info@apexlanetech.com+1 815 853 2235+91 92058 28250
Book Your Consultation
Legal

Privacy Policy

How we collect, use and protect your information.

Effective date: 12 October 2026

1. Who we are and what this policy covers

ApexLane IT Services (“ApexLane”, “we”, “us” or “our”) provides IT support, cloud and infrastructure services, cybersecurity, website development and digital marketing. This Privacy Policy explains how we handle personal information when you visit apexlanetech.com, make an enquiry, communicate with us or engage our services.

Business contact address: 1501 South Greeley Highway, Suite C, Cheyenne, WY 82007, USA. India headquarters: 1st Floor, Plot No. 112, Udyog Vihar, Phase-1, Gurugram, Haryana 122001, India. Email: info@apexlanetech.com. Telephone: +1 815 853 2235, +91 92058 28250.

Legal entity operating the business: ApexLane IT Services Private Limited, a company incorporated in India (CIN: [INSERT CIN]). Privacy contact: the ApexLane privacy team; contact us at the email above with the subject “Privacy request”.

This policy covers information about identifiable individuals, including business contacts. It does not replace a client data processing agreement or a specific collection notice. Applicable privacy law depends on our legal presence, activities, the information involved and your location. References to regional rights below apply where the relevant law covers the processing; they do not represent certification by a government or regulator.

2. Our role in handling personal information

We generally determine the purposes of processing our own enquiry, supplier, recruitment, billing and business contact records. Depending on the law, this role may be described as controller, business, organisation or Data Fiduciary.

When a client authorises us to support its systems or process its employee or customer information, we may instead act as a processor, service provider or contractor under the client’s instructions. The client’s privacy notice normally explains those activities. Requests concerning that information should usually be directed to the client; we will assist the client as required by our agreement and applicable law.

3. Information we collect

  • Enquiries and correspondence: your name, email, telephone number, company, service interest and message, together with subsequent correspondence. Provide only information relevant to your request. Do not include passwords, payment-card details, government identifiers, medical records or other sensitive information in a general enquiry.
  • Business administration: contact details of authorised representatives, proposals, contracts, invoices, payment status and records needed to manage the relationship. If a payment facility is introduced, we will identify the payment provider and explain what it receives before collection. We do not currently offer online payments or customer accounts; this policy will be updated before either is introduced.
  • Technical website information: hosting or security providers may receive IP addresses, request times, device and browser information, requested pages and security logs when serving the website. The precise records depend on their configuration. Our website is hosted by Hostinger; its server logs are used only to operate and secure the site and are kept as set out in section 11.
  • Client service information: where necessary and authorised, support tickets, device identifiers, account usernames, configuration details, access records, system diagnostics, security alerts and information encountered in client environments. The applicable service agreement must identify the permitted data and access. Access to a system is not permission to use its contents for unrelated purposes.
  • Recruitment information: if you apply for a role, your contact details, CV, qualifications and information you choose to send. We will give any additional notice needed for screening, references or a separate application platform. Do not send unnecessary sensitive information.

Sensitive information is handled only where necessary, lawfully authorised and subject to additional safeguards. A general enquiry or service purchase is not blanket consent to handle health information, biometrics or other regulated data.

4. How information reaches us

We receive information directly from you through email, telephone, authorised messaging channels and service interactions. We may receive it from your employer or a client that has authority to involve you in a project, from authorised suppliers or from lawful public business sources. Public availability does not remove applicable restrictions on use or marketing.

The website contact form sends your entries to Formspree, a form-handling service, which forwards them to our business email. When you book a consultation, the booking calendar is provided by Calendly, which collects your name, email, any answers you give and your chosen time, and sends us the booking. Each provider handles that information under its own privacy notice (see section 9). Newsletter information will be collected when an operational subscription service is made available, with the applicable notice and marketing choices.

5. Why we use information

We use relevant information to respond to enquiries, prepare proposals, communicate with authorised contacts, deliver contracted services, manage invoices and suppliers, investigate service issues, protect systems against misuse and meet legal obligations. We may also maintain evidence needed to resolve disputes or establish legal claims.

Optional marketing and optional tracking are separate purposes. We will not make an enquiry response conditional on agreeing to unrelated promotional messages. Information collected for one purpose will not be repurposed incompatibly without an appropriate legal basis and any required notice or consent.

6. Consent and other permitted grounds

Where consent is required, we will request a clear choice describing the information and purpose. You can withdraw consent through the original preference facility, an unsubscribe mechanism or info@apexlanetech.com. Withdrawal affects future consent-based processing and does not automatically erase records we must lawfully retain.

Other grounds may permit necessary processing, such as performing a contract, complying with a legal obligation or specific statutory exceptions. We assess those grounds under the applicable law rather than assuming that a general business interest is a valid basis everywhere. If required information is not supplied, we may be unable to answer a request or provide the affected service; we will explain this where practicable.

