Privacy Policy

01Introduction and scope

Welcome to ExxForce (the “Platform”), a spin-off platform of ExxSun Corporation. We respect your privacy and are committed to protecting your personal and business data.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our social engagement, CRM, and commercial transaction services. It applies to the ExxForce website, mobile and desktop applications, and any related services that link to this policy.

This policy does not apply to third-party websites, applications, or services that integrate with ExxForce but operate under their own privacy policies. Where ExxForce processes data on behalf of a business customer — for example, the customer records, invoices, and contact details a business uploads into its CRM workspace — that business is the data controller and its own privacy notice governs that data. Our handling of it is set out in our Data Processing Agreement.

By using the Platform, you acknowledge that you have read and understood this policy.

02Who we are and who is responsible

For the personal data described in this policy, the data controller is:

Entity

ExxForce, a division of ExxSun Corporation

Registered address

[registered address]

Privacy contact

[privacy@exxforce.com]

Data Protection Officer

[name / email, if appointed]

03Information we collect

Account and profile information

When you register, we collect your name, email address, phone number, login credentials, and the professional or personal profile details you choose to provide, including job title, company, profile photo, and biography.

Business and transaction data

For our CRM and commercial tools, we collect details related to invoices, proposals, Point of Sale (POS) records, payment records, quotes, and customer interactions you create or record on the Platform.

Social and usage activity

Like other social platforms, we collect the content you post, share, or interact with, including messages, media, likes, comments, follows, and how you navigate the Platform.

Technical and device data

We automatically collect IP address, browser type and version, device identifiers, operating system, time zone, referring pages, and server log data. This information supports secure performance, abuse prevention, and diagnostics.

Information from other sources

If you sign in through a third-party identity provider, connect a payment processor, or link an external tool, we receive limited information from that provider, such as your name, email address, and account identifier. We may also receive business contact information from partners and publicly available sources.

Information we do not ask for

We do not request special categories of personal data — such as health, biometric, or political data — and ask that you not upload it to the Platform except where a feature is expressly designed for it.

04Cookies and similar technologies

We use cookies, local storage, and similar technologies to keep you signed in, remember your preferences, secure your session, and understand how the Platform is used. We group them as follows:

• Strictly necessary — authentication, session integrity, load balancing, and fraud prevention. These cannot be switched off.
• Functional — language, layout, and interface preferences.
• Analytics — aggregated measurement of feature usage and performance.

You can manage non-essential cookies at any time through [our cookie settings link] or your browser settings. Disabling strictly necessary cookies may prevent parts of the Platform from working.

05How and why we use your information

We use the information we collect for the purposes below. Where the GDPR or similar laws apply, the legal basis for each purpose is stated alongside it.

Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal. Where we rely on legitimate interests, we have assessed that our interest does not override your rights, and you may object as described in section 13.

06Public, shared, and social content

ExxForce is in part a social platform. Content you post to public areas — posts, comments, reactions, profile details marked public — can be seen, copied, and re-shared by other users and, depending on your settings, by people outside the Platform. Search engines may index public content.

Direct messages and workspace content are visible to the recipients and workspace members you share them with, and to administrators of a business account you belong to. Deleting content removes it from public view, but copies retained by other users, or in backups, may persist for a period.

Please consider carefully what you make public, and review your privacy settings at [settings link].

07Information sharing and disclosure

We do not sell your personal data. We share information only in the following circumstances:

• At your direction — with other users, workspace members, or third-party tools you choose to connect.
• Service providers — vendors who host infrastructure, process payments, send communications, or provide technical support, acting on our instructions under written confidentiality and data protection terms.
• Corporate affiliates — other entities within ExxSun Corporation and its spin-offs, where necessary to operate and support the Platform, under this policy.
• Business transfers — in connection with a merger, acquisition, financing, reorganization, public offering, or sale of assets, information may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.
• Legal requirements and safety — where required to comply with a subpoena, court order, or regulatory process, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of our users, the public, or ExxForce.
• Aggregated or de-identified data — information that can no longer reasonably identify you, used for research, benchmarking, and reporting.

