1. Who we are
Substrait Pte. Ltd. (“Substrait”, “we”, “us”) is a company registered in Singapore. We help organisations deploy and govern the software tools that their people build with AI, in the organisation’s own cloud.
This notice explains how we collect, use, disclose and protect personal data under Singapore’s Personal Data Protection Act 2012 (the “PDPA”).
2. What this notice covers
This notice covers personal data that we collect for our own purposes. That includes when you visit our website, contact us, meet us, work with us as a customer or supplier, or hold an account on our platform.
This notice does not cover data that our customers’ tools process in our customers’ own systems. When we handle that data, we act for the customer as its data intermediary, under our contract with the customer. The customer’s own privacy notice applies to that data. If you send us a request about it, we will pass the request to the customer.
3. The personal data we collect, and why
| Who you are | What we collect | Why we use it |
|---|---|---|
| A visitor to our website | Technical data that your browser sends when it loads a page: your IP address, browser type and the pages you request. Our hosting provider and our font provider receive this data. Our website sets no cookies and uses no analytics or advertising trackers. | To deliver the website and keep it secure. |
| A person who contacts us or meets us, for example a prospective customer or partner | Your name, job title, organisation, business email and phone number, and what you tell us in messages and meetings. Recordings and transcripts of online meetings, where we tell you at the start of the meeting. | To reply to you, arrange meetings, understand what your organisation needs, prepare proposals, and keep a record of our discussions. |
| A contact at one of our customers, or a person who holds an account on our platform | Your name, business email, role and the Seats you hold; records of your sign-in and use of the platform; for billing contacts, billing details. Our platform’s licence check sends us seat counts and the identifiers needed to count Seats. | To provide the platform and our services, count and bill Seats, support you, keep the platform secure, and send you notices about the service. |
| A supplier or contractor | Your business contact details and payment details. | To agree, manage and pay for the work. |
4. Where we get it
We collect personal data from you directly. We also receive it from your organisation, for example when it names you as a contact or a Seat holder. We may also use public business sources, such as company websites, the ACRA business register and professional networking sites.
5. Consent
We collect, use and disclose personal data with your consent, or where the PDPA allows us to do so without consent. Most of the PDPA’s rules, including its consent rules, do not apply to business contact information, such as your name, job title and business email, unless you gave it to us solely for personal purposes.
You may withdraw your consent at any time by writing to our Data Protection Officer (section 13). We will tell you what withdrawing means for you, for example that we can no longer provide a service. We will then stop within a reasonable time.
6. Messages about Substrait
We send news and offers about Substrait only to business contacts. You can stop them at any time: reply to the message, or write to our Data Protection Officer. We do not sell personal data.
7. AI tools
We use AI tools to help us summarise meetings, draft documents and analyse the information that you share with us.
8. Who we share it with
We share personal data only as far as each purpose needs, with:
- service providers that store or process data for us, such as cloud hosting, email and documents, meeting tools, AI tools, and payment and accounting services;
- our professional advisers, such as lawyers and accountants;
- government authorities, where the law requires it; and
- a buyer of our business, or a successor to it.
We bind our service providers by contract to protect personal data.
9. Transfers outside Singapore
Some of our service providers store data outside Singapore, for example in the United States. We transfer personal data outside Singapore only where the recipient must protect it to a standard comparable to the PDPA.
10. How we protect it
We limit access to the people who need it. We use company accounts, strong authentication and the least access that each task needs.
11. How long we keep it
We keep personal data only as long as its purpose, the law or a business need requires. For example, the law requires us to keep accounting records for 5 years. After that, we delete the data or make it anonymous.
12. Access and correction
You may ask us what personal data we hold about you and how we have used or disclosed it in the past year, and ask us to correct it. Write to our Data Protection Officer.
We acknowledge a request within 5 business days and answer as soon as we reasonably can. If we cannot answer within 30 days, we will tell you in writing, within those 30 days, when we will answer. We may charge a reasonable fee for access. If we do, we will give you a written estimate of the fee before we start. We do not charge for a correction.
13. Contact our Data Protection Officer
Lai Chang Wen, Data Protection Officer
Email: changwen@substrait.build
Substrait Pte. Ltd., 10A Kay Siang Road, Singapore 248927
If you are not satisfied with our answer, you may contact the Personal Data Protection Commission at www.pdpc.gov.sg.
14. Data breaches
We assess any suspected data breach promptly. Where the PDPA requires it, we notify the Personal Data Protection Commission and the people affected.
15. Children
Our services are for organisations. We do not knowingly collect personal data from children.
16. Changes to this notice
We may update this notice. The date at the top shows when we last changed it.