Privacy Policy

1. About this policy

Wise Data Pte. Ltd. (UEN 202317584K), a company incorporated in Singapore ("Wise Data", "we", "us"), respects your privacy. This policy explains how we collect, use, disclose and look after personal data when you visit wisedata.sg or contact us, in line with Singapore's Personal Data Protection Act 2012 (the "PDPA").

"Personal data" means data about an individual who can be identified from that data, or from that data and other information we have or are likely to have access to.

This policy covers our website and our dealings with enquirers, prospective customers, investors and business contacts. It does not cover the data our customers store or process in Wise Office, Ghostdrive Enterprise or Wee; see section 12.

By using our website or submitting your details to us, you acknowledge this policy. Where the PDPA requires your consent, we obtain it as described below.

2. Personal data we collect

We collect only what we need. Depending on how you deal with us, this may include:

Please do not send us sensitive personal data (for example health, financial account or identity-document details) through our forms. If you give us personal data about another person, you confirm that you have their consent to do so.

3. How we collect it

We collect personal data directly from you when you complete a form, email or call us, or meet us. We may also receive business contact details from your colleagues or employer, from introductions, or from publicly available professional sources, and we will use them only for the purposes in section 4.

4. Why we use personal data

We use personal data to:

• respond to your enquiry and give you the information, demo, pilot, proposal or investor briefing you asked for;
• evaluate whether and how we can work with you, prepare proposals and enter into and perform contracts;
• for investor enquiries, assess eligibility (for example, whether you are an institutional or accredited investor) and comply with applicable securities, anti-money-laundering and sanctions requirements;
• communicate with you about our products and services where you have asked us to or have consented;
• operate, secure and improve our website, and detect and prevent misuse or fraud;
• comply with law, respond to lawful requests from authorities and establish, exercise or defend legal claims; and
• keep business records.

We do not sell personal data.

5. Consent and other grounds

We collect, use and disclose personal data with your consent. When you submit a form, you consent to us using the data you give for the purposes described in section 4. Where the PDPA allows, we may also rely on deemed consent (for example, where you voluntarily give us your business contact details for a purpose a reasonable person would expect, such as asking us for a proposal) or on exceptions such as legitimate interests (for example, keeping our website secure and preventing fraud), business improvement, or a legal requirement. Where we rely on legitimate interests, we assess the impact on you first.

You may withdraw your consent at any time (see section 10). Withdrawal may mean we can no longer respond to your enquiry or provide certain services.

6. Who we share it with

We share personal data only as needed for the purposes above, with:

• Service providers who process data for us, including: Web3Forms (delivers website form submissions to us); Spaceship (Spacemail email service); GitHub, Inc. (website hosting through GitHub Pages); Exabytes (domain registration and DNS); and Google (web fonts loaded from Google Fonts). These providers may only use data to provide their services to us or under their own terms;
• Professional advisers such as lawyers, accountants and auditors, under duties of confidentiality;
• Our group, partners and suppliers where needed to deliver something you requested, for example Ghostdrive, whose technology underlies some of our offerings, and only with your agreement or where an engagement requires it;
• Authorities, regulators and courts where required or permitted by law; and
• A buyer or investor in connection with a merger, acquisition or financing, subject to confidentiality.

7. Transfers outside Singapore

Some of our service providers store or process data outside Singapore, including in the United States. Before transferring personal data overseas we take appropriate steps to ensure the recipient is bound by legally enforceable obligations (for example contractual terms or the provider's binding data protection terms) to give the data a standard of protection comparable to the PDPA, as the PDPA's transfer limitation obligation requires.

8. How long we keep personal data

We keep personal data only for as long as we need it for the purposes in section 4 or as the law requires. As a general rule: enquiries that do not lead to an engagement are deleted or anonymised within about 24 months of our last meaningful contact; contract, billing and compliance records are kept for the periods required by Singapore law (generally at least five years); and server logs are kept for a short period by our hosting provider. When we no longer need personal data, we delete it, anonymise it or securely destroy it.

9. How we protect it, and data breaches

We use reasonable administrative, technical and physical safeguards to protect personal data, including access controls, encrypted connections (HTTPS) on our website, and confidentiality obligations on our staff and providers. No system is completely secure, and we cannot guarantee the security of information sent over the internet.

If a data breach occurs that is likely to cause significant harm to individuals or affects 500 or more individuals, we will notify the Personal Data Protection Commission ("PDPC") no later than three calendar days after we assess that the breach is notifiable, and we will notify affected individuals where the PDPA requires.

10. Your rights: access, correction and withdrawal

Under the PDPA you may:

• ask for access to the personal data we hold about you and information on how we have used or disclosed it in the past year;
• ask us to correct personal data you believe is inaccurate or incomplete; and
• withdraw your consent to our collection, use or disclosure of your personal data.

To make a request, email our Data Protection Officer using the details in section 16. We may need to verify your identity first. We aim to respond to access requests within 30 days and will tell you if we need longer. We may charge a reasonable fee for access requests, and will tell you the amount beforehand. We may refuse a request where the PDPA allows, and will explain why. We will act on correction requests as soon as practicable, and on withdrawal of consent after a reasonable time, and we will tell you the consequences.

11. Marketing and the Do Not Call Registry

We send marketing messages only to people who have asked for them or have given consent, and we include a simple way to unsubscribe. We do not send marketing messages by telephone call, text or fax to Singapore telephone numbers listed on the Do Not Call (DNC) Registry unless the PDPA allows it, for example where you have given clear and unambiguous consent. Messages about an existing contract or your own enquiry are not marketing messages. You can opt out at any time by writing to us.

12. Customer data in our services

When a customer uses Wise Office, Ghostdrive Enterprise or Wee, the customer decides what data goes into the service and why. In that case Wise Data generally acts as a data intermediary processing data on the customer's behalf under a written agreement, and the customer is responsible for having the right to use that data. This policy does not govern that processing. If you are an individual whose data is held by one of our customers, please contact that customer first.

13. Children

Our website and services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

14. Links to other websites

Our website may link to other websites. We do not control them and are not responsible for their privacy practices. Please read their policies.

15. Changes to this policy

We may update this policy from time to time, for example when our practices or the law change. The latest version is always at wisedata.sg/privacy/, with its effective date at the top. If we make a material change, we will take reasonable steps to bring it to your attention.

16. Contact us and complaints

If you have a question, request or complaint about how we handle personal data, please contact our Data Protection Officer first so we can address it. If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore at pdpc.gov.sg.