1. About this policy

This policy explains how Eleos Web Pte Ltd ("Eleos", "we", "us") collects, uses, discloses, stores and protects personal data. We are based in Singapore and handle personal data in line with Singapore's Personal Data Protection Act 2012 (PDPA). Where we handle personal data of people in other countries, including the Philippines under the Data Privacy Act of 2012, we also follow the data protection laws that apply to that data.

It applies to visitors to our website, to people who contact us, to our customers' contact persons, and to users of our software and services, including our point-of-sale, payments, messaging and AI products.

2. Our role: controller and processor

When we collect personal data for our own purposes, such as managing our website, responding to enquiries or running our business relationships, we act as the organisation responsible for that data (the "controller" or "personal information controller").

When we provide our software and services to a business customer and process personal data on that customer's behalf, the customer decides why and how the data is used. We act only on the customer's instructions, as a "processor" (a "data intermediary" under the PDPA, or a "personal information processor" in the Philippines).

If you are an end customer or user of one of our customers, please contact that customer first about your personal data. We will help the customer respond to your request.

3. Personal data we collect

Depending on how you deal with us, we may collect:

• Contact and business details you give us in forms or by email, such as name, email address, telephone number, company, job title and department.
• Customer account and billing records, such as customer emails, billing addresses and invoices.
• Account and security data for people who use our systems, such as usernames, login attempts, access records and activity or change logs.
• Messaging data when a business uses our messaging products, such as phone numbers, message content, opt-in and opt-out records, and delivery status. See section 6.
• Transaction and merchant data when a business uses our payments products, such as transaction records and the business details needed to set up and verify a merchant account. See section 7.
• Content you or your business submit to our AI features, such as text entered into a prompt or drawn from business records. See section 5.
• Website usage data, such as pages visited and device or browser information collected through analytics. See section 15.

We collect only the personal data we need for the purposes in section 4. We do not ask for government-issued identification numbers unless a service specifically requires it and we tell you so at the time.

4. Why we use personal data

We use personal data only for the purposes we have declared:

• to provide, support, secure and improve our software and services, including our AI features;
• to set up and manage customer accounts, billing and invoicing;
• to respond to your questions and requests;
• to keep audit trails, detect and investigate security incidents, and protect our systems;
• to send you marketing communications, where you have agreed to receive them; and
• to meet our legal and regulatory obligations.

The law lets us process personal data only where we have a valid reason, known as a legal basis. The table shows the basis we rely on for each purpose.

Where the law of your country requires a different or additional basis, such as your express consent for sensitive personal data, we will follow it. We do not use personal data for a different purpose unless the law allows it or we first obtain your consent.

5. AI features and how we protect your data

Some of our products and consulting services use third-party AI model providers, for example to draft text, summarise records or answer questions about business data.

Before any content goes to an AI model provider, our system automatically masks personally identifiable information (PII) and all other sensitive data. The provider receives the masked text, not the original details. Masking is an automated control, so we also limit what we send to what the feature needs.

We use AI providers as service providers under written agreements. They may process data only to provide the service to us. We do not allow them to use the data we send to train their models. AI providers keep the data they receive for no longer than 30 days.

We do not use your customer data to train our own AI models without your or your customer's permission.

AI output is a suggestion for the people who use our products. Our AI features do not make fully automated decisions that significantly affect individuals without human review.

Our AI providers are listed in our sub-processor list (see sections 8 and 12). If you are a business customer and want to switch AI features off for your account, contact us using the details in section 16.

6. Messaging channels such as WhatsApp

Eleos is a Meta Tech Provider. Our business customers use our messaging products to talk to their own customers through channels such as WhatsApp. In this case the business customer decides what is sent and to whom, and we process messages on its behalf.

To run the service we handle phone numbers, message content, opt-in and opt-out records, and delivery status. Meta delivers the messages and handles them under its own terms and privacy policy.

