Privacy Policy

1. Introduction

BUILD YOUR SALES GROUP PTE. LTD. (UEN: 202601183R) ("Company", "we", "us", or "our"), a company incorporated in the Republic of Singapore, is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Build Your Data platform and services (collectively, the "Service").

This policy complies with the Singapore Personal Data Protection Act 2012 ("PDPA"), the European Union General Data Protection Regulation ("GDPR"), and other applicable data protection laws.

2. Data Controller Information

For the purposes of applicable data protection laws, the data controller is:

3. Information We Collect

3.1 Information You Provide:

• Account Information: Email address, name, company name, job title, and password
• Payment Information: Billing address and payment details (processed by secure third-party payment processors; we do not store full card numbers)
• Communication Data: Information you provide when contacting support or providing feedback
• User Content: Data you upload for enrichment (CSV files, contact lists)

3.2 Information Collected Automatically:

• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, pages viewed, referring URLs
• Usage Data: Features used, queries made, enrichment operations performed
• Cookies: Session cookies, authentication tokens, analytics cookies

4. Legal Basis for Processing (GDPR)

We process personal data under the following legal bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide our services
• Legitimate Interests (Art. 6(1)(f)): Fraud prevention, security, service improvement, and marketing to existing customers
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws and regulations
• Consent (Art. 6(1)(a)): Marketing communications to non-customers (withdrawable at any time)

5. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service
• Process transactions and manage your account
• Send transactional communications (receipts, updates, security alerts)
• Respond to inquiries and provide customer support
• Analyze usage patterns to improve the Service
• Detect, prevent, and address fraud and security issues
• Comply with legal obligations
• Send marketing communications (with consent where required)

6. B2B Data Enrichment Processing

When you use our enrichment services:

• We process business contact data only (B2B data, not consumer data)
• Data is processed in real-time and not stored in permanent databases
• We act as a data processor on your behalf; you remain the data controller
• We connect to third-party data providers under strict data processing agreements
• We do not create, maintain, or sell databases of personal information

Important: You are responsible for ensuring your use of enriched data complies with applicable laws, including obtaining necessary consents for outreach activities.

7. Information Sharing and Disclosure

We may share your information with:

• Service Providers: Cloud hosting (Supabase, Vercel), payment processing (Stripe), analytics providers
• Data Providers: Third-party B2B data sources for enrichment (under DPAs)
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with merger, acquisition, or sale of assets
• With Your Consent: For any other purpose with your explicit consent

We do NOT sell your personal information to third parties.

8. International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including Singapore and the European Union. We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all sub-processors
• Use of service providers in jurisdictions with adequate data protection (EU servers via Supabase)

9. Data Security

We implement industry-standard security measures:

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Access Controls: Role-based access, multi-factor authentication
• Infrastructure: SOC2-compliant hosting providers
• Monitoring: Continuous security monitoring and logging
• Incident Response: Documented breach notification procedures (within 72 hours for GDPR)

While we strive to protect your data, no transmission method is 100% secure. You use the Service at your own risk.

10. Data Retention

We retain data according to the following schedule:

• Account Data: Duration of account plus 30 days after deletion request
• Enrichment Data: Processed in real-time, not stored permanently
• Transaction Records: 7 years (legal/tax requirements)
• Log Data: 90 days for security and debugging
• Marketing Data: Until consent is withdrawn

11. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Restriction: Request limitation of processing
• Withdraw Consent: Withdraw consent at any time (where processing is based on consent)

To exercise these rights, contact us at privacy@buildyourdata.com. We will respond within 30 days (or as required by applicable law).

12. Cookies and Tracking

We use the following types of cookies:

• Essential Cookies: Required for Service functionality (authentication, security)
• Analytics Cookies: Help us understand usage patterns (privacy-focused analytics)
• Preference Cookies: Remember your settings and preferences

You can control cookies through your browser settings. Disabling essential cookies may affect Service functionality.

13. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected data from a child, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or prominent notice on the Service at least 30 days before taking effect. The "Last updated" date indicates the most recent revision.

15. Contact Us

For privacy-related inquiries or to exercise your rights:

EU Representative: For EU data subjects, you may also contact our EU representative or lodge a complaint with your local supervisory authority.