Privacy & Data Protection Policy

This Policy applies to all Personal Data processed by HEOSSI in connection with our solutions, platforms, APIs, research initiatives, events, and outreach activities. It governs data collected through our websites, portals, APIs, communication channels, and any service relationship where we act as a data controller or data processor on behalf of our customers.

Where we process Personal Data on behalf of our customers, we do so under the instructions of the relevant data controller and the contractual terms agreed. In such cases, this Policy supplements - rather than replaces - those agreements.

• Directly from you when you submit contact forms, request materials, enter into contracts, participate in events, or interact with our platforms
• Automatically through secure telemetry, access logs, and platform instrumentation necessary to protect and maintain our infrastructure
• From third-party sources such as partners, information providers, public registries, or regulatory filings, where lawful and relevant to our service relationships

We process Personal Data only where a valid legal basis exists:

• Responding to enquiries and providing solution documentation, demos, and platform access
• Delivering, operating, and supporting our platforms and solutions
• Conducting security monitoring, incident response, fraud prevention, and risk assessments
• Managing contractual relationships, billing, and compliance obligations
• Improving our solutions, research, and development roadmap
• Communicating updates, insights, or invitations that align with your stated interests (you may opt out at any time)
• Complying with laws, regulations, court orders, or governmental requests

Depending on your jurisdiction, you may have the following rights:

We implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction:

• End-to-end encryption for data in transit and at rest
• Post-quantum cryptographic algorithms (CRYSTALS-Kyber, CRYSTALS-Dilithium)
• Multi-factor authentication and access controls
• Regular security audits and penetration testing
• Incident response and breach notification procedures
• Employee training on data protection and security

We hold very little personal data, and we would rather tell you exactly what and for how long than publish a schedule that sounds thorough but describes systems we do not operate.

If you want anything above erased sooner, email privacy@heossi.com and we will action it - except the suppression record, which exists solely to protect you and which we will not delete unless you ask us to re-contact you.

We send business-to-business communications only to business addresses, and only where the subject matter is relevant to the recipient's professional role. In Singapore this relies on the business-contact-information provisions of the PDPA; elsewhere it relies on the equivalent lawful basis for that jurisdiction.

• Every message identifies us, names our registered entity and UEN, carries our postal address, and includes a working one-click unsubscribe.
• An opt-out is honoured immediately and permanently, and applies across every HEOSSI solution - not just the one that contacted you.
• We do not send unsolicited commercial email into jurisdictions that require prior consent for it - including Germany and Austria (UWG §7) and Canada (CASL). This is enforced in our sending systems, not left to discretion.
• Marketing is never sent from the domain that carries our transactional mail (login codes, receipts), so a marketing complaint can never affect delivery of security-critical messages to you.

If you are a resident of California - or of another US state with comparable legislation, including Virginia, Colorado, Connecticut, Utah and Texas - you have the right to know what personal information we hold, to request its deletion or correction, to obtain a portable copy, to limit the use of sensitive personal information, and to not be discriminated against for exercising any of these rights.

To exercise any of them, email privacy@heossi.com. You may use an authorised agent. We will verify your identity before acting, and we will respond within the period the applicable statute requires.

Our business services and website are not directed to children under 18, and we do not knowingly solicit personal data from them. A parent or guardian who believes a child has provided personal data should contact privacy@heossi.com so we can assess and delete it where required. Research involving minors requires a separately approved protocol, appropriate consent or assent, safeguards, and all legally required ethics and regulatory approvals.

Public contact-form uploads are disabled. The production portal has no connected file-upload store and did not retain attachments through that endpoint. If a document is necessary, HEOSSI will arrange an appropriate transfer channel after verifying the enquiry. Never send confidential, classified, privileged, special-category, payment-card, credential, private-key, or other sensitive material through an unapproved channel.

For questions about this Privacy Policy or to exercise your data protection rights:

If you are not satisfied with our response, you may refer the matter to:

• Personal Data Protection Commission (Singapore)
• Information Commissioner's Office (UK)
• Relevant EU Data Protection Authority
• California Attorney General (for CCPA matters)