""Privacy Policy""

1. Who We Are

Arvixi Private Ltd (“Arvixi”, “we”, “us”, or “our”) is a software development and technology services company incorporated in Pakistan, with its registered address at Civic Center, 81, Gulberg Greens Executive Block, Islamabad. We are the data controller responsible for your personal information when you interact with our website, services, or team.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have in relation to your data. We are committed to handling your information with transparency, care, and in compliance with applicable privacy legislation, including the EU General Data Protection Regulation (GDPR) where applicable to international clients and users.

2. Data We Collect

We collect personal data in the following categories, depending on how you interact with us:

Identity & Contact Information

• Name, email address, phone number
• Company name and job title
• Billing address and payment details (processed via third-party payment processors)

Usage & Technical Data

• IP address, browser type, operating system
• Pages visited, session duration, referring URL
• Cookie identifiers and analytics data

Communication Data

• Enquiries and messages submitted via our contact form or email
• Support ticket content and correspondence
• Meeting notes and project communication (for active clients)

3. How We Use Your Data

We use the personal data we collect for the following purposes:

• Service Delivery: To provide, manage, and improve the software development and technology services you have engaged us for.
• Communication: To respond to enquiries, provide support, send project updates, and maintain client relationships.
• Billing: To process payments, issue invoices, and manage financial records as required by law.
• Marketing (with consent): To send newsletters, service updates, or promotional materials where you have opted in. You may unsubscribe at any time.
• Analytics: To understand how our website is used and improve the user experience using aggregated, anonymised data.
• Legal Compliance: To meet our legal and regulatory obligations under applicable law.

4. Legal Basis for Processing

Where the GDPR applies (typically for users and clients based in the European Economic Area or United Kingdom), we rely on the following legal bases for processing your personal data:

• Contract (Article 6(1)(b)): Processing necessary for the performance of a contract with you or to take steps at your request before entering a contract.
• Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, such as improving our services, fraud prevention, and direct marketing to existing clients, where not overridden by your interests or rights.
• Consent (Article 6(1)(a)): Where you have given explicit consent, such as subscribing to our newsletter or accepting non-essential cookies.
• Legal Obligation (Article 6(1)(c)): Where processing is required to comply with a legal obligation, such as tax and financial reporting requirements.

5. Cookies & Tracking

Our website uses cookies and similar tracking technologies to enhance your experience and collect usage analytics. Cookies are small text files placed on your device when you visit our site.

We use the following categories of cookies:

• Essential Cookies: Required for the website to function correctly (e.g., session management). These cannot be disabled.
• Analytics Cookies: Used to understand how visitors interact with our website (e.g., Google Analytics). These are only set with your consent.
• Preference Cookies: Remember your settings and choices to provide a personalised experience.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of parts of our website.

6. Third-Party Services

We work with trusted third-party service providers to operate our business and deliver our services. These providers may process your personal data on our behalf, and we ensure they are bound by appropriate data processing agreements. Key third-party services we use include:

• Google Analytics: Website traffic analytics (anonymised IP addresses)
• Stripe / Payment Processors: Secure payment processing (we do not store card data directly)
• Amazon Web Services (AWS): Cloud hosting and data storage infrastructure
• Google Workspace: Business email and document collaboration
• Vercel / Netlify: Website and application deployment hosting

We do not sell your personal data to any third party. We only share data where necessary for service delivery, legal compliance, or with your explicit consent.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Client project and communication records: 7 years (for legal and financial compliance)
• Contact form enquiries (non-converted): 2 years
• Newsletter subscriber data: Until unsubscription + 30 days
• Website analytics data: 26 months (anonymised after 14 months)
• Support tickets: 3 years from ticket closure

When data is no longer required, we securely delete or anonymise it. You may request earlier deletion of your data in accordance with your rights set out in Section 8 below.

8. Your Rights

Subject to applicable law, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at hr@arvixi.com. We will respond within 30 days of receiving your request.

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or the relevant supervisory authority in your EU member state).

9. International Transfers

As a Pakistan-based company serving international clients, your personal data may be transferred to and processed in countries outside your own jurisdiction, including Pakistan and countries where our cloud infrastructure providers operate (such as the United States and European Union member states).

Where we transfer personal data originating from the EEA or UK to countries not deemed adequate by the European Commission or UK Information Commissioner's Office, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms to protect your data during such transfers.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact our Privacy team: