1. Who We Are
Express Solutions Lab Private Limited ("Express Solutions Lab", "we", "us", "our") is a private limited company incorporated in India under the Companies Act, 2013, providing SAP Business One consulting, support, custom development and AI-assisted finance automation services.
For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described in this policy. Where the EU or UK General Data Protection Regulation applies, we act as the Controller.
- •Registered office: Office No. 2, UG Floor, Industry House, 15, A. B. Road, Indore, Madhya Pradesh 452001, India
- •CIN: U62010MP2024PTC072240
- •GSTIN: 23AAICE3101D1ZG
- •Email: info@expresssolutionslab.com
- •Telephone: +91 97525 47340
This policy covers expresssolutionslab.com and the business communications we send by email, WhatsApp, LinkedIn and telephone. It does not cover bizapps360.com, which is operated by a separate entity under its own privacy policy.
2. Personal Data We Collect
We collect only what we need, and we collect it in three ways.
a) Information you give us directly. When you submit the contact form or request a free AI Readiness Audit, we collect:
- •Your name
- •Your work email address
- •Your company name
- •Your telephone number, if you choose to provide one
- •The service you are interested in
- •The content of your message
b) Information we collect automatically. This website runs no analytics, advertising or profiling cookies, and sets no tracking cookie of any kind. What we do process automatically is limited to keeping the site working and free of abuse:
- •Your IP address, held briefly in server memory to rate-limit form submissions and block automated abuse. It is not written to a database and is discarded within minutes.
- •Standard server logs generated by our hosting provider, including IP address, request time, browser type and referring page.
- •If bot protection is enabled, a challenge token issued by Cloudflare Turnstile. Turnstile is a privacy-preserving alternative to CAPTCHA and does not track you across websites.
c) Business contact information we obtain from other sources. For business-to-business marketing we may hold the name, job title, business email address, business telephone number, employer and publicly stated professional information of individuals in their professional capacity. We obtain this from:
- •Publicly available sources, including company websites and public professional profiles
- •Licensed business-to-business data providers
- •Business cards, events, webinars and trade exhibitions
- •Referrals and introductions from our clients and partners
- •Our own prior dealings with you or your organisation
We do not seek or knowingly collect special category or sensitive personal data, financial account numbers, or government identifiers through this website.
3. How We Use Your Personal Data
We use personal data to:
- •Respond to your enquiry and provide the information, quotation or audit you asked for
- •Deliver, support and improve the services we are engaged to provide
- •Send you service, technical and administrative messages relating to work in progress
- •Carry out business-to-business marketing by email, WhatsApp, LinkedIn and telephone, as described in section 4
- •Maintain our client relationship and sales records
- •Detect, investigate and prevent spam, fraud and abuse of our forms and systems
- •Meet our legal, tax, accounting and regulatory obligations
We do not sell, rent or trade personal data. We do not use personal data to make decisions about you by automated means that produce legal or similarly significant effects.
4. Marketing Communications — Email, WhatsApp, LinkedIn and Telephone
We carry out direct marketing to businesses. This section explains exactly how, and how to stop it. We treat a request to stop as absolute, however it reaches us.
Email. We send sales and marketing email to business addresses, including messages addressed to people who have not previously dealt with us.
- •Every marketing email carries a working unsubscribe link and a one-click List-Unsubscribe header, so your mail client's own unsubscribe button works.
- •Every marketing email carries our postal address.
- •We record whether a marketing email was opened and whether its links were clicked. This measures whether our messages are useful and is not used to build a profile of you.
- •Unsubscribing adds your address to a permanent suppression list. Suppression is keyed to the email address itself, so it holds even if you change employer or we obtain your address again from a different source. It is never silently reversed.
- •Replies to our emails, and messages relating to work we are actually doing for you, are conversations rather than campaigns, and are not stopped by an unsubscribe.
