Privacy Policy

This Privacy Policy describes how ECFY Consulting Private Limited (“WebXpress”, “we”, “us”, “our”) collects, uses, discloses and safeguards personal data when you visit www.webxpress.ai (the “Site”), request a product demo, or otherwise interact with us in connection with our logistics software platform and services (collectively, the “Services”).

We are committed to processing personal data lawfully, fairly and transparently in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) of India, the EU General Data Protection Regulation 2016/679 and the UK GDPR (“GDPR”), and the California Consumer Privacy Act of 2018 as amended by the CPRA (“CCPA”), where applicable.

For the purposes of the DPDP Act, WebXpress is the Data Fiduciary. For the GDPR, we are the Controller. For the CCPA, we are the Business.

1. Who we are and how to contact us

ECFY Consulting Private Limited (trading as WebXpress)
Registered office: Mumbai, Maharashtra, India
General queries: business@webxpress.in
Privacy and data rights: apurva@webxpress.in

Grievance Officer (DPDP Act)
Name: Apurva Mankad, Founder & CEO
Email: apurva@webxpress.in

2. Scope

This policy applies to personal data we collect through:

• the Site (including the Request a Demo form at /request-demo/);
• email, telephone, WhatsApp and other messaging channels you initiate with us;
• marketing events, webinars and trade shows;
• our CRM and marketing automation systems.

It does not cover personal data processed on behalf of our enterprise customers within the WebXpress platform itself; that processing is governed by the Data Processing Agreement signed with each customer, under which WebXpress acts as Data Processor.

3. Personal data we collect

3.1 Data you give us via the demo form

When you submit the Request a Demo form, we collect:

• Company name and company website
• Full name
• Work email address
• Phone number and country code
• Job title
• Company size and industry
• Areas of interest (TMS, WMS, Visibility & Control Tower, GreenXpress, AI & Innovation)
• Monthly shipment volume
• Current logistics challenges (free-text)
• How you heard about WebXpress
• Consent record (whether you agreed to the Terms and Privacy Policy and the timestamp of that consent)

3.2 Data you give us in other communications

Content of emails, WhatsApp messages, call recordings (where permitted and disclosed), meeting notes and any other information you choose to share.

3.3 Data collected automatically

• IP address and approximate geo-location (country / region)
• Browser type, device type, operating system
• Referring URL, pages viewed, time on page, click events
• Cookies and similar technologies (see Section 11)

3.4 Data from third parties

• Enrichment data from business intelligence providers (e.g., company firmographics matched against your work email domain)
• Public profiles (e.g., LinkedIn) where you interact with us on those platforms
• Referrals from existing customers or partners

We do not knowingly collect Special Category Data under the GDPR or Sensitive Personal Data under the DPDP Act through the Site.

4. How we use personal data and our legal basis

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

5. Who we share personal data with

We share personal data only with parties who need it to deliver our Services or meet a legal requirement:

• Hosting and infrastructure: DigitalOcean for website and application hosting.
• Email and productivity: our business email provider for inbound and outbound correspondence (demo requests arriving at business@webxpress.in).
• Lead database: our internal PostgreSQL database used by the WebXpress sales team to manage follow-ups.
• Marketing and analytics: providers such as Google Analytics (anonymised where possible) and LinkedIn Insight Tag, subject to your cookie choices.
• Professional advisors: auditors, lawyers and tax advisors under confidentiality.
• Authorities: law enforcement, regulators or courts, when required by applicable law.
• Corporate transactions: acquirers, investors or successors in the event of a merger, acquisition or restructuring, under appropriate confidentiality.

We do not sell personal data as defined under the CCPA, nor do we “share” personal data for cross-context behavioural advertising as defined under the CPRA.

6. Data location and international transfers

WebXpress is headquartered in India. Our primary production data centres are located in:

• India (primary region for India-based customers and the website);
• South East Asia (Singapore and/or Malaysia, for regional customers);
• Australia (for customers in Australia and the South Pacific).

Depending on which of our Services you use and where you are based, your personal data may be processed in one or more of these regions. Where we transfer personal data across borders, we do so on the basis of appropriate safeguards:

• for transfers out of the EEA or UK: European Commission / UK adequacy decisions where available, or the EU / UK Standard Contractual Clauses, supplemented by a transfer impact assessment and, where appropriate, additional technical measures;
• for transfers out of India under the DPDP Act: compliance with any restrictions notified by the Central Government from time to time;
• contractual commitments with our hosting and sub-processors to maintain equivalent protection regardless of processing location.

7. Data retention

• Demo enquiries that do not progress: up to 24 months from last contact, then deleted or anonymised.
• Active sales opportunities: for the duration of the opportunity and up to 36 months after closure.
• Customer contact records: for the term of the customer contract plus 7 years (for tax / audit).
• Website analytics: up to 26 months.
• Cookies: durations are listed in our Cookie Policy.

Retention periods may be extended to comply with legal, regulatory or contractual obligations, or to defend legal claims.

8. Your rights

8.1 Under the DPDP Act (India)

You have the right to:

• access a summary of your personal data and processing activities;
• correct or update inaccurate or incomplete data;
• erase personal data, subject to exceptions;
• nominate another individual to exercise your rights in the event of death or incapacity;
• have grievances redressed by our Grievance Officer (Section 1) within the statutory timeframe;
• escalate to the Data Protection Board of India if you are not satisfied.

8.2 Under the GDPR / UK GDPR

You have the right to access, rectify, erase, restrict or object to processing, data portability, withdraw consent and lodge a complaint with your local supervisory authority (e.g., the Irish DPC, UK ICO, French CNIL).

8.3 Under the CCPA (California residents)

• know what personal information we collect, use, disclose and sell / share;
• delete personal information, subject to exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (note: we do not sell or share personal information);
• limit the use of sensitive personal information (we do not collect sensitive PI through the Site);
• non-discrimination for exercising your rights.

8.4 How to exercise your rights

Email apurva@webxpress.in with the subject line “Data Rights Request” and a description of your request. We will verify your identity before responding and aim to reply within 30 days (or the shorter period required by law). There is no charge for reasonable requests.

9. Children

The Services are intended for business users. We do not knowingly collect personal data from children under 18 (DPDP Act) or under 16 (GDPR). If you believe a minor has provided us data, please contact us and we will delete it.

10. Security

We maintain administrative, technical and physical safeguards designed to protect personal data, including encryption in transit (TLS 1.2+), access controls, logging, patching and regular review. No system is perfectly secure; if we become aware of a personal data breach likely to result in risk to data principals, we will notify you and the relevant authority as required by law.

11. Cookies and similar technologies

The Site uses cookies and similar technologies for:

• Strictly necessary: keeping the Site functional (e.g., theme preference, session tokens). These cannot be disabled.
• Analytics: understanding how visitors use the Site.
• Marketing: measuring campaign performance.

You can manage cookies through your browser settings. Disabling cookies may affect Site functionality.

12. Automated decision-making

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing, including profiling.

13. Changes to this policy

We may update this policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes will be notified by a Site banner or by email where we have a current address for you.

14. Contact

Questions about this Privacy Policy or our data practices:
Privacy / data rights: apurva@webxpress.in
General queries: business@webxpress.in
Post: ECFY Consulting Private Limited, Mumbai, Maharashtra, India

See also our Terms of Use and Cookie Policy.