1. Data Controller

Whitcher Worldwide LLC is the data controller responsible for your personal data processed through this website.

Contact: info@surexperience.co

2. Data We Collect

We collect the following types of data when you use our website (surexperience.co):

Cookie consent preferences (strictly necessary)
Theme preference (strictly necessary)
Usage data (pages visited, time on site) — only with your consent
Language preference — only with your consent

For full details on how we use cookies, see our Cookie Policy.

3. Legal Basis for Processing

We process your personal data only where we have a lawful basis to do so under the General Data Protection Regulation (GDPR). The legal basis for each type of processing is as follows:

Cookie consent preferences — Legitimate Interest (Article 6(1)(f)): necessary to record and honour your consent choice
Theme preference — Legitimate Interest (Article 6(1)(f)): necessary to provide consistent website functionality
Usage data (analytics) — Consent (Article 6(1)(a)): only collected when you have explicitly accepted analytics cookies
Language preference — Consent (Article 6(1)(a)): only persisted when you have accepted functional cookies

Where we rely on consent as our legal basis, you have the right to withdraw that consent at any time via the Cookie Preferences link in the footer.

4. Third-Party Services & International Data Transfers

We use the following third-party service providers that may process your personal data on our behalf:

Google LLC (Google Analytics) — We use Google Analytics (GA4) to understand how visitors interact with our website. This service is only activated with your explicit consent. Google processes analytics data on servers located in the United States. Google LLC participates in the EU–US Data Privacy Framework and uses Standard Contractual Clauses (SCCs) as a safeguard for international data transfers under GDPR Chapter V. Under the California Consumer Privacy Act (CCPA), sharing data with Google Analytics may constitute “sharing” of personal information for cross-context behavioral advertising purposes. Because we gate this service behind your explicit consent, this sharing only occurs where you have opted in. You can withdraw consent at any time via Cookie Preferences in the footer. You can review Google's privacy practices at policies.google.com/privacy.

We do not sell your personal data to third parties and do not share it with any party other than those listed above, except where required by law.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy:

Cookie consent record (sx-cookie-consent) — 1 year from the date of your consent choice
Theme preference (sx-website-theme) — Stored in your browser's local storage; persists until you clear your browser data or change your preference
Language preference (NEXT_LOCALE) — 1 year, only where functional consent has been granted
Analytics data (GA4) — 14 months, as configured in our Google Analytics account; data is automatically deleted thereafter

You may request earlier deletion of any personal data we hold about you by contacting us at info@surexperience.co.

6. Your Privacy Rights

Depending on where you are located, you may have specific legal rights regarding your personal data. This section describes your rights under applicable law. To exercise any of the rights described below, contact us at info@surexperience.co. We will respond within 30 days; complex requests may be extended by a further 60 days with notice.

6.1 GDPR Rights (EU / EEA Residents)

Under the General Data Protection Regulation (GDPR), you have the right to:

Access your personal data (Article 15)
Correct inaccurate or incomplete data (Article 16)
Request erasure of your data (“right to be forgotten”) (Article 17)
Object to or restrict processing (Articles 18–21)
Withdraw consent at any time, without affecting the lawfulness of prior processing (Article 7(3))
Data portability — receive your data in a structured, machine-readable format (Article 20)
Lodge a complaint with your local data protection supervisory authority

6.2 CCPA / CPRA Rights (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you, and the purposes for which it is used or shared
Right to Delete — request deletion of personal information we have collected from you, subject to certain exceptions
Right to Correct — request correction of inaccurate personal information
Right to Opt-Out of Sale or Sharing — we do not sell your personal information. We share analytics data with Google only with your explicit consent. You can opt out of this sharing at any time by clicking in the footer of any page, which reopens the consent panel and allows you to withdraw your selection
Right to Limit Use of Sensitive Personal Information — we do not collect sensitive personal information as defined by CPRA
Right to Non-Discrimination — we will not discriminate against you for exercising any of your privacy rights. We will not deny services, charge different prices, or provide a different quality of service based on your exercise of these rights

To submit a verifiable consumer request under CCPA/CPRA, contact us at info@surexperience.co. We will respond within 45 days, as required by California law.

6.3 Other US State Privacy Rights

Residents of Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other US states with applicable privacy laws have similar rights to those described above, including rights to access, correct, delete, and opt out of certain processing. To exercise any of these rights, contact us at info@surexperience.co and we will respond in accordance with the requirements of your state's applicable law.

7. Platform Data

If you are a customer of the SureXperience platform (surexperience.app), data generated through your use of the platform — including account and user information, application packages, test artifacts, session recordings, experience reports, and structured configuration data — is treated as confidential business data and is governed by our Terms of Service (Section 9: Confidentiality & Data Handling), not by this Privacy Policy. This Privacy Policy applies only to personal data collected through our public-facing website (surexperience.co).

8. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the “Last Updated” date at the top of this page. Where required or appropriate, we will provide additional notice by email to all registered users of SureXperience. We encourage you to review this page periodically to stay informed about how we protect your data.

9. Contact

For any privacy-related enquiries, please contact us at: info@surexperience.co