Privacy Policy

About This Policy

Preamble

This Privacy Policy ("Policy") is issued by EcoVault (hereinafter "EcoVault", "we", "our", or "us"), a platform operated from India, providing F&B compliance management services to Singapore-based establishments. This Policy governs the collection, use, disclosure, and protection of personal data submitted by users ("you", "User", or "Establishment") through the EcoVault platform, website, and application (collectively, the "Services").

This Policy is prepared in accordance with the Personal Data Protection Act 2012 (No. 26 of 2012) of Singapore ("PDPA"), as amended from time to time. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy.

Personal Data We Collect

EcoVault collects only such personal and business data as is necessary for the provision of compliance management services to F&B establishments in Singapore.

We do not collect sensitive personal data such as NRIC numbers, financial account details, or health information unless expressly required and separately consented to.

Consent

EcoVault collects personal data only with your express or deemed consent. Consent is obtained at the following stages:

• Account Registration: By completing sign-up and agreeing to this Policy, you provide express consent to the collection and use of your identity and contact data.
• Maintenance Log Upload: By submitting compliance records, you consent to their collection, storage, and processing.
• Report Export: By initiating a data export or report share, you separately authorise the disclosure of your compliance records to the designated recipient.

You may withdraw consent at any time by contacting our DPO. Withdrawal may affect our ability to continue providing the Services.

Purpose Limitation

EcoVault collects, uses, and discloses personal data only for the following purposes:

1. Facilitating the onboarding and management of F&B establishment compliance profiles;
2. Tracking and managing maintenance compliance activities including grease trap servicing, pest control, and temperature monitoring;
3. Generating automated compliance reports and reminders;
4. Enabling audit-ready documentation for submission to NEA and SFA;
5. Communicating service announcements and maintenance reminder notifications;
6. Ensuring the security, integrity, and performance of the platform.

Disclosure to Third Parties

EcoVault does not disclose your personal data to any third party except in the following circumstances:

• Regulatory Authorities (User-Initiated): You may export and share compliance records with NEA or SFA officers directly from your dashboard. Such disclosure occurs only upon your explicit action.
• Service Providers: Trusted third-party providers (e.g., cloud hosting) who process data on our behalf under contractual obligations consistent with this Policy.
• Legal Obligation: If required by law, court order, or governmental authority.
• Business Transfer: In the event of a merger or acquisition, subject to equivalent data protection obligations.

Data Protection

EcoVault implements the following security measures:

• Encrypted servers compliant with industry security standards;
• Transport Layer Security (TLS) encryption for data transmission;
• Role-based access controls (RBAC);
• Regular security assessments and vulnerability scanning;
• Internal data protection training for staff.

In the event of a notifiable data breach under the PDPA, EcoVault shall comply with mandatory breach notification obligations to the PDPC and affected individuals.

Access & Correction Rights

You have the right to:

• Access (Section 21): Request access to personal data EcoVault holds about you, including compliance records.
• Correction (Section 22): Request correction of any error or omission in your personal data.

EcoVault provides in-platform tools to directly edit, update, or delete your maintenance logs and establishment profile at any time. For data not editable via dashboard, submit a formal request to our DPO. We will respond within 30 calendar days.

Data Retention & Deletion

• Active account data retained for subscription duration + 3 years following account closure;
• Compliance records retained for minimum period prescribed under relevant legislation;
• Usage and server log data retained for up to 12 months;
• Upon expiry, data is securely deleted or anonymised using industry-standard methods.

Your Rights Under the PDPA

• Right to be informed — Notified of purposes for which your data is collected, used, or disclosed;
• Right of access — Request a copy of your personal data held by EcoVault;
• Right to correction — Request that inaccurate data be corrected;
• Right to withdraw consent — Withdraw consent for any use or disclosure of your data;
• Right to data portability — Request transfer of your data in a machine-readable format;
• Right to lodge a complaint — Make a complaint to the PDPC at www.pdpc.gov.sg.

Data Protection Officer

EcoVault has appointed a Data Protection Officer responsible for ensuring PDPA compliance and serving as the primary contact for all personal data-related inquiries.

Amendments to This Policy

EcoVault reserves the right to amend this Privacy Policy at any time. Material amendments will be communicated via email or in-platform notice at least 14 days prior to taking effect. Continued use of the Services constitutes acceptance of the amended Policy.

The most current version will always be accessible at ecovault.online/privacy.