Privacy Policy

Xclamation.ai ("Xclamation", "we", "us", or "our") respects your privacy and is committed to processing personal data transparently, securely, and in compliance with applicable global privacy laws.

This Global Privacy Policy ("Policy") governs how we collect, use, store, disclose, and protect personal information when you:

• Visit our website (xclamation.ai or affiliated domains);

• Interact with our digital content, marketing materials, or communications;

• Engage us for Agentic AI consulting, architecture design, solution deployment, workflow automation, or managed AI services; or

• Participate in pilot programs, workshops, or training sessions.

This Policy applies to individuals globally and incorporates region-specific disclosures for residents of Australia, the European Economic Area (EEA), the United Kingdom (UK), the United Arab Emirates (UAE), and the United States (US).

Depending on the context of data processing, Xclamation operates in two distinct legal capacities:

We collect personal information across three primary streams:

3.1 Information You Provide Directly

• Contact & Professional Identifiers: Full name, business email address, telephone number, job title, employer/company name, and geographic location.

• Commercial & Engagement Details: Inquiries, project requirements, architectural specifications, statements of work, billing and payment records, and communication histories.

• User Feedback & Survey Submissions: Responses to client satisfaction surveys, event registrations, and direct consultation requests.

3.2 Information Collected Automatically

• Technical & Device Identifiers: IP address, device type, operating system, unique device identifiers, browser type, and language settings.

• Usage & Telemetry Data: Pages visited, time spent per page, clickstream patterns, referring URLs, HTTP headers, and engagement with our site components.

3.3 Information From Third-Party Sources

Commercial Data Sources: Professional social networks (e.g., LinkedIn), industry directories, public registry filings, and mutual business partners or client referrals.

We process personal information under defined legal bases recognized by the GDPR, UK GDPR, UAE PDPL, and Australian Privacy Principles:

Given our core focus on enterprise Agentic AI systems, we adhere to strict architectural and contractual boundaries regarding client information:

• No Model Training on Client Data: We do not use confidential client data, customer inputs, or proprietary business workflows to train, fine-tune, or retrain public, third-party, or open-source foundation models unless expressly authorized in writing by the client.

• Tenant & Infrastructure Isolation: Where we deploy or configure AI agents within client cloud environments (e.g., GCP, AWS, or Azure), processing takes place within defined client boundaries and enterprise VPC configurations governed by enterprise-grade security controls.

• Client Responsibility: Clients retain sole responsibility for determining the suitability of third-party AI models, providing lawful notices to their end-users, ensuring valid legal bases for personal data submitted into automated workflows, and configuring workplace AI usage policies.

No Solely Automated Legal Effects: We do not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning website visitors or prospective clients.

Agentic Workflows: Where we architect AI agents for enterprise clients that perform decision logic or predictive scoring, such agents operate under human-in-the-loop (HITL) guardrails or client-governed policy engines as outlined in specific statements of work.

We do not sell personal information or share personal information for cross-context behavioral advertising. We disclose personal data solely as follows:

• Authorized Service Providers: Trusted cloud infrastructure vendors (e.g., hosting, compute, database), CRM providers, cybersecurity auditors, and communication platforms acting as our sub-processors under binding confidentiality and data protection agreements.

• Professional Advisers: Legal, financial, tax, and insurance advisers for governance, compliance, and corporate risk management.

• Corporate Transactions: Prospective acquirers or merger partners in connection with any reorganization, asset sale, or merger, under customary non-disclosure agreements.

• Legal Mandates: Law enforcement, regulatory bodies, or judicial authorities when required by court order, subpoena, or mandatory statutory law.

International Data Transfers

Xclamation operates out of Australia and utilizes cloud infrastructure and service providers located globally (including the US, EU, and UAE). Where personal data is transferred across borders:

• From the EEA / UK: We implement Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Addendum, or rely on recognized adequacy decisions.

• From the UAE: Transfers comply with UAE PDPL cross-border transfer controls, ensuring equivalent protection or approved standard agreements.

• From Australia: We take reasonable steps pursuant to APP 8 to ensure overseas recipients do not breach the Australian Privacy Principles.

Technical & Organisational Safeguards: We employ encryption at rest (AES-256) and in transit (TLS 1.3), role-based access control (RBAC), multi-factor authentication (MFA), continuous audit logging, and vulnerability management aligned with modern SOC2 security principles.

Retention Criteria: We retain personal information only for as long as necessary to fulfill the purposes outlined in this Policy, satisfy contractual commitments, resolve disputes, and comply with mandatory statutory limitation periods (typically 5–7 years for commercial and financial transactions). When no longer required, data is irreversibly anonymized or securely deleted.