7. Cookies, browser storage and external website resources

The current site stores your cookie-banner choice in browser local storage under the key “apexlane-cookie”. This records acceptance or refusal until the value is cleared or changed; it is not itself evidence that analytics have been enabled or disabled. You can clear site storage in your browser. Doing so may cause the banner to appear again.

Our website loads Google Fonts and images from Unsplash. Your browser sends technical connection information to those providers to retrieve the resources. Their own privacy notices govern their independent handling. We will identify other embedded or hosted features as they are introduced.

Cookies and similar storage used on this website:

  • apexlane-cookie (this website, browser local storage): remembers whether you accepted or declined the cookie banner. Holds only that choice, is kept until you clear it, and is essential to the banner working.
  • Calendly cookies (calendly.com): set only when you open the booking calendar, to run the scheduler. Calendly shows its own cookie banner for any optional cookies; see Calendly’s privacy notice.

No analytics, advertising pixels or tag manager are enabled on this website.

If optional analytics or advertising tools are introduced, we will provide appropriate notice and any legally required choice before they operate. A preference button must actually control the relevant tools. Where required, refusal and withdrawal will be as accessible as acceptance, and recognised universal opt-out signals will be honoured. Essential security and delivery functions may continue where law permits.

Browser “Do Not Track” signals and legally recognised opt-out preference signals are different mechanisms. Because this website runs no analytics, advertising or cross-site tracking, there is currently nothing for either signal to switch off. If we introduce such tools, we will honour Global Privacy Control signals where the law requires. Third-party resources may have their own tracking behaviour; review the inventory and provider notices for details.

8. Marketing choices

We send promotional email or other commercial messages only where permitted, with consent where required. Messages identify the sender and provide an effective unsubscribe method. You can also request that marketing stop by emailing us. Necessary service, invoice or security communications may continue when they do not constitute optional marketing.

We keep only the minimum suppression information needed to respect an opt-out and prevent accidental re-enrolment. Marketing permission is not inferred merely because you supplied contact details for support. Applicable requirements may include Australia’s Spam Act, Canada’s CASL, United States CAN-SPAM rules and local telecommunications restrictions in India and the UAE.

9. Who may receive information

Relevant personnel and authorised contractors may access information needed for their duties. We may engage hosting, business email, support, cloud, security, accounting and other service providers for defined tasks, subject to appropriate confidentiality and data handling terms. Our current providers are:

We may disclose necessary information to a client whose authorised service request involves you; professional advisers; an authority where disclosure is legally required; or a successor in a lawful business transaction, subject to appropriate safeguards and notice. We assess requests from authorities and limit disclosure to what is required or otherwise lawful.

We do not sell, rent or exchange personal information for value, share it for cross-context behavioural advertising, or use it for targeted advertising.

10. International handling

Information may be accessed or processed outside your country where an authorised team or provider is located. Our business contact address is in the USA and we also have headquarters in India. Countries where we market services are not necessarily countries where information is stored.

Our team that handles enquiries and client work is based in India, and information is stored and accessed there. We also use Cloudflare and Amazon Web Services (AWS), whose infrastructure may be located in India, the United States and other countries. Our website contact form (Formspree) and booking calendar (Calendly) are provided by companies based in the United States.

Where required, we assess overseas arrangements, use suitable contractual protection or another lawful transfer mechanism, restrict access and address local storage requirements. We will provide additional information or obtain specific consent where the applicable law requires it. Overseas information may be subject to lawful access by authorities in the receiving jurisdiction. A general acceptance of this policy is not a substitute for a required transfer safeguard.

11. Retention and disposal

We keep information only for the period justified by its purpose, contractual requirements, applicable recordkeeping law and any necessary legal hold. Information no longer needed is securely deleted or appropriately de-identified. Backup copies may remain until their scheduled expiry and should not be restored for unrelated use.

  • Enquiries not resulting in engagement: 12 months from our last contact with you
  • Client service records: for the engagement and 3 years after the service ends
  • Contracts and financial records: 8 years, or longer where tax law requires
  • Applicant records: 6 months after the recruitment decision
  • Website logs: up to 30 days
  • Backup expiry: up to 30 days
  • Marketing consent and suppression records: for as long as needed to respect your choice and show that we did

Different records may require different periods. Mandatory security-log or breach-record retention takes priority over routine deletion where applicable. A deletion request does not require us to destroy records that we are legally obliged to retain; we will explain an applicable exception.

12. Security and incident handling

We select proportionate organisational and technical measures for the information and services involved. These may include controlled access, secure transmission, suitable credential management, updates, monitoring, staff instructions and contractual restrictions. The controls for a client environment are specified in the relevant agreement. For this website, connections are encrypted (HTTPS only), security headers restrict what pages may load, there are no user accounts or databases on our web server, and form and booking details go directly to Formspree and Calendly rather than being stored on it. Business email and records are accessible only to authorised ApexLane personnel.

No internet transmission or system can be guaranteed risk-free. This statement does not limit our legal duty to take appropriate security measures. Do not transmit credentials through ordinary enquiry channels; use a separately agreed secure method.

