PDPA Statement

About this statement #

FLOW FN PTE. LTD. (UEN 202617303Z), a company incorporated in Singapore complies with the Personal Data Protection Act 2012 (the PDPA) and its regulations in collecting, using and disclosing personal data for Nayto. This statement supplements our Privacy Notice, which says what we collect and why.

Where we process personal data on a customer's behalf, we do so as the customer's data intermediary under the Data Processing Addendum, and the protection and retention obligations below apply to us directly.

Consent #

We collect, use and disclose personal data with consent - given when you create an account or accept an invitation, or deemed where you give us data for an evident purpose - or where the PDPA allows us to without consent, such as for our legitimate interests in securing the Service or to comply with the law. We do not make consent to unnecessary processing a condition of providing the Service.

Purpose limitation and notification #

We use personal data only for purposes a reasonable person would consider appropriate, and which we have told you about at or before collection. The purposes are listed in the Privacy Notice. If we want to use personal data for a new purpose, we will tell you and, where the PDPA requires, ask for your consent first.

Withdrawing consent #

You may withdraw your consent at any time by writing to privacy@nayto.io. We will tell you the likely consequences - in most cases, that we can no longer provide the Service to you - and stop the collection, use or disclosure within a reasonable time, unless the law requires or allows it to continue.

Access and correction #

You may ask for the personal data we hold about you and how it has been used or disclosed in the past year, and ask us to correct an error or omission. Write to privacy@nayto.io or use our privacy request form. We respond within 30 days; if we cannot, we will tell you within that time when we will. We may charge a reasonable fee for access, and will tell you the amount before we incur it.

Accuracy #

We take reasonable steps to keep personal data accurate and complete where it is likely to be used to make a decision about you. You can correct your own name and password in the console at any time.

Protection #

We make reasonable security arrangements to protect personal data from unauthorised access, collection, use, disclosure, copying, modification and disposal, and from the loss of any device or medium holding it. Our Security page describes them.

Retention limitation #

We stop keeping personal data, or make it anonymous, once it no longer serves the purpose it was collected for and no legal or business purpose needs it. The periods are in our Data Retention Schedule.

Transfer limitation #

Nayto is hosted in Singapore, and its database and stored content do not leave it. Some of our providers process limited personal data outside Singapore, as the subprocessors page shows. Before transferring personal data out of Singapore, we make sure the recipient is bound by legally enforceable obligations - in our contracts with it - to give the data a standard of protection comparable to the PDPA's, as the Personal Data Protection Regulations 2021 require.

Data breach notification #

We assess a suspected data breach promptly. If it is notifiable - likely to cause significant harm to the people affected, or affecting 500 or more people - we notify the Personal Data Protection Commission as soon as practicable and within three calendar days of our assessment, and we notify the people affected where it is likely to cause them significant harm, unless the PDPA exempts us. We keep a record of every breach.

Accountability and our data protection officer #

We have designated a data protection officer, who is responsible for our compliance with the PDPA and can be reached at dpo@nayto.io. We keep written policies and practices for handling personal data, train the people who handle it, and make information about them available on request.

Do Not Call #

We do not send marketing calls, text messages or faxes to Singapore telephone numbers. If we ever do, we will check the Do Not Call registers first, as the PDPA requires.

Complaints #

Write to our data protection officer at dpo@nayto.io; we will respond within 30 days. If you are not satisfied, you may complain to the Personal Data Protection Commission.

How this document changes #

Every version of this document has a number and the date it applies from, both printed under the title. A change is published as a new version rather than an edit to this one, so what the document said on any day can be checked.

When a change matters to what you have agreed or to how we use your data, we tell you before it takes effect. Earlier versions are available from legal@nayto.io.