Business customers are responsible for having a valid basis, and consent where required, to message their own customers. We keep opt-in and opt-out records so customers can show this and honour opt-outs. Where marketing messages go to Singapore numbers, the Do Not Call Registry rules apply and we expect customers to follow them.

7. Payments

When a business uses our payments products, we process transaction records for that business and, where needed, the business and owner details used to set up and verify a merchant account. Our payment partners and card-terminal providers may collect further verification details that the law requires, and they tell you when they do.

Card payments are handled by our payment partners and terminal providers under their own security obligations, including PCI DSS where it applies. We use these partners as service providers (see section 8).

We keep transaction records for as long as the customer's contract and the law require (see section 13).

8. Who we share personal data with

We do not sell your personal data.

We share personal data only where needed for the purposes in section 4, with:

• Service providers, such as hosting, analytics, customer relationship management and AI model providers, who may process data only on our instructions and under data processing agreements;
• Messaging and payments partners, such as Meta (for WhatsApp) and our payment partners and card-terminal providers, to deliver messages and process payments;
• Third-party systems you or our customer ask us to connect through our integrations, which receive only the data needed for that integration; and
• Authorities and other parties where the law requires or permits it, such as courts, regulators and law enforcement acting with proper legal authority.

Business customers can ask us for our current list of sub-processors. Section 12 explains how we handle changes to that list.

9. Where we host data, and transfers outside your country

Eleos is based in Singapore. Our systems run on servers in Singapore, or on servers in a location our business customer chooses where we have agreed this in writing. Personal data about people in other countries, including the Philippines, may therefore be processed in Singapore or in the location the customer chose.

Some service providers in section 8, such as AI model providers and messaging platforms, may process limited data outside Singapore. For AI providers this is masked text only (see section 5). If a customer chooses hosting outside Singapore, the laws of that country may apply to the data held there.

When personal data is transferred across borders, we take steps so that it continues to be protected to a standard comparable to the law that applies. Where the law requires it, we use approved safeguards such as contract clauses. Our business customers agree to the processing of their data in Singapore, or in the location they chose, in their service contract with us. We apply the security measures in section 10, limit access to people who need it, and require our service providers to protect personal data under written agreements.

10. How we protect personal data

We use organisational, physical and technical measures to protect personal data from misuse, loss, and unauthorised access, change or disclosure. These include:

Technical measures

• Encryption of data in transit between users and our systems, and a web application firewall with rate limiting and an additional network protection layer in front of our application programming interfaces;
• Automatic masking of personally identifiable information (PII) and all other sensitive data before content is sent to AI model providers;
• Encrypted backups, with disk encryption and password protection, and daily backups to a separate location;
• Unique user accounts with strong passphrase rules, account lockout and multi-factor authentication;
• Role-based access to logs, and logging and monitoring of servers, firewalls and managed devices, with logs protected against unauthorised change and reviewed periodically and during incident investigations;
• Malware and firewall protection, centrally managed device security, and tested software and operating system updates; and
• Vulnerability scans before and after deployment, and penetration testing of internet-facing services.

Organisational measures

• Documented information security policies, reviewed at least once a year, and an annual risk assessment of our information systems;
• Confidentiality agreements for employees, contractors and partners who may access sensitive information;
• Security awareness training every year for employees, contractors and temporary staff;
• Data classified by sensitivity, with an inventory of the data we hold, where it is kept and how long we keep it; and
• Business continuity and disaster recovery planning, with backup restoration tests.

Physical measures

• Controlled access to our offices and data centres, with visitors signed in, issued guest cards and escorted or monitored; and
• Approval and tracking of hardware and software before it is used, and secure handling of equipment when it is retired.

Independent certification

Eleos Web Pte Ltd holds the Cyber Essentials for ICT Vendors certification under the Cyber Security Agency of Singapore's cybersecurity certification scheme, audited by an independent certification body. The certification covers our production and development environment. Certificate number MS-005-2026-0016, issued by Setsco Certification on 10 April 2026 and valid until 9 April 2028, confirms that we meet the requirements of the CSA Cybersecurity Certification for Cyber Essentials for ICT Vendors (2025).