Cookie Management: We use essential cookies to maintain site security and session state. We use analytics cookies only to monitor traffic patterns and optimize site architecture. You can adjust your browser settings to decline non-essential cookies.

Global Privacy Control (GPC) & DNT: We recognize Global Privacy Control (GPC) signals transmitted by supported browsers and treat them as a valid opt-out request for analytics tracking.

10.1 Australia (Privacy Act 1988 & APPs)

If you reside in Australia:

• Access & Correction: You have the right under APPs 12 and 13 to request access to the personal information we hold about you and to request corrections if it is inaccurate, out of date, or incomplete.

• Notifiable Data Breaches (NDB): In the event of an eligible data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with Part IIIC of the Privacy Act 1988 (Cth).

• Complaints: If you believe we have breached the APPs, contact us using the details in Section 13. If unresolved, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10.2 European Union & United Kingdom (GDPR / UK GDPR)

If you are located in the EEA or UK, you hold the following rights under Chapter III of the GDPR:

• Right of Access (Art. 15): Request confirmation of processing and a copy of your personal data.

• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data.

• Right to Erasure ("Right to be Forgotten", Art. 17): Request deletion of your personal data where retention is no longer justified.

• Right to Restriction of Processing (Art. 18): Restrict processing under statutory conditions.

• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.

• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.

• Withdrawal of Consent (Art. 7(3)): Withdraw consent at any time without affecting past lawful processing.

Supervisory Authority: You have the right to lodge a complaint with an EU Data Protection Authority in your member state or the UK Information Commissioner's Office (ICO) at ico.org.uk.

10.3 United Arab Emirates (UAE PDPL & Free Zones)

For individuals in the UAE:

Legal Standard: We process personal data in accordance with Federal Decree-Law No. 45 of 2021 regarding Personal Data Protection (UAE PDPL). Where services are delivered specifically within the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM), the DIFC Data Protection Law No. 5 of 2020 or ADGM Data Protection Regulations 2021 apply respectively.

Your Rights: Under the UAE PDPL, you have the right to:

• Obtain access to your data and information on processing categories;

• Request data transfer to another controller (data portability);

• Request correction, completion, or erasure of your personal data;

• Restrict processing where data is inaccurate or processing violates regulations; and

• Object to automated decision-making or processing intended for direct marketing.

Regulatory Authority: You may file a complaint with the UAE Data Office or the competent regulatory body in the relevant financial free zone.

10.4 United States (CCPA/CPRA & US State Privacy Laws)

For residents of California and states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah, Texas):

Notice of Collection: In the preceding 12 months, we have collected the categories of personal information listed in Section 3 (Identifiers, Commercial Information, Internet/Network Activity, Professional Information).

No Sale or Sharing: We do not sell personal information, nor do we share personal information for cross-context behavioral advertising (as defined under the CCPA/CPRA). We have not engaged in such sales or sharing in the preceding 12 months.

No Use of Sensitive Personal Information: We do not collect or process "Sensitive Personal Information" to infer characteristics about consumers.

Your Rights:

• Right to Know / Access: Request disclosure of categories and specific pieces of personal information collected, sources, and commercial purposes.

• Right to Delete: Request deletion of personal information subject to legal exceptions.

• Right to Correct: Request correction of inaccurate personal information.

• Right to Non-Discrimination: We will not deny goods, charge different prices, or provide a lower quality of service for exercising your privacy rights.

Shine the Light Law: California Civil Code § 1798.83 permits California residents to request information regarding disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal data to third parties for their own marketing.

To exercise any of the rights described above:

Email: Send an email to privacy@xclamation.ai with the subject line "Privacy Rights Request".

Online Form: Submit an inquiry via our contact page at xclamation.ai/contact.

Verification Procedure: To protect your personal information, we must verify your identity before fulfilling statutory requests. We may ask you to confirm your email address or provide proof of professional association. If you designate an authorized agent, we require written proof of authority and direct identity verification from you.

Response Timelines: We acknowledge requests within statutory windows:

• Australia & UAE: Within 30 days.

• EEA / UK: Within 30 days (extendable by 60 days for complex requests).

• US (California & other states): Within 45 days.

Our website and services are strictly intended for enterprise professionals and businesses. We do not knowingly collect personal data from individuals under 18 years of age. If we learn that personal data of a minor has been collected without parental consent, we will promptly delete it.

If you have questions, feedback, or complaints regarding this Policy or our data governance practices, please contact us:

Entity: Xclamation.ai Pty Ltd

Attention: Privacy Officer / Data Protection Lead

Email: privacy@xclamation.ai

Website: xclamation.ai

We may update this Policy periodically to reflect changes in our services, technological infrastructure, or international legal requirements. Any modifications will be posted on this page with an updated "Last Updated" date. Where changes are material, we will provide additional notice through our website or direct communication.