Privacy Notice

Privacy Notice

Privacy Notice

Last updated: 04.08.2026

This Privacy Notice explains how ProfitSoft B.V., trading under the name Expandi (“Expandi”), processes Personal Data where Expandi acts as Controller under applicable data protection laws.

This Privacy Notice applies to the processing of Personal Data relating to visitors of the Expandi website, prospective customers, Customers, users of the Services, suppliers, business contacts and other individuals with whom Expandi interacts in the course of its business.

Where Expandi processes Personal Data solely on behalf of a Customer in connection with the provision of the Services, Expandi acts as Processor. Such Processing is governed exclusively by the applicable Data Processing Agreement (“DPA”), which forms an integral part of the applicable Terms of Service (“Terms”).

This Privacy Notice describes, among other things:

  • what Personal Data Expandi collects;
  • for which purposes Expandi processes Personal Data;
  • the legal bases for such Processing;
  • with whom Personal Data may be shared;
  • how long Personal Data is retained;
  • the rights of Data Subjects; and
  • how Data Subjects can contact Expandi regarding privacy-related matters.

Unless otherwise defined in this Privacy Notice, capitalized terms shall have the meanings assigned to them in the Terms of Service. Terms originating from applicable data protection laws shall be interpreted in accordance with those laws.

  1. Processing Activities as Controller

1.1 Expandi processes Personal Data for different purposes depending on the nature of its relationship with the relevant Data Subject and the Services provided.

1.2 The categories of Personal Data processed, the purposes of the Processing, the applicable legal bases and the applicable retention periods may differ depending on the relevant Processing activity. The applicable retention periods, or the criteria used to determine them, for the principal Processing activities described in this Privacy Notice are maintained through Expandi’s Trust Center (or another publicly available location designated by Expandi). The information is kept up to date and forms an integral part of this Privacy Notice.

1.3 Where Expandi relies on its legitimate interests as the legal basis for Processing, such legitimate interests may include operating and improving the Services, ensuring the security of its systems, communicating with Customers and prospective customers, preventing fraud, protecting its legal rights and operating its business efficiently.

1.4 Personal Data may be obtained directly from the Data Subject or indirectly from Customers, business partners, publicly available professional sources, social media platforms, event organizers or other third parties, depending on the relevant Processing activity. Where Expandi obtains Personal Data indirectly, Expandi will provide the information required under Applicable Data Protection Laws within the applicable period and, where relevant, no later than at the time of the first communication with the Data Subject.

1.5 The following sections describe the principal Processing activities carried out by Expandi as Controller.

  1. Website Visitors and Prospective Customers

2.1 Expandi processes Personal Data relating to website visitors and prospective customers in connection with visits to the Expandi website, requests for information, demonstrations, webinars, downloadable resources and other pre-contractual interactions.

2.2 Depending on the nature of the interaction, Expandi may process the following categories of Personal Data:

  • name;
  • company name;
  • job title;
  • business email address;
  • telephone number;
  • LinkedIn profile URL;
  • country or region;
  • IP address and device information;
  • browser and technical usage information;
  • marketing preferences;
  • any other Personal Data voluntarily provided by the Data Subject.

Expandi does not intentionally collect Special Categories of Personal Data or Personal Data relating to criminal convictions for the purposes described in this Privacy Notice. Data Subjects are requested not to provide such information. If such Personal Data is nevertheless received, Expandi will delete it where appropriate unless retention is required by law.

2.3 Expandi processes such Personal Data for the following purposes:

  • providing requested information, demonstrations and webinars;
  • responding to enquiries;
  • evaluating potential business relationships;
  • communicating with prospective customers;
  • improving the website and user experience;
  • maintaining the security and integrity of the website;
  • conducting sales and marketing activities where permitted by applicable law.

2.4 The applicable legal basis depends on the nature of the Processing and may include:

  • taking steps prior to entering into a contract;
  • Expandi’s legitimate interests;
  • the Data Subject’s consent, where required by applicable law.

2.5 Where Expandi uses cookies or similar technologies on its website, additional information regarding the use of such technologies, including the categories of cookies used, their purposes and, where applicable, the management of cookie preferences, is set out in Expandi’s Cookie Notice.

