Privacy Policy

1. Introduction & Scope

Welcome to the Privacy Policy of MACCO XE ("Company", "we", "us", or "our"). This privacy policy is meticulously designed to inform you about how we collect, use, process, and intensely protect your personal and corporate data when you visit our website (www.maccoxe.com), engage with our software development services, use our proprietary platforms (such as Macstrom Battle), or communicate with us in any capacity.

We recognize that as an enterprise IT, FinTech, and Web3 development agency, we handle highly sensitive proprietary information, intellectual property (IP), and critical user data daily. Consequently, we comply with major global data protection regulations, including the General Data Protection Regulation (GDPR) of the European Union and the California Consumer Privacy Act (CCPA).

By accessing our website or utilizing our professional services, you acknowledge that you have thoroughly read, understood, and explicitly agree to be bound by the terms outlined in this Privacy Policy document.

2. Information We Collect

We may collect, use, store, and transfer different categories of personal and business data about you, which we have grouped together as follows:

• check_circleIdentity Data: First name, last name, username or similar identifier, professional title, and company/organization name.
• check_circleContact Data: Billing address, physical business address, corporate email address, and primary telephone numbers.
• check_circleFinancial & Transaction Data: Bank account details, payment card details (processed securely via PCI-DSS compliant gateways like Stripe or Razorpay; we do not store raw card data), and transaction history regarding our services.
• check_circleTechnical Data: Internet protocol (IP) address, your login data, browser type and version, time zone setting, operating system, and platform used to access our website.
• check_circleProprietary & Project Data: Source code snippets, API keys, server credentials, and proprietary business logic shared with us strictly under Non-Disclosure Agreements (NDAs) for development purposes.
• check_circleUsage Data: Information about how you interact with our website, platforms, and services, collected via secure analytics tools.

3. How We Collect Data

We employ various direct and indirect methods to collect data from and about you, including through:

• ads_clickDirect Interactions: You may give us your Identity, Contact, and Financial Data by filling in forms on our site, signing Master Service Agreements (MSAs), or corresponding with us via email, phone, or meetings.
• memoryAutomated Technologies: As you interact with our website, we automatically collect Technical Data about your equipment and browsing patterns utilizing cookies and server logs.
• hubThird Parties & Public Sources: We may receive personal data about you from analytics providers (e.g., Google Analytics), advertising networks, or publicly available corporate registries (e.g., LinkedIn).

4. How We Use Your Information

We will only use your personal data when the law allows us to. Most commonly, we use your data in the following scenarios:

• To register you as a new client and officially set up your enterprise account in our CRM.
• To process, engineer, and deliver the custom software, mobile applications, or IT infrastructure you have contracted us to build.
• To manage our ongoing business relationship, which includes invoicing, fee collection, and critical project updates.
• To administer and protect our business and website operations, encompassing troubleshooting, data analysis, and system maintenance.
• To utilize data analytics for continuously improving our website UI/UX, product offerings, and overall customer experience.

5. Legal Basis for Processing (GDPR Compliance)

For individuals located in the European Economic Area (EEA) or the United Kingdom, our legal basis for collecting and using the personal information described above will depend heavily on the personal information concerned and the specific context in which we collect it.

However, we will normally collect and process personal information from you only under the following legal bases:

• Performance of a Contract: When we need the personal information to perform an agreement with you (e.g., executing a software development contract).
• Legitimate Interests: When the processing is in our legitimate business interests and not overridden by your data protection interests or fundamental rights (e.g., protecting against fraud or improving our IT infrastructure).
• Consent: When we have obtained your explicit, informed consent to do so.
• Legal Obligation: When we have a statutory or legal obligation to collect and retain personal information from you (e.g., for tax and accounting purposes).

6. Information Sharing & Disclosure

MACCO XE does not sell, trade, or rent your personal identification information to unauthorized third parties. We may, however, share your personal data with the specific parties set out below solely for the purposes outlined in Section 4:

• Internal Corporate Affiliates: Other entities and subsidiaries within the MACCO XE corporate group who require access to facilitate project delivery.
• External Service Providers: Highly vetted third-party vendors acting as processors. This includes enterprise cloud hosting providers (e.g., AWS, Google Cloud Platform), IT system administrators, and secure payment gateways (e.g., Stripe, Razorpay) strictly utilized for processing contract fees.
• Professional Advisers: Our external lawyers, bankers, auditors, and insurers who provide consultancy, legal, insurance, and accounting services to our company.
• Legal & Regulatory Authorities: We reserve the right to disclose your data if mandated to do so by applicable law, or in response to legally binding requests by public authorities (e.g., a court order or a government agency subpoena).
• Corporate Restructuring: In the event that MACCO XE undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be securely transferred to the acquiring entity under strict confidentiality agreements.

7. International Data Transfers

MACCO XE is proudly headquartered in India, yet we operate on a global scale serving clients in North America, Europe, and the Middle East. Consequently, your data may be transferred to, and processed in, countries other than the country in which you are resident.

Whenever we transfer your personal data out of the EEA or the UK, we implement rigorous safeguards to ensure a similar degree of protection is afforded to it. We achieve this by ensuring at least one of the following mechanisms is implemented:

• We transfer data only to countries that have been deemed to provide an "adequate level of protection" for personal data by the European Commission.
• When engaging certain global service providers (like AWS), we utilize specific legally-approved contracts known as Standard Contractual Clauses (SCCs), which mandate that the provider gives personal data the exact same protection it has within Europe.