If an incident occurs, we assess its scope, contain it, preserve necessary evidence and provide notifications and cooperation required by law and contract. Reporting duties vary by jurisdiction, the data affected and our role. We will not delay a mandatory report while awaiting a client’s permission. Report suspected exposure concerning ApexLane to info@apexlanetech.com with the subject “Security concern”; do not include exposed passwords in that message.

13. Your requests and complaints

Depending on applicable law, you may request access, correction, deletion, a portable copy, withdrawal of consent, information about disclosures, an objection or restriction, or an opt-out of particular advertising or profiling activities. Rights have lawful exceptions and are not identical in every jurisdiction.

Email info@apexlanetech.com with your request and sufficient information to locate the records. We may seek proportionate verification or evidence that a representative is authorised. Do not send a government identity document unless we explain why it is necessary and provide a suitable method. Verification information is used only as needed for the request and related lawful recordkeeping.

We respond within the applicable statutory period, explain any permitted extension, and give reasons and available review options if we cannot fulfil a request. Any charge must be permitted by law and disclosed in advance. We do not penalise you for exercising protected rights.

For complaints, describe the issue, relevant dates and the outcome you seek. We will investigate and explain our response. You retain any right to approach the competent regulator or court; contacting us does not waive that right.

14. Regional provisions

India

Where applicable and in force, the Digital Personal Data Protection Act 2023 and its rules govern digital personal data. Relevant rights include information about processing, correction and erasure, grievance redress and nomination as provided by the Act. We apply consent requirements and legally permitted uses to the particular activity. The DPDP Rules 2025 have phased commencement; this policy does not state that every provision is already operative.

The Information Technology Act and the sensitive personal data rules apply where relevant during the legal transition. Designated India grievance contact: Grievance Officer, ApexLane IT Services, info@apexlanetech.com (subject “Grievance”). Grievances under the 2011 rules will be addressed within the required one-month period where those rules apply. Access to the Data Protection Board is subject to the applicable provisions being operative and required prior grievance steps.

Australia

Where the Privacy Act 1988 applies, we handle information in accordance with the Australian Privacy Principles, including access, correction, transparency and appropriate security. Overseas disclosure is addressed under APP 8 where applicable. If unresolved after we have had a reasonable opportunity to respond, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. Coverage depends on the entity and activity; an Australian address alone does not settle every exemption or obligation.

Canada

Where applicable, PIPEDA and relevant provincial private-sector privacy laws govern collection, use, disclosure, safeguards, access and correction. We obtain meaningful consent where required and explain significant overseas processing arrangements. Applicable provincial regimes can include those in Quebec, Alberta and British Columbia. Quebec-specific notices, portability and cross-border assessments are addressed where required. You may complain to the Office of the Privacy Commissioner of Canada or the relevant provincial authority.

United Arab Emirates, including Dubai

Where it applies, Federal Decree-Law No. 45 of 2021 on personal data protection governs relevant processing, subject to its scope, exclusions and implementing requirements. We address applicable consent, security, transfer and individual-rights requirements. Dubai International Financial Centre processing may instead fall within DIFC Data Protection Law No. 5 of 2020, as amended. These are distinct regimes. Complaints may be taken to the competent UAE authority or, for DIFC matters, the DIFC Commissioner of Data Protection.

United States

Applicable federal, state and sector-specific laws depend on the activity. This includes relevant state privacy-notice and breach-notification obligations. Where the California Consumer Privacy Act as amended applies, residents may have rights to know, access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive information and receive non-discriminatory treatment. Other applicable state laws may provide portability, advertising or profiling opt-outs and an appeal of a denied request. Submit an appeal to the privacy email with the subject “Privacy appeal”; we will follow the applicable procedure and explain available regulator escalation.

We do not imply that every United States resident has the same statutory rights or that every privacy law covers this business.

15. Children and regulated information

Our public website and business enquiry services are intended for adults acting in a business capacity, not for children. If you believe a child has submitted information, notify us so we can assess and take appropriate action. Any client service involving children’s information requires separate scope, lawful authority and safeguards; an adult-only website notice does not authorise handling children’s records in client systems.

Health, financial, education, government or other regulated information requires a separate assessment and agreement where appropriate. A cybersecurity or compliance service description does not establish HIPAA coverage, a certification, a government authorisation or permission to process a regulated category.

16. Artificial intelligence and automated tools

Any use of AI with personal information must have a defined purpose, suitable notice, appropriate authority and assessed provider terms. We will not treat a client’s general service instruction as permission to submit its confidential data to a public AI tool. We do not currently use AI tools to process personal information, and we make no solely automated decisions that have legal or similarly significant effects on individuals.

If an activity requires a separate explanation, consent, impact assessment or human-review facility, we will address those requirements before introducing it. Advertising or analytics tools, if enabled, must be described in the relevant inventory rather than hidden under this section.

17. Updates and contact

We update this policy when our practices or applicable requirements change. The effective date identifies the published version. We will provide additional notice and obtain fresh consent where required for a material change; continued browsing is not automatically consent to a new processing purpose.