No system is completely secure. If you believe your data or an account has been compromised, please contact us straight away using the details in section 16.

11. Data breaches

We keep a record of security incidents and investigate them promptly. If we process data for a business customer and a breach affects it, we tell that customer without undue delay, and within 24 hours as set out in our data processing agreement, so it can meet its own duties.

If a data breach is likely to cause you significant harm, we will notify you and the relevant authority within the time the law requires, for example the Personal Data Protection Commission in Singapore or the National Privacy Commission in the Philippines.

12. Information for business customers

We know business customers need to show their own regulators and auditors how their data is handled. We support this in the following ways.

• Data processing agreement. We offer a data processing agreement that sets out what we process, on whose instructions, and the security and breach duties that apply.
• Sub-processors. We keep a list of our sub-processors, including what each one does and where it processes data, and share it on request. We tell customers 30 days before we add or replace a sub-processor that handles their personal data, and a customer may object on reasonable grounds.
• Security assurance. On request, we provide our security overview and evidence of our independent certification and a summary of our latest penetration test. Our latest penetration test, carried out in June 2026 by an independent security testing firm, covered our Kassie+ web application. It found no critical or high-risk issues. It found three medium and one low-risk issue, which we fixed, and a retest in July 2026 confirmed that none remained.
• Questionnaires and audits. We answer reasonable security and privacy questionnaires, and the data processing agreement sets out how a customer can audit our handling of its data.
• Hosting location. Customers can choose where their data is hosted, as described in section 9.

13. How long we keep personal data, and how we dispose of it

We keep personal data only for as long as we need it for the purposes in section 4 and for legal, tax and audit reasons.

When personal data is no longer needed, or when a customer asks us to delete it, we delete it from our live systems through a controlled and auditable process. Copies in backups are not restored to live use and are overwritten when the backups expire, within the periods in the table.

When a business customer's contract ends, the customer can export its data in a commonly used format for 30 days. After that we delete it from our live systems and our backup files within 9 months of the contract ending.

Paper records are cross-cut shredded, and hard drives, USB devices and other media are physically destroyed. We keep records of destruction and require approval before equipment is retired.

14. Your rights

Depending on where you live and the law that applies, you may have the right to:

• be informed about how your personal data is collected, used and shared;
• access the personal data we hold about you, and how we use and disclose it;
• correct personal data that is inaccurate or incomplete;
• withdraw your consent at any time, including to marketing communications, subject to legal or contractual restrictions;
• object to our processing of your personal data;
• ask us to erase or block personal data that is no longer needed;
• receive your personal data in a commonly used electronic format (data portability), where the law gives you this right; and
• complain to us or to the data protection authority in your country.

To exercise a right, email us at the address in section 16. We may ask you to verify your identity before we act on a request. We will acknowledge your request promptly and aim to respond within 5 working days. We will always respond within the time the law requires (30 days under the PDPA), or tell you if we need more time and why. If you are an end customer of one of our customers, we may refer your request to that customer.

If you are not satisfied with our response, you can complain to the Personal Data Protection Commission in Singapore, or to the data protection authority in your country.

15. Cookies and analytics

Our website uses cookies and similar technologies for analytics, to understand how visitors use our pages. Analytics cookies are used only with your consent where the law requires it. You can accept or decline them in the cookie banner, and you can also block or delete cookies in your browser settings. Declining analytics cookies does not stop you from using our website.

16. Contact us

For privacy questions, requests or complaints, contact Eleos Web:

Eleos Web Pte Ltd
Email: privacy@eleos.com
Address: 205 Balestier Road, #02-09, The Mezzo, Singapore 329682

17. Changes to this policy

We may update this policy from time to time. The latest version is always on this page, with the date it was last updated shown at the top. If we make a material change, we will tell you in a suitable way, for example by notice on our website or by email to our business customers.