WhatsApp. Where you have given us a mobile number, or where a number is published by your business for business contact, we may message you on WhatsApp through the WhatsApp Business Platform using message templates approved in advance by Meta.
- •Reply STOP, UNSUBSCRIBE, OPT OUT, CANCEL or QUIT to any WhatsApp message from us and we will record an opt-out and stop immediately.
- •Your use of WhatsApp is also governed by WhatsApp's own terms and privacy policy, and Meta processes the message in delivering it. We do not control that processing.
- •We send WhatsApp business messages during reasonable business hours.
LinkedIn. We may send connection requests and messages through LinkedIn. These are delivered by LinkedIn under its own terms and privacy policy. Ignoring, declining or asking us to stop ends the contact.
Telephone. We may call business numbers to discuss our services. If we record or transcribe a call for note-taking or training, we will tell you at the start of that call and you may ask us not to. Tell us not to call and we will record it against your contact record.
Your choice, in one place. Whatever the channel, you can stop all marketing from us by emailing privacy@expresssolutionslab.com or info@expresssolutionslab.com. We will action it across email, WhatsApp, LinkedIn and telephone, not only the channel you replied on. You do not have to give a reason.
5. Our Lawful Basis for Processing
Under the DPDP Act, 2023 (India). We process personal data on the basis of your consent, given when you submit a form or otherwise agree to be contacted, and on the basis of the "certain legitimate uses" permitted by section 7 — including processing for a purpose for which you voluntarily provided your data and did not indicate an objection. You may withdraw consent at any time, as easily as you gave it, using the contacts in section 10. Withdrawal does not affect processing already carried out.
Under the UK/EU GDPR, where it applies to you:
- •Legitimate interests (Article 6(1)(f)) for business-to-business marketing to corporate contacts, for keeping our client and prospect records, and for securing our systems. Our interest is in promoting our services to businesses likely to need them. We have weighed this against your interests, we market only in a professional capacity, and you can object at any time with immediate effect.
- •Consent (Article 6(1)(a)) where electronic marketing law requires it, and for any optional processing you agree to.
- •Performance of a contract (Article 6(1)(b)) to deliver services you or your organisation have engaged us for.
- •Legal obligation (Article 6(1)(c)) for tax, accounting and statutory records.
You have an unconditional right to object to direct marketing. If you object, we stop.
6. Who We Share Personal Data With
We do not sell personal data. We share it only with service providers who process it on our instructions under contract, and where the law requires.
- •Hosting and content delivery — the providers who serve this website and our applications.
- •Google (Google Workspace / Google Sheets) — enquiry records and business productivity.
- •Microsoft 365 — email delivery and mailbox services.
- •Cloudflare — bot protection on our forms, where enabled.
- •Meta Platforms (WhatsApp Business Platform) — delivery of WhatsApp business messages.
- •LinkedIn — delivery of LinkedIn messages and connection requests.
- •Business-to-business data providers — sourcing and verification of business contact details.
- •Telephony and call-transcription providers — where calls are made, recorded or transcribed.
- •Our own customer relationship management system, operated by us for our sales and client records.
- •Professional advisers — accountants, auditors and lawyers, under a duty of confidentiality.
- •Authorities, courts and regulators, where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims.
If our business is reorganised, merged or acquired, personal data may transfer as part of that transaction. You will be told if this materially changes how your data is handled.
7. International Transfers
We are based in India and our records are principally held in India. Several of the service providers listed in section 6 operate globally, so personal data may be processed outside your country, including in the United States and the European Union.
Where we transfer personal data out of the UK or EEA, we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with appropriate technical and organisational safeguards.
Transfers from India are made in accordance with the DPDP Act and any restrictions notified by the Central Government.
8. How Long We Keep Personal Data
We keep personal data only as long as it serves the purpose it was collected for, or as long as the law requires.
- •Enquiry and audit submissions — up to 24 months from your last contact with us, unless the enquiry becomes a client relationship.
