Privacy notice

This notice applies to the Expandus website, assessments, Blueprints and customer workspace. Where Expandus decides why and how personal data is processed — for example, account data and assessment inputs — it acts as a controller. Where it processes data on documented instructions from a customer organisation, or passes information to a provider you have asked us to engage, it acts as a processor or as a separate controller alongside that provider. The role that applies depends on the activity described in each section below.

• Account and identity data (name, work email, company, sign-in metadata) — to create and secure your account and workspace.
• Assessment and Blueprint inputs (origin market, target markets, activity, structure, timeline, budget signals) — to generate indicative readiness scores, corridor analysis and roadmaps.
• Launch and coordination data (launch requests, projects, tasks, provider assignments) — to coordinate execution you have requested.
• Documents you upload — to fulfil document requests raised for your expansion workflow.
• Contact and support messages — to answer enquiries and provide support.
• Technical and security data (device, browser and log information generated when you use the service) — to keep the service available, debug faults and prevent abuse.

Where EU/UK data protection law applies, we rely on: performance of a contract (running your account, assessments and coordination work); legitimate interests (service security, fault diagnosis, product improvement, and responding to business enquiries); consent (optional analytics or marketing storage, which is off unless you turn it on); and legal obligation (where we must keep or disclose records). Other jurisdictions apply their own equivalents; where a jurisdiction requires a different basis, we apply that local requirement.

We use third-party infrastructure and service vendors to host the platform, store documents, authenticate users, and deliver assistive features. Where you ask us to coordinate execution, information necessary to that engagement is shared with the qualified providers involved. We share only what is needed for the purpose, and we do not sell personal data.

The integrated services, what each is used for, and which of them run only when a feature is enabled, are listed on the Subprocessors and service providers page. Listing a service there does not by itself mean a data processing agreement or transfer safeguard has been completed for it. If you need the position and the provider list relevant to your account, request it through the contact route below.

We keep personal data for as long as your account or engagement is active, and afterwards only for as long as needed for the purpose it was collected, to resolve disputes, or to meet a legal or record-keeping requirement that applies to us. This notice does not publish fixed deletion timetables; where you need the retention period that applies to a specific record, ask us and we will confirm what applies.

Access to customer data is restricted by authenticated accounts, role-based internal permissions and database-level access rules, and documents are exchanged through authorised, expiring links. No method of transmission or storage is completely secure, and this notice does not claim any certification, audit outcome or security guarantee.

Expandus is used across multiple countries, so personal data may be processed outside the country where you are located — including where a provider, vendor or member of our team operates. Where a transfer is subject to local transfer rules, we take the steps that those rules require before the transfer takes place. We do not claim any specific adequacy decision or transfer mechanism in this notice. You can see which services are integrated on the Subprocessors and service providers page; contact us if you need the transfer details that apply to your engagement.

Assessment scores, corridor rankings, cost bands and recommended next steps are produced by deterministic scoring rules applied to the answers you provide, and some explanatory text may be AI-assisted. These outputs are indicative and are reviewed or confirmed by people before any regulated action is taken. They do not by themselves produce legal or similarly significant effects, and you can ask for a human explanation or review of any recommendation shown to you.

Expandus is a business service and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us so we can review and remove it.

Strictly necessary storage is always active. Analytics and marketing storage stay off until you give affirmative consent, and you can change your choice at any time using the Privacy preferences control in the footer. See the Cookies notice.