XPLORENCE PRIVACY POLICY

Privacy Policy

Last updated: 9 October 2026

Consulting company Xplorence (hereinafter referred to as the 'Company', 'we', 'us', or 'our') deeply respects the privacy of your data. As a strategic partner for market leaders and a pioneer in ESG transformation, we view information protection (Data Governance) as a fundamental element of sustainable corporate governance.

This policy describes how Xplorence processes data of website visitors, clients and expert-network applicants. Processing grounds and terms depend on applicable Uzbekistan law, consent and the contract; additional international-project requirements are agreed separately.

01What Information We Collect

To ensure the seamless delivery of high-tech consulting services and the design of intelligent business architectures, we collect information from various sources. Data is categorized into the following broad categories:

Automatically Collected Technical Data and Metadata:Page requests provide the server with connection data, including the IP address and browser parameters. Optional Yandex Metrica on public pages starts only after consent; it receives the page path and limited funnel events without form contents or URL parameters. Respondent questionnaires do not load Metrica. Cookie preferences can be changed through the footer link.
B2B Client Data and Project Documentation:During the initiation of cooperation (e.g., when requesting Market Intelligence, Intelligent Automation, or ISO implementation services), we collect contact information for representatives: Full Name, corporate email, phone numbers, job title, and company name. Additionally, during preliminary negotiations (prior to signing a commercial contract), we may collect tender documentation (RFP), organizational charts, public financial reports, and other business process details voluntarily shared via secure communication channels for preliminary audits.
Expert Network Participant Profiles:Applicants provide their name, contacts, specialization, experience, competencies and CV; additional information comes from application fields or by agreement. The form and CV may contain personal data. They may be sent to external AI for profile creation and team matching, as described below.

02How We Use Your Information

The collected data is integrated into our operational processes solely to achieve the following legitimate business purposes:

Service Delivery and Project Management:Fulfilling contractual obligations to our clients, conducting deep econometric research, and developing ESG strategies using anonymized datasets.
Intelligent Matching and AI Analytics:AI tools may build an expert profile from the form and CV and suggest project matches. This is processing by an external language model, not training a proprietary model on CVs. A responsible staff member decides invitations and team composition.
Compliance, KYC, and AML Procedures:Information may be used to verify contractual details, qualifications and conflicts of interest to the extent required by a specific project or mandatory requirement. The site does not claim universal automated KYC/AML checks for all users.
Thought Leadership and Institutional Memory:Publication of research results and use outside the order are agreed separately. Mailings require an appropriate basis; recipients can opt out through the Company contact or a link provided in the message.

03Data Transfer and Disclosure

Xplorence strictly does not sell, rent, or monetize your personal data by transferring it to advertising brokers. Information disclosure is strictly regulated:

Strategic Clients and Partners:The profile, CV and contact information shared with a client for team selection are agreed for the specific project. Profiles and CVs may retain identifying details; automatic de-identification of every document is not provided.
Authorized IT Service Providers:External technology providers support hosting, message delivery and AI processing. In particular, Anthropic Claude may receive an expert’s name, form details and CV file or text, along with project context. There is no universal automatic removal of contacts from free text and files. Processing terms and required documents must be agreed before transferring restricted data.
Mergers and Acquisitions (M&A):In the event of a reorganization, merger, sale of Company assets, or investment capital raising, databases (as a Company asset) may be transferred to the successor, provided the protection level stated in this Policy is maintained.
Cross-border Transfer via Security Standards:Primary storage on a server in Uzbekistan does not exclude external processing: data from the AI functions described above may be transferred outside the country. The legal basis, data scope and additional contractual safeguards must be determined before transfer. Signed SCCs or a separate DPA are not automatically assumed for every order.
Law Enforcement:Disclosure of information to law enforcement and judicial authorities is carried out solely in response to reasonable and legal procedural requests.

04Security Architecture and Retention Periods

We use the safeguards listed below; they do not imply security certification.

Protection:HTTPS/HSTS protects connections, and access to working data is role-based. Phone reveals for quality checks are logged. Backups are encrypted and copied off-server. External AI may receive briefs, documents and individual open answers; universal automatic de-identification is not provided. Agree the transfer scope before uploading confidential data.
Storage:Retention is split by category in the shared table below. Contract completion does not automatically delete a project. Expert retention periods and grounds are agreed separately; there is no universal automatic five-year erasure.

05Your Digital Rights and Data Control

You retain full sovereignty over your personal information. At any time, you have the right to:

Right to Access and Portability:Request an export of a copy of your personal data in a structured, machine-readable format (e.g., CSV or JSON).
Right to Rectification:Demand the immediate correction of factual errors or outdated information in your profile.
Right to be Forgotten (Deletion):Withdraw consent for processing and initiate the total destruction of your data from our active systems (except for data subject to mandatory archival storage by law).
Protection from Automated Decisions:Request the involvement of a human specialist (review) if an automated AI algorithm rejected your project application.

Retention periods

Category	Period and action
Panel and enquiry contacts	Panel profile: until the member deletes it. Enquiry contacts: while needed to respond and deliver the order; then erasure on request, subject to mandatory document retention. No automatic enquiry expiry is configured.
Respondent phone	Encrypted callback number: 12 months from storage. Deduplication hash: until personal traces are erased on request.
Research answers	Retention and erasure are agreed in the contract. Contract completion does not trigger automatic deletion. Member erasure removes free text; closed answers remain without a direct profile link.
Audio, derivatives and transcripts	12 months from creation: originals, merged audio, Safari copies and stored transcripts. Daily cleanup; earlier when personal traces are erased.
Geotags	12 months from media creation; for drafts, from the last update. Member erasure removes linked geotags.
Contracts	During performance and applicable mandatory retention. Contracts supporting accounting records: at least 5 years after the reporting year; law or a dispute may require longer. A responsible person controls erasure.
Financial and accounting records	At least 5 years after the reporting year (Article 29 of the Accounting Law), longer where required by law. This is a separate archive; profile erasure does not erase mandatory accounting records.
Uploaded brief files	For the brief upload form: 30 days from upload, then source-file deletion. The agreed order specification follows contract retention. This rule applies when the upload form is available.
Backups	Erasure from the live database does not rewrite existing encrypted backups. On restore, the erasure log must be replayed before access is opened. The maximum backup rotation period is available on request.

Send access, correction or erasure requests and questions about processing terms to the Company contact below.

Emailcontact@xplorence.com

We commit to providing a reasoned response to any requests regarding privacy within 30 calendar days.