2.6 Personal Data relating to prospective customers is retained only for as long as reasonably necessary for the relevant purpose, taking into account the nature of the interaction, applicable legal obligations and Expandi’s legitimate business interests. Where Processing is based on consent, such consent may be withdrawn at any time by contacting Expandi. Withdrawal of consent does not affect the lawfulness of any Processing carried out before such withdrawal.

2.7 Where Expandi sends marketing communications, each communication includes a clear and easy means for the recipient to unsubscribe or object to further marketing communications.

  1. Customers and Users of the Services

3.1 Expandi processes Personal Data relating to Customers and users of the Services in connection with the creation, administration and management of user accounts, the provision of customer support, subscription management, billing and other activities necessary to perform its contractual relationship with the Customer.

3.2 Depending on the Services provided and the nature of the contractual relationship, Expandi may process the following categories of Personal Data:

  • first and last name;
  • business email address;
  • company information;
  • billing information;
  • account credentials;
  • language preferences;
  • subscription information;
  • support communications;
  • technical account information;
  • other account-related information voluntarily provided by the Customer.

3.3 Expandi processes such Personal Data for the following purposes:

  • creating and maintaining user accounts;
  • providing access to the Services;
  • administering subscriptions and billing;
  • communicating service-related information;
  • providing customer support;
  • maintaining the security and integrity of the Services;
  • complying with legal and regulatory obligations;
  • improving the quality, performance and security of the Services.

Payment card details are processed exclusively by authorized payment providers and are not stored by Expandi.

3.4 The applicable legal basis depends on the nature of the Processing and may include:

  • performance of a contract;
  • compliance with a legal obligation;
  • Expandi’s legitimate interests.

3.5 Personal Data relating to Customers and users of the Services is retained for as long as necessary to perform the applicable agreement, comply with legal obligations and resolve disputes. Following termination of the contractual relationship, Personal Data will be retained only for as long as required by applicable law or as reasonably necessary to protect Expandi’s legitimate interests.

  1. Customer Data Processed through the Services

4.1 When Customers use the Services, Expandi processes Personal Data on behalf of the Customer in order to provide the Services.

4.2 In relation to such Processing, the Customer acts as Controller and remains responsible for determining the purposes and means of the Processing, as well as for ensuring that the relevant Processing complies with applicable data protection laws. Expandi acts solely as Processor and processes such Personal Data exclusively on the Customer’s documented instructions and in accordance with the applicable Data Processing Agreement (“DPA”), unless otherwise required by applicable law.

4.3 This Privacy Notice therefore does not further describe the Processing of Customer Data carried out by Expandi as Processor. The respective rights and obligations of the Customer and Expandi in relation to such Processing are governed exclusively by the applicable DPA.

  1. Sharing of Personal Data

5.1 Expandi may share Personal Data with third parties where this is necessary for the purposes described in this Privacy Notice, for the performance of its contractual obligations, to comply with applicable legal obligations or to protect its legitimate interests.

5.2 Depending on the nature of the relevant Processing activity, Personal Data may be shared with categories of recipients including:

  • providers of cloud hosting and infrastructure services;
  • providers of payment processing services;
  • providers of customer support and communication services;
  • providers of website analytics and marketing services;
  • professional advisers, auditors and legal advisers;
  • competent governmental, regulatory or judicial authorities where disclosure is required by applicable law; and
  • other service providers specifically engaged for hosting, communications, customer support, analytics, marketing, payment processing, security or professional services, as applicable to the relevant Processing activity.

5.3 Expandi will only share Personal Data to the extent reasonably necessary for the relevant purpose and will implement appropriate contractual, technical and organizational safeguards where required by applicable data protection laws.

5.4 Certain recipients of Personal Data, including payment service providers, professional advisers (such as lawyers and auditors) and public authorities, may process Personal Data as independent Controllers where required by applicable law.

  1. International Transfers

6.1 Where Expandi transfers Personal Data to recipients located outside the European Economic Area (“EEA”), Expandi will ensure that such transfers are carried out in accordance with applicable data protection laws.

