This Privacy Policy explains how VALO TECH PTE. LTD. ("VALO") handles personal data in connection with the Verdiq platform and websites. VALO acts in two distinct roles, and they are governed differently.
1. Two roles, two regimes
- Processor.For personal data that a customer's users upload into the platform as part of their compliance, risk, security, or privacy work ("Customer Data"), the customer is the controller and VALO is the processor. That processing is governed by our Data Processing Addendum, not this policy.
- Controller. For the limited personal data we handle to run our own business, this policy applies. That is the data described below.
2. Data we handle as controller
- Account data. Names, work email addresses, role, and authentication metadata of the people your organization invites to the platform.
- Sales and enquiry data. Details you submit when you request access, contact us, or evaluate the Service.
- Site data. Limited technical data when you visit our websites, described in our Cookie Policy.
- Support data. The content of support requests you send us.
3. Why we use it, and our lawful bases
We use this data to provide and secure the Service, to manage our relationship with your organization, to respond to enquiries and support, to meet legal and accounting obligations, and to improve our websites. Our lawful bases include performance of a contract, our legitimate interests in running and securing the business, compliance with legal obligations, and consent where required (for example, non-essential cookies).
4. Cookies and site measurement
We keep cookies to a minimum and never use advertising cookies. See the Cookie Policy for the categories we use and how to change your choice.
5. Sharing and subprocessors
We do not sell personal data. We share it only with service providers that help us run the platform, under contracts that bind them to protect it, and where required by law. The categories of providers are listed on our Subprocessors page.
6. International transfers
We are based in Singapore and host primarily in the region. Where personal data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses and equivalent mechanisms.
7. Retention
We keep personal data only as long as needed for the purposes above or as required by law (for example, accounting records), then delete or anonymize it. Customer Data retention is governed by the agreement and the Data Processing Addendum.
8. Your rights
Subject to applicable law (including Singapore's PDPA and the GDPR), you may request access to, correction of, or deletion of your personal data, and may object to or restrict certain processing. For personal data held within Customer Data, please contact the customer organization that controls it; we will assist them as their processor. To exercise rights in the data we control, contact us below.
9. Security
We apply administrative, technical, and physical safeguards appropriate to the risk, including encryption in transit and at rest, access controls, and audit logging. No system is perfectly secure, and we will notify affected parties of a personal-data breach as required by law.
10. Contact
Privacy enquiries: privacy@valotech.org. Data Protection Officer: dpo@valotech.org. VALO TECH PTE. LTD., Singapore.