Personal Data Protection Policy

Voltade Pte. Ltd. ("Voltade", UEN 202307668E) processes personal data in compliance with the Personal Data Protection Act 2012 of Singapore ("PDPA") and, where applicable to customer engagements, other data protection regimes such as the EU General Data Protection Regulation (GDPR). This policy applies to all personal data handled by Voltade (that of our customers, our customers' end users, our employees, and our business partners), whether processed electronically or otherwise, and binds all Voltade employees and contractors.

It complements our public Privacy Policy (the notice to individuals) and our Security Policies (the technical controls). Where Voltade processes personal data on behalf of a customer, Voltade acts as a data intermediary and processes such data only on the customer's instructions and for the contracted purposes.

Voltade has designated a Data Protection Officer ("DPO") in accordance with section 11(3) of the PDPA. The DPO is responsible for ensuring Voltade's compliance with the PDPA, maintaining this policy, handling data protection enquiries and complaints, and coordinating breach response. The DPO reports to Voltade's management, which retains overall accountability for data protection.

The DPO can be reached at [email protected] (Attn: Data Protection Officer).

• Personal data is collected only for legitimate business purposes that a reasonable person would consider appropriate, and individuals are notified of those purposes
• Consent is obtained before collection, use, or disclosure, except where an exception under the PDPA applies; consent can be withdrawn at any time
• Data collection is minimised: we collect and retain only what is needed for the stated purpose
• Personal data processed on behalf of customers is used solely to provide the contracted services, never for advertising, profiling unrelated to the service, or sale to third parties
• Individuals may request access to and correction of their personal data via the DPO, and we respond within the timelines prescribed by the PDPA

Voltade maintains security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal, and loss, including:

• AES-256 encryption at rest and TLS 1.3 encryption in transit for all personal data
• Per-tenant data isolation enforced with row-level security in our multi-tenant platform
• Least-privilege, role-based access control with multi-factor authentication for all privileged accounts
• Data minimisation towards AI model providers: only the minimum context required for a task is transmitted, under contractual no-training terms (see Data Residency & AI Infrastructure)
• Audit logging, monitoring, and alerting across production systems
• Data protection impact assessments (DPIA) for new processing activities involving personal data

The full control set is documented in our Security Policies and summarised in the Trust Centre.

This policy is disseminated to all employees and contractors. Every new joiner receives data protection and security awareness training during onboarding, with an annual refresher for all staff. Access to customer personal data is granted only to personnel who need it to deliver the contracted services, and such access is logged.

Voltade engages a small number of vetted sub-processors to deliver its services, listed publicly in our sub-processor register. For each sub-processor:

• A written contract is in place imposing data protection obligations equivalent to those Voltade owes its customers
• Sub-processors are selected for recognised, independently audited certifications (e.g. SOC 2, ISO 27001) and their compliance posture is reviewed before onboarding and periodically thereafter, including review of their current audit reports and trust documentation
• Sub-processors may process personal data only to provide their service to Voltade, and never to train AI models or for their own purposes

Personal data is stored primarily in the AWS Asia Pacific (Singapore) region. Where a processing step involves a transfer outside Singapore, for example, AI inference by a model provider, Voltade complies with the PDPA's transfer limitation obligation (section 26): transfers occur only to recipients bound by legally enforceable obligations (contractual clauses and data processing agreements) that provide a standard of protection comparable to the PDPA. Destination and provider details per service are documented in Data Residency & AI Infrastructure.

Voltade maintains a breach response process aligned with Part 6A of the PDPA:

1. Detect & contain: monitoring and alerting surface suspected incidents; affected systems are isolated and access revoked immediately
2. Assess: the DPO assesses within the statutory timeframe whether the breach is notifiable (significant harm or significant scale)
3. Notify: affected customers (as data controllers) are notified without undue delay so they can meet their own obligations; where a breach is notifiable, the PDPC is notified within three (3) calendar days of that determination, and affected individuals are notified where required
4. Remediate & review: root cause is fixed, and a post-incident review updates controls and this process

Voltade has experienced no data breach or cyber security incident to date. A copy of the detailed breach response runbook is available to customers on request via [email protected].

• Personal data is retained only for as long as necessary for the purpose for which it was collected, or as required by law
• On termination of a customer contract, customer data is returned or deleted at the customer's election; deletion requests are honoured within thirty (30) days
• Deleted data is removed from production systems immediately and from encrypted backups within the backup rotation cycle
• Detailed schedules are in our Data Retention & Deletion Policy