Privacy Policy

1. Scope of this policy

This Privacy Policy applies to www.xque.pk (the "Website") and to the xQue Queue Management products, services, hardware, and cloud platform (collectively, the "Services") operated by Experts InfoTech (Pvt) Ltd., a private limited company registered in Pakistan under the Companies Act, 2017.

It explains what information we collect, why we collect it, how long we keep it, who we share it with, and what choices you have. It applies to visitors of our Website, prospective customers, customers who deploy xQue at their premises, and end-users (visitors, patients, citizens) who interact with xQue kiosks and displays at our customer sites.

Where xQue is deployed on a customer's premises, that customer is the controller of the personal data processed at their site (visitor names, ticket numbers, service records). Experts InfoTech acts as a processor on their behalf under a Data Processing Agreement. This policy focuses on the data we collect as a controller of www.xque.pk and the xQue Cloud platform.

2. Who is the data controller?

The data controller for this Website is:

3. What information we collect

We collect information in three ways: information you give us, information we collect automatically, and information from third parties.

3.1 Information you give us

• Contact form: name, work email, phone number, organisation, industry, and the free-text message you send us.
• Account & billing: when you become a customer, we collect your company's legal name, NTN/STRN, registered address, billing contact, and bank/wire details for invoicing.
• Support communications: emails, WhatsApp messages, and call recordings (with notice) you send to our support team.
• Feedback & NPS responses: survey answers and free-text comments you submit through the xQue system.

3.2 Information collected automatically

• Device & browser: IP address, user-agent string, screen size, operating system, language.
• Usage: pages viewed, time on page, referring URL, click paths.
• Cookies: small text files we or our processors set on your device (see Section 5).
• Approximate location: country and city derived from your IP address (not precise GPS).

3.3 Information from third parties

• Business partners: if a reseller refers you to us, we receive your name, work email, and a brief description of your needs.
• Public sources: company size, industry, and publicly available contact data we use to keep our CRM accurate.

4. How we use your information

We process your information for the following purposes, on the legal bases indicated:

• To respond to your enquiry — name, email, message (legal basis: performance of a contract / pre-contractual steps).
• To provide, maintain, secure, and improve the Services — usage data, device data, logs (legal basis: legitimate interest in running a reliable service).
• To send you product updates and newsletters — work email (legal basis: consent, which you can withdraw at any time).
• To train our AI routing and analytics models — aggregated, de-identified service metrics (legal basis: legitimate interest; no personal data is used for training without separate consent).
• To comply with law and enforce our terms — billing records, support logs (legal basis: legal obligation and legitimate interest).
• To prevent fraud, abuse, and security incidents — IP, logs, device fingerprint (legal basis: legitimate interest in protecting our customers and ourselves).

We do not sell your personal information to anyone, ever.

5. Cookies & tracking

We use a minimal set of cookies and similar technologies. We do not use third-party advertising cookies. Categories we use:

• Strictly necessary — session, security, load-balancing cookies. These cannot be disabled because the site doesn't work without them.
• Preferences — language, theme, time-zone, last-viewed demo state. We store these in localStorage rather than cookies where possible.
• Analytics — anonymized, aggregated page-view counts. We prefer privacy-friendly analytics that do not set cross-site tracking cookies.

You can clear cookies and site data at any time from your browser. Most browsers also let you block all cookies or block only third-party cookies — your call.

6. Third-party services we use

To run the Website and the xQue Cloud, we rely on a small number of vetted sub-processors:

• Google Fonts — typography served from Google's CDN. Google's privacy policy applies.
• Google Maps — embedded on our Contact page. Google may set cookies and collect telemetry per its own policy.
• Hosting & CDN — primary hosting in Pakistan, with a disaster-recovery replica in AWS Frankfurt (encrypted in transit and at rest).
• Transactional email — for sending you demo confirmations, password resets, and invoices. We never send marketing email through this provider without your consent.
• WhatsApp Business — for optional virtual-queue conversations initiated by you.

A current, complete list of sub-processors is available on request to privacy@xque.pk.

7. When we share your information

We share information only in these limited cases:

• With your consent — for anything not covered below, we ask first.
• With service providers — the sub-processors listed in Section 6, bound by data-processing agreements.
• For legal reasons — when we receive a valid order from a court of competent jurisdiction, or to investigate suspected violations of our terms or applicable law.
• In a business transfer — if Experts InfoTech is acquired or merges with another entity, your information may be transferred under continued protection of this policy.
• Aggregated, de-identified data — we may share industry-benchmark statistics that cannot be traced back to any individual or organisation.

8. How we protect your information

We take security seriously. In production we use:

• TLS 1.3 encryption for all data in transit.
• AES-256 encryption for data at rest.
• Role-based access control (RBAC) with least-privilege principles.
• Annual third-party penetration tests.
• SOC 2 Type II-aligned controls (formal certification in progress for 2026).
• Encrypted backups, tested quarterly, stored in geographically separate locations.
• 24/7 incident response with a target notification time of 72 hours for any confirmed breach affecting personal data.

No system is 100% secure. If you discover a vulnerability, please report it responsibly to security@xque.pk.

9. How long we keep your information

We keep personal data only as long as we have a clear purpose to do so:

• Contact-form submissions: 24 months from last contact, then anonymised for aggregate analytics.
• Customer billing records: 7 years (Pakistan tax law).
• Support tickets & call recordings: 36 months.
• Website analytics: 14 months in identifiable form, then aggregated.
• Visitor queue data (kiosk): owned by the customer controller; Experts InfoTech retains aggregates for up to 13 months for trend reporting.

10. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data, subject to the retention periods above.
• Restrict or object to certain processing.
• Port your data to another service in a common, machine-readable format.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with the Pakistan Personal Data Protection Authority (once constituted) or your local data-protection authority.

To exercise any of these rights, email privacy@xque.pk from the address you originally contacted us with. We respond within 30 days at no charge.

11. International data transfers

xQue is built for Pakistan first. Most of your data stays in our Islamabad and Faisalabad data centres. Where data does cross borders — for example, our disaster-recovery replica in Frankfurt — it is encrypted in transit and at rest, and protected by Standard Contractual Clauses or equivalent safeguards.

Customer data of Pakistani citizens and residents is, by default, stored in Pakistan. Cross-border replication is encrypted and used only for disaster recovery.

12. Children's privacy

xQue and this Website are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@xque.pk and we will delete it promptly.

13. Changes to this policy

We may update this policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page.
• For material changes, notify customers by email at least 30 days in advance.
• Keep previous versions archived and available on request.

14. Contact us

For any privacy question, request, or complaint, reach our Data Protection team: