

When you submit our contact form, we collect the data fields you provide (name, email, company, message, etc.). This data is:

• Sent to our business email address for the purpose of responding to your enquiry
• Stored in a secure server-side log file (contact-log.txt) for quality and audit purposes
• Used to send you an automatic acknowledgement email confirming receipt

We do not sell, rent, or share your contact form data with third parties for marketing purposes. Your data is used solely to respond to your enquiry and, if applicable, to fulfil a client engagement.

3. Analytics

With your consent, we use Google Analytics 4 (GA4) to understand how visitors use our website. Analytics data collected includes:

• Page views and session duration
• Traffic sources (organic search, direct, referral)
• Device and browser information
• Conversion events (form submissions, button clicks)

GA4 data is anonymised (IP anonymisation enabled) and processed by Google LLC under their Privacy Policy. We do not use analytics to identify individuals.

You can opt out of Google Analytics by visiting Google's opt-out page or by adjusting your cookie preferences on our website.

4. Cookies

We use cookies and similar tracking technologies. Please read our full Cookie Policy for details. In summary:

Your cookie preferences are stored in your browser's localStorage. You can change your preferences at any time via the Cookie Settings link in our footer.

5. How We Use Your Data

We use the information we collect to:

• Respond to your enquiries and provide requested information
• Schedule and conduct discovery calls or meetings
• Deliver contracted services to clients
• Send transactional emails (enquiry acknowledgements, project updates)
• Improve and optimise our website and services
• Detect and prevent spam, fraud, and security incidents
• Comply with applicable legal and regulatory obligations

We do not use your data to send unsolicited marketing emails without your explicit consent, and we do not engage in automated decision-making or profiling that produces legal effects on individuals.

6. Data Sharing & Third Parties

We may share your data with the following categories of third parties, only to the extent necessary:

• Email service providers — for sending transactional emails (e.g. SMTP providers)
• Analytics providers — Google Analytics (with consent)
• Cloud infrastructure providers — AWS, Google Cloud (data processors under DPA)
• Professional advisors — lawyers, accountants (bound by confidentiality)
• Law enforcement — where required by applicable law or court order

We do not sell your personal data. We do not share your data with data brokers, advertising networks, or third-party marketers without your explicit consent.

All third-party processors are subject to Data Processing Agreements (DPAs) where required under GDPR Article 28.

7. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

• Contact form enquiries — retained for 2 years from the date of submission, then deleted
• Client engagement records — retained for 7 years for legal and accounting purposes
• Email correspondence — retained for 3 years unless longer retention is required by law
• Analytics data — retained for 14 months (Google Analytics default, which we apply)
• Server logs (IP addresses) — retained for 30 days for security purposes

Upon expiry of the retention period, data is securely deleted or anonymised.

8. Your Rights Under GDPR

If you are in the European Economic Area (EEA) or UK, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Right of Access — request a copy of the personal data we hold about you
• Right to Rectification — request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten") — request deletion of your data
• Right to Restrict Processing — request that we limit how we use your data
• Right to Data Portability — receive your data in a machine-readable format
• Right to Object — object to processing based on legitimate interests
• Right to Withdraw Consent — withdraw consent at any time where we rely on it

To exercise any of these rights, email privacy@infionx.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g. ICO in the UK, PDPC in Singapore).

9. California Residents — CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights:

• Right to Know — what personal information we collect and how we use it
• Right to Delete — request deletion of your personal information
• Right to Opt-Out — we do not sell personal information, so this right is not triggered
• Right to Non-Discrimination — we will not discriminate against you for exercising your rights

To submit a verifiable consumer request, email privacy@infionx.com with the subject "CCPA Request".

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• HTTPS/TLS encryption for all data transmitted to and from our website
• Server-side input sanitisation and validation on all form submissions
• CSRF token protection on forms
• Rate limiting to prevent brute-force and spam attacks
• Access controls limiting who within InfionX can access personal data
• Regular security reviews and vulnerability assessments

Despite our best efforts, no security measure is completely infallible. In the event of a data breach affecting your rights and freedoms, we will notify relevant supervisory authorities within 72 hours and inform affected individuals without undue delay, as required by GDPR Article 33/34.

11. International Data Transfers

InfionX operates globally with offices and infrastructure in Singapore, India, the UK, and the US. Your personal data may be transferred to and processed in countries outside your country of residence.

For transfers from the EEA/UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions (where applicable)

For transfers involving Singapore, we comply with the Personal Data Protection Act 2012 (PDPA) and its cross-border transfer obligations.

12. Children's Privacy

Our website and services are directed at business professionals and are not intended for children under the age of 16. We do not knowingly collect personal data from individuals under 16. If you believe we have inadvertently collected such data, please contact us immediately at privacy@infionx.com and we will delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where required, notify you by email or a prominent notice on our website.

We encourage you to review this policy periodically. Continued use of our website after the effective date constitutes your acceptance of the updated policy.

14. Contact Us

For any privacy-related queries, requests, or complaints, please contact our Data Protection Officer:

If you are in the UK, you may also contact the Information Commissioner's Office (ICO) at ico.org.uk. In Singapore, the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.