08Selling and targeted advertising

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under United States state privacy laws. We do not use your private messages or CRM records to target advertising.

We honor recognized opt-out preference signals, including the Global Privacy Control (GPC), where transmitted by your browser.

09Payments and financial data

Payments made through the Platform are processed by PCI DSS compliant payment providers. We do not store full payment card numbers on our systems. We retain transaction records — amount, date, status, the last four digits of the instrument, and related invoice details — for accounting, tax, dispute resolution, and fraud prevention purposes.

Our current payment providers are [list providers], whose own privacy notices govern their handling of your payment details.

10Data retention

We keep personal data only for as long as we need it for the purposes described in this policy, and then delete or de-identify it. Our general periods are:

We may retain information for longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

11Data security

We implement administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit and at rest, role-based access controls, network segregation, logging and monitoring, regular patching of our infrastructure, and periodic security reviews. Access to production data is limited to personnel who need it and is subject to authentication controls.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for enabling available account protections such as two-factor authentication.

If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected users without undue delay, in accordance with applicable law.

12International data transfers

ExxForce operates globally and our infrastructure and service providers are located in [list countries/regions]. Your information may therefore be transferred to, stored in, and processed in a country other than your own, including countries whose data protection laws differ from those in your jurisdiction.

Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on an adequacy decision where one applies, or on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) together with supplementary technical and organizational measures. You may request a copy of the relevant safeguards using the contact details in section 18.

13Your data rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — to know what personal data we hold about you and obtain a copy.
• Correction — to have inaccurate or incomplete data corrected.
• Deletion — to have your data erased, subject to legal retention requirements.
• Portability — to receive your data in a structured, machine-readable format, or have it sent to another provider.
• Restriction and objection — to limit or object to certain processing, including processing based on our legitimate interests.
• Withdrawal of consent — where processing is based on consent.
• Opt out of marketing — through the unsubscribe link in any marketing message or your notification settings.
• Non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised your rights.

How to exercise your rights

You can access, update, or delete most of your personal and professional profile information directly in your account settings. For anything else, contact us at [privacy@exxforce.com]. We will verify your identity before acting on a request, usually by confirming control of the account email, and will respond within [30/45] days. If we need more time, we will tell you why.

An authorized agent may submit a request on your behalf with written permission and proof of identity. If we decline a request, we will explain the reason and how to appeal.

If you are in the EEA, the UK, or Switzerland, you also have the right to lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concerns first.

If your data was uploaded to ExxForce by a business using our CRM, please direct your request to that business; we will assist them in responding.

14Children's privacy

ExxForce is a professional and commercial platform intended for adults. It is not directed to children, and we do not knowingly collect personal data from anyone under [16/18]. If you believe a child has provided us with personal data, contact us at [privacy@exxforce.com] and we will delete the account and associated information promptly.

15Personalization and automated processing

We use automated systems to rank content in your feed, suggest connections and business contacts, surface relevant CRM records, and detect spam, fraud, and abuse. These systems draw on your activity, profile, and technical signals.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement. Where automated screening flags an account for suspension or transaction blocking, you may request human review through [support@exxforce.com].

16Third-party links and integrations

The Platform may contain links to third-party sites and offer integrations with external tools such as accounting software, calendars, and payment providers. When you connect an integration, you authorize the exchange of the data that integration requires. We do not control how those third parties use your information, and their privacy policies apply. Review them before connecting.

17Changes to this policy

We may update this Privacy Policy periodically to reflect changes to our services, technology, or legal obligations. We will post the revised policy on this page with a new effective date and version number.

If changes are material — for example, a new purpose for using your data — we will provide advance notice by email or an in-product notification before the change takes effect, and where required, seek your consent. Previous versions are available on request.

18How to contact us

For questions about this policy or how we handle your information:

Privacy enquiries

[privacy@exxforce.com]

Customer support

[support@exxforce.com]

Postal address

[street, city, state, postal code, country]

EU / UK representative

[name and address, if applicable]