6.2 Depending on the circumstances, Expandi may rely on one or more of the following transfer mechanisms:

  • an adequacy decision adopted by the European Commission;
  • the EU Standard Contractual Clauses (“SCCs”);
  • the EU-U.S. Data Privacy Framework, where applicable; or
  • any other lawful transfer mechanism recognized under applicable data protection laws.

6.3 Where required, Expandi implements supplementary contractual, technical and organizational safeguards to protect Personal Data transferred outside the EEA.

  1. Data Retention

7.1 Expandi retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, resolve disputes and protect or enforce its legal rights.

7.2 The applicable retention period depends on the nature of the relevant Processing activity, the categories of Personal Data involved and the legal or contractual obligations applicable to the relevant Processing. For the applicable retention periods relating to the principal Processing activities described in this Privacy Notice, please refer to Expandi’s Trust Center.

7.3 Upon expiry of the applicable retention period, Expandi will securely delete, anonymize or otherwise irreversibly de-identify Personal Data, unless continued retention is required or permitted by applicable law.

  1. Security

8.1 Expandi implements appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

8.2 Such measures are designed taking into account the nature, scope, context and purposes of the relevant Processing, as well as the risks to the rights and freedoms of natural persons.

8.3 Expandi periodically reviews and updates its security measures to ensure they remain appropriate in light of technological developments, evolving security risks and applicable legal requirements.

  1. Data Subject Rights

9.1 Subject to applicable data protection laws, Data Subjects may exercise the following rights in relation to their Personal Data processed by Expandi as Controller:

  • the right of access;
  • the right to rectification;
  • the right to erasure;
  • the right to restriction of Processing;
  • the right to data portability;
  • the right to object to Processing;
  • the right to object at any time to the Processing of Personal Data for direct marketing purposes; and
  • where Processing is based on consent, the right to withdraw such consent at any time, without affecting the lawfulness of Processing based on consent before its withdrawal.

9.2 Data Subjects may also lodge a complaint with the competent supervisory authority if they believe that Expandi’s Processing of Personal Data does not comply with applicable data protection laws.

9.3 Requests relating to the exercise of Data Subject rights may be submitted using the contact details set out in this Privacy Notice. Expandi may request additional information where reasonably necessary to verify the identity of the requesting individual before responding to such request. Subject to Article 9.4 of this Privacy Notice, Expandi will respond to requests without undue delay and, in any event, within one month after receipt.

9.4 Where Expandi receives a request relating to Personal Data processed solely on behalf of a Customer, Expandi will, where appropriate, forward the request to the relevant Customer or otherwise handle the request in accordance with the applicable Data Processing Agreement.

  1. Provision of Personal Data

10.1 In certain circumstances, Expandi requires Personal Data in order to enter into or perform a contract, provide requested Services or comply with applicable legal obligations.

10.2 For each relevant Processing activity, Expandi will indicate whether the provision of Personal Data is required by law, required under a contract, necessary to enter into a contract, or voluntary. Where the provision is required or necessary, Expandi will explain the consequences of not providing the Personal Data. Failure to provide required Personal Data may result in Expandi being unable to provide the requested Services, enter into the relevant contractual relationship or otherwise fulfil the relevant request.

  1. Automated Decision-Making

Expandi does not make decisions based solely on automated Processing, including profiling, that produce legal effects concerning Data Subjects or similarly significantly affect them. Expandi may use limited automated Processing for operational, security and marketing purposes, provided such Processing does not produce legal or similarly significant effects.

  1. Changes to this Privacy Notice

12.1 Expandi may update this Privacy Notice from time to time to reflect changes in applicable law, regulatory requirements, the Services or the way Personal Data are processed.

12.2 Where required by applicable law, Expandi will provide appropriate notice of material changes before they take effect.

12.3 The applicable version of this Privacy Notice is identified by the “Last updated” date shown at the top of this Privacy Notice.

  1. Contact Details

If you have any questions regarding this Privacy Notice or Expandi’s Processing of Personal Data, please contact:

ProfitSoft B.V.
Frederiklaan 10e
5616 NH Eindhoven
The Netherlands
[email protected]