Privacy policy

What this policy covers, and what it does not

This policy covers personal data that SG Systems itself collects and uses: visitors to this website, people who contact us, and the people we work with in sales, pilots and delivery. It does not cover data processed inside a customer’s REMIT deployment. REMIT runs entirely inside the customer’s own environment and no case data reaches SG Systems; how REMIT helps a customer meet its own PDPA obligations is a product matter described on the product pages, not a matter of this policy.

What we collect, and why

When you visit this site

Aggregate page-view analytics from Ahrefs Web Analytics, which sets no cookies and is designed not to identify individual visitors. Your browser’s request (IP address, user agent, page, referrer) is processed by Ahrefs to produce counts we see only in aggregate. The site itself sets one technical cookie, NEXT_LOCALE, to remember the language; it identifies nobody.

WhyTo know which pages are read. Nothing else.

When you email us or request a demo

Your name, work email, organisation, role, and whatever you write, including the sector, workflow and case volume on the demo request. The demo request opens a Calendly booking with those details pre-filled, or, if you prefer, an email in your own mail client; this site stores nothing.

WhyTo answer you and, if you ask for one, to prepare a demo or a pilot proposal.

When you book a call

The name, email, chosen time and anything you enter or that the demo request pre-fills into Calendly, which also places the booking in our calendar.

WhyTo hold the meeting, prepared.

When we work together

Business contact details of the people on your side, the correspondence between us, and contract documents. Never the personal data inside your cases: REMIT is built so that it stays in your environment.

WhyTo deliver the engagement and to keep the records a contract requires.

Consent and purpose

We collect personal data only for the purposes above, and we rely on your consent, given when you contact us, book a call or enter a business relationship with us, for those purposes. We do not use your data for marketing unless you ask us to, we do not sell it, and we do not combine it with data from other sources. You may withdraw consent at any time by writing to the Data Protection Officer; we will stop the processing concerned unless a contract or a legal duty requires us to keep a record.

Who else sees it

We do not disclose personal data to any third party for that party’s own purposes. Three providers process data on our behalf, for the purposes stated above and nothing else:

• Ahrefs Web Analytics, for aggregate page-view counts on this site.
• Calendly, for scheduling calls you book through the site.
• Our hosted email and calendar provider, where correspondence and bookings are stored.

Links to GitHub, Hugging Face and LinkedIn take you to those services under their own policies; nothing is sent to them by this site.

Cross-border transfer

The three providers above store data outside Singapore. We transfer personal data to them only for the purposes stated, and only under terms that require them to protect it to a standard comparable to the PDPA. We do not transfer personal data outside Singapore for any other purpose.

How long we keep it

• Enquiries and correspondence: two years after our last exchange, unless a contract follows.
• Contracts and the records a contract requires: seven years, the statutory period for business records.
• Booking data in Calendly: deleted when the booking is no longer needed for the meeting or its follow-up.
• Analytics: aggregate only; no personal data is retained.

Your rights

• Access: ask what personal data we hold about you and how we have used it in the past year. We respond within thirty days.
• Correction: ask us to correct an error or omission.
• Withdrawal: withdraw consent for any purpose, with the consequence stated above.
• Complaint: if you are not satisfied with our answer, you may complain to the Personal Data Protection Commission of Singapore.

How we protect it

Access to the data described here is limited to the Data Protection Officer and the people handling your enquiry or engagement, on accounts with strong authentication. If a data breach occurs that is likely to cause significant harm, or that affects 500 or more people, we assess it within thirty days of becoming aware, notify the Commission within three calendar days of that assessment, and notify the people affected as soon as practicable, as the PDPA requires.

Changes

When this policy changes, the date at the top changes with it. Material changes to what we collect or why will be stated here plainly, not hidden in a revision.