Your data deserves clear rules.

About this policy

This policy explains how Cosmos Digital Hub collects, uses, discloses, stores and protects personal data in line with Singapore's Personal Data Protection Act 2012 (PDPA). It applies to enquiries, client and supplier relationships, and use of this website.

In this policy, "we", "us" and "our" mean Cosmos Digital Hub. Personal data means data about an identifiable individual, whether that data is true or not.

Personal data we may collect

Depending on how you interact with us, we may collect:

• Identity and contact information such as your name, role, company, email address, telephone number and business address.
• Enquiry and project information including requirements, correspondence, meeting notes, proposals, contracts and support requests.
• Billing and transaction records needed to provide services and meet accounting obligations.
• Technical and security information generated during service delivery, such as authorised account identifiers, audit records, device information and access logs.
• Website information provided by your browser or our hosting infrastructure, such as IP address, browser type, referring page, requested page and timestamp.
• Other information you choose to provide.

Please do not provide personal data we have not requested, especially confidential credentials or sensitive records, unless necessary and we have agreed on a secure method.

How we collect personal data

We may collect personal data directly from you when you email, call, meet or contract with us. We may also receive it from your employer, an authorised representative, a referral partner, a service provider or publicly available business sources where permitted by law.

Why we use personal data

We collect, use or disclose personal data only for reasonable and notified purposes, including to:

• Respond to enquiries and prepare proposals.
• Assess requirements, eligibility and project suitability.
• Deliver, secure, support and improve contracted services.
• Manage accounts, billing, payments and business records.
• Communicate service updates and information you requested.
• Prevent fraud, investigate misuse and protect our systems, clients and legal rights.
• Meet legal, regulatory, tax, accounting and reporting obligations.

Where consent is required, you may withdraw it with reasonable notice by contacting us. We will explain any practical consequences and stop the relevant processing unless continued processing is permitted or required by law.

Disclosure and service providers

We do not sell personal data. We may disclose only what is reasonably necessary to employees and authorised contractors, hosting and cloud providers, communications providers, payment and accounting providers, security providers, professional advisers, regulators, law enforcement, courts, or another party involved in a business transfer.

Service providers are expected to use personal data only for the agreed purpose and apply appropriate safeguards. When we act as a data intermediary for a client, we process personal data according to the client's documented instructions and our contract.

Overseas transfers

Some service providers or project systems may process data outside Singapore. Where the PDPA applies, we take steps to ensure transferred personal data receives a standard of protection comparable to that required under the PDPA, unless an exception applies.

Retention

We keep personal data only while it is needed for the purpose collected, a legitimate business need, dispute management, or a legal and regulatory requirement. We then delete, anonymise or securely dispose of it. Retention periods vary by record type and contract.

Security

We use reasonable administrative, technical and physical safeguards appropriate to the nature of the data. These may include least-privilege access, authentication controls, encryption where appropriate, backups, logging, secure configuration, contractor controls and incident response procedures.

No system or transmission is completely secure. If a data breach occurs, we will assess it and notify the Personal Data Protection Commission and affected individuals when required by law.

Accuracy, access and correction

Please tell us if your personal data changes. You may ask to access personal data in our possession or control, learn how it was used or disclosed during the applicable period, or correct an error or omission. Legal exceptions may apply, and we may need to verify your identity before responding. A reasonable fee may apply where permitted, and we will tell you the amount in advance.

Cookies and website analytics

This build does not use advertising trackers or non-essential cookies. Our hosting infrastructure may create technical logs for security and operation. If analytics, embedded media or advertising services are added later, this policy and any required consent controls must be updated before those services are enabled.

Third-party links

Our website may link to third-party websites. Their privacy practices are controlled by their operators, and you should review their policies before providing personal data.

Children's personal data

Our services are intended for businesses and are not directed to children. If you believe a child has provided personal data to us without appropriate consent, contact us so we can assess and address it.

Contact and complaints

Questions, requests or complaints about personal data may be directed to our Data Protection contact:

We will review the matter and respond within a reasonable time. You may also contact Singapore's Personal Data Protection Commission if you are not satisfied with our response.

Changes to this policy

We may update this policy when our practices, services or legal obligations change. The date above shows the latest revision. Material changes will be communicated where appropriate.