8. Data Security Protocols

The security of your data is the cornerstone of our engineering philosophy. We have architected robust, enterprise-level security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorized way, altered, or maliciously disclosed.

• enhanced_encryption
  Advanced Encryption:We utilize military-grade AES-256 encryption for all data stored at rest. Furthermore, all data in transit across our networks and APIs is secured using modern TLS 1.3 protocols.
• admin_panel_settings
  Strict Access Control (RBAC):We implement severe Role-Based Access Controls within our agency. Only specific senior employees and lead engineers with a legitimate "need to know" are granted temporary access to specific client databases or critical source code repositories.
• policy
  Continuous Auditing & Penetration Testing:Our internal infrastructure and active client deployments are subjected to regular vulnerability scanning, automated threat detection, and manual ethical penetration testing to identify and patch zero-day exploits.

Additionally, we have established rapid-response procedures to deal with any suspected personal data breach. We will legally notify you and any applicable regulatory body of a breach where we are legally required to do so within the stipulated 72-hour window.

9. Data Retention Policy

We will retain your personal data strictly for as long as reasonably necessary to fulfill the purposes we originally collected it for. This includes satisfying any mandatory legal, regulatory, tax, accounting, or government reporting requirements.

To determine the appropriate retention period, we consider the volume, nature, and extreme sensitivity of the personal data, the potential risk of harm from unauthorized use, and the applicable legal requirements of the jurisdiction.

Upon the formal termination or completion of our software development contract, all client proprietary data, operational API keys, and testing databases are securely and permanently purged from our servers within thirty (30) days, unless requested otherwise by the client in writing.

10. Your Privacy Rights

Depending on your global location, you possess powerful rights under data protection laws in relation to your personal data. These empower you to:

• Request Access: Obtain a complete copy of the personal data we hold about you.
• Request Correction: Demand the immediate correction of any incomplete or inaccurate data we hold about you.
• Request Erasure (Right to be Forgotten): Ask us to completely delete or remove your personal data where there is no legally valid reason for us to continue processing it.
• Object to Processing: Object to our processing of your data where we are relying on a legitimate interest, especially for direct marketing purposes.
• Request Restriction: Ask us to temporarily suspend the processing of your personal data in specific scenarios.
• Request Data Portability: Request the structured, machine-readable transfer of your personal data to you or a nominated third party.
• Withdraw Consent: Withdraw your previously given consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

11. California Privacy Rights (CCPA / CPRA)

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you specific, enhanced rights regarding your personal information.

• Right to Know: You may request that we disclose the specific categories and pieces of personal information we have collected about you over the past 12 months.
• Right to Delete: You may request the deletion of your personal information, subject to certain legal exceptions (e.g., completing a financial transaction).
• Right to Opt-Out of Sale: MACCO XE fundamentally operates as a B2B service provider. We do not sell your personal information. We never have, and we never will. Therefore, no opt-out mechanism is required.
• Right to Non-Discrimination: We will never discriminate against you (e.g., by charging different prices or providing lower quality service) for exercising any of your CCPA rights.

12. Cookies & Tracking Technologies

Our website utilizes cookies, web beacons, pixels, and similar tracking technologies to distinguish you from other users, gather analytical data, and provide you with a customized, seamless digital experience.

• Strictly Necessary Cookies: Absolute technical requirements for the operation of our website (e.g., maintaining secure login sessions or shopping carts).
• Analytical & Performance Cookies: Allow us to recognize, count, and track how visitors move around our website. We primarily use Google Analytics for this purpose to improve our UI/UX.
• Functionality Cookies: Used to recognize you when you return, enabling personalized content (such as remembering your region or language preferences).

You possess full control to set your browser to refuse all or some browser cookies. However, please note that if you disable or refuse cookies, certain interactive parts of this website may become inaccessible or function improperly.

13. Children's Privacy

Our enterprise website and B2B software development services are strictly intended for corporate clients and adults. We do not knowingly solicit or collect personal information from children under the age of 16 (or any higher age threshold stipulated by local laws such as COPPA or GDPR).

If you are a parent or guardian and you become aware that your child has provided us with personal information without your consent, please contact us immediately. Upon verification, we will take swift action to permanently remove that information from our servers.

14. Third-Party Links & Services

This website may contain links to external third-party websites, plug-ins, and applications (for example, links to our GitHub repositories, live portfolio projects, or external payment gateways). Clicking on those links or enabling those connections may allow third parties to independently collect or share data about you.

MACCO XE does not control these third-party websites and is not responsible for their respective privacy statements or security practices. When you navigate away from our website, we strongly encourage you to read the privacy policy of every external destination you visit.

15. Changes to this Policy

We keep our privacy policy under constant, rigorous review to ensure absolute compliance with evolving global data laws. We may update this policy periodically to reflect changes in our technological practices, legal requirements, or business operations.

If we make material changes, we will notify you by prominently posting the updated policy on our website and altering the "Last Updated" date at the absolute top of this page. We encourage all clients to review this policy periodically.

16. Contact Information

If you have any questions, concerns, or requests regarding this privacy policy, our data handling practices, or if you wish to formally exercise your legal data rights, please contact our dedicated Data Protection Officer (DPO) via the following channels:

You have the right to make a complaint at any time to your relevant national data protection supervisory authority. However, we would highly appreciate the opportunity to address and resolve your concerns internally before you approach them.