- •Client records — for the duration of the engagement and for 8 years afterwards, to meet Indian tax, company-law and statutory record-keeping requirements.
- •Marketing contact records — while the contact remains commercially relevant, reviewed periodically; removed on request.
- •Suppression and opt-out records — kept indefinitely. This is deliberate: we have to retain the fact that you asked not to be contacted in order to honour it, and this record is never used to contact you.
- •Rate-limiting IP data — discarded within minutes; never written to a database.
- •Server logs — as retained by our hosting provider in the ordinary course, typically a short rolling period.
When data is no longer needed, we delete it or irreversibly anonymise it.
9. Your Rights
If you are in India, the DPDP Act, 2023 gives you the right to:
- •Obtain a summary of the personal data we process about you and the processing activities we undertake
- •Have inaccurate or incomplete personal data corrected, completed or updated
- •Have your personal data erased where it is no longer needed for the purpose it was collected for
- •Withdraw consent at any time, as easily as you gave it
- •Nominate another individual to exercise your rights in the event of your death or incapacity
- •Have a grievance addressed by us before approaching the Data Protection Board of India
If you are in the UK or EEA, you additionally have the right to restrict processing, to data portability, to object to processing based on legitimate interests, and to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office.
Making a request. Email privacy@expresssolutionslab.com. We will respond within 30 days. We may need to verify your identity before acting, and we will tell you if a request is one we cannot fully action and why.
You will never be charged for exercising a right, and exercising one will never affect the service we provide you.
10. Grievance Officer
As required by section 13 of the DPDP Act, 2023 and the Information Technology (Reasonable Security Practices) Rules, we have appointed a Grievance Officer. Any complaint about how we handle your personal data should go to:
- •Anirudh Vaish, Managing Director and Grievance Officer
- •Email: grievance@expresssolutionslab.com
- •Post: Express Solutions Lab Private Limited, Office No. 2, UG Floor, Industry House, 15, A. B. Road, Indore, Madhya Pradesh 452001, India
We acknowledge every grievance and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India, or to your own supervisory authority if you are in the UK or EEA.
11. Security
We apply reasonable technical and organisational measures proportionate to the data we hold:
- •Encryption in transit using TLS across our website and applications
- •Access limited to personnel who need it for their work
- •Credentials and access tokens held in secrets management, never in source code
- •Bot protection, submission rate limiting and abuse filtering on all public forms
- •Security headers and dependency maintenance on our web properties
No method of transmission or storage is completely secure, and we do not claim otherwise. If a personal data breach occurs that is likely to cause harm, we will notify the Data Protection Board of India and affected individuals as the DPDP Act requires, and any other regulator we are obliged to inform.
12. Children
Our website and services are directed at businesses and the professionals who work in them. They are not intended for children, and we do not knowingly collect the personal data of anyone under 18. If you believe a child has provided us with personal data, contact privacy@expresssolutionslab.com and we will delete it.
13. Third-Party Websites
Our website and our communications may link to sites we do not operate, including bizapps360.com, LinkedIn and the sites of clients, partners and publications. We are not responsible for their content or their privacy practices. Read their policies before giving them your data.
14. Changes to This Policy
We may update this policy to reflect changes in our processing, our service providers or the law. The current version is always published at https://expresssolutionslab.com/privacy with the date it was last updated at the top.
Where a change materially affects how we use your personal data, we will take reasonable steps to tell you before it takes effect — by email where we hold your address, and by a notice on this website.
15. How to Contact Us
Questions about this policy, or about how we handle your personal data:
- •Privacy and data protection: privacy@expresssolutionslab.com
- •Grievances: grievance@expresssolutionslab.com
- •General: info@expresssolutionslab.com
- •Telephone: +91 97525 47340
- •Post: Express Solutions Lab Private Limited, Office No. 2, UG Floor, Industry House, 15, A. B. Road, Indore, Madhya Pradesh 452001, India