Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Contact information: name, email address, phone number, company name and job title when you fill in our contact form or request a demo
• Business enquiry details: project descriptions, requirements and other information you voluntarily share
• Account credentials: if you register for any of our platform services or client portals
• Communication records: emails, calls and meeting notes as part of client engagement

1.2 Information Collected Automatically

• Log data: IP address, browser type, browser version, pages visited, time and date of visit, time spent on pages
• Device information: hardware model, operating system version, unique device identifiers
• Usage data: clickstream data, features accessed, search terms used
• Location data: general geographic location derived from IP address

1.3 Information from Third Parties

• Publicly available professional information (e.g. LinkedIn) for business development purposes
• Referral information when a partner or existing client recommends our services

---

2. How We Use Your Information

We use your personal information for the following purposes:

• To respond to enquiries and provide the services you request
• To deliver, manage and improve our technology services
• To send service-related communications (project updates, invoices, support)
• To send marketing communications where you have consented or where we have a legitimate interest
• To analyse website usage and improve user experience
• To comply with legal and regulatory obligations
• To protect against fraud, security incidents and misuse
• To facilitate business operations including HR, finance and compliance

---

3. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation (GDPR) applies, we process your data on the following legal bases:

Purpose	Legal Basis
Responding to enquiries and delivering services	Contract performance / Pre-contractual steps
Marketing communications (where opted in)	Consent
Website analytics and improvement	Legitimate interests
Fraud prevention and security	Legitimate interests
Legal and regulatory compliance	Legal obligation

---

4. Sharing Your Information

We do not sell, rent or trade your personal information to third parties. We may share your information in the following circumstances:

• Service providers: trusted third-party vendors who assist in delivering our services (cloud infrastructure, email platforms, analytics), bound by confidentiality agreements
• Business partners: where necessary to deliver a project (e.g. Siemens for PLM/Opcenter implementations) and only to the extent required
• Legal compliance: where required by law, court order or government authority
• Business transfers: in the event of a merger, acquisition or sale of assets, with notice to affected users
• Consent: any other sharing with your explicit consent

---

5. Cookies & Tracking Technologies

We use cookies and similar technologies on our website. You can control cookies through your browser settings.

Cookie Type	Purpose	Duration
Essential / Strictly Necessary	Required for the website to function (session management, security)	Session
Analytics	Understanding how visitors use our site (e.g. Google Analytics) — anonymised	Up to 2 years
Functional	Remembering your preferences (language, region)	Up to 1 year
Marketing	Displaying relevant advertising (only with your consent)	Up to 2 years

You may withdraw consent for non-essential cookies at any time by adjusting your browser settings or clearing cookies. Note that disabling certain cookies may affect website functionality.

---

6. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, or as required by law. Typical retention periods:

• Contact and enquiry data: 3 years from last interaction
• Client project records: 7 years (for financial and legal compliance)
• Marketing consent records: until consent is withdrawn + 2 years
• Website analytics data: 26 months (anonymised)

When data is no longer needed, we securely delete or anonymise it.

---

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration or destruction. These include:

• HTTPS/TLS encryption for all data in transit
• Access controls and role-based permissions
• Regular security assessments and vulnerability testing
• Employee training on data protection and security practices
• Incident response procedures for data breaches

No method of transmission over the Internet is 100% secure. If you suspect any security incident, please contact us immediately at mail@canwin.com.

---

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your data ("right to be forgotten") where applicable
• Restriction: request we restrict processing of your data in certain circumstances
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests or for direct marketing
• Withdraw Consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at mail@canwin.com. We will respond within 30 days. You also have the right to lodge a complaint with your relevant data protection authority.

---

9. International Data Transfers

Canwin operates in India. Your personal information may be transferred to, stored or processed in India, which may have different data protection laws than your country of residence.

Where transfers occur from the EEA or UK to countries without an adequacy decision, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) to ensure your data receives adequate protection.

---

10. Children's Privacy

Our website and services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

---

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.

We encourage you to review this Policy periodically. Your continued use of our website after changes constitutes acceptance of the updated Policy.

---

12. Contact Us