Privacy Policy

1. Scope and who this policy covers

This policy explains how Balian AI collects, uses, discloses and protects personal data in connection with:

• visitors to balian.ai (the “Site”); and
• individuals connected with our advisory clients and prospective clients (contact persons, employees of client organisations) whose personal data we may receive in the course of an engagement.

It is written to meet Balian AI’s obligations under Singapore’s Personal Data Protection Act 2012 (“PDPA”) and, where applicable, the EU/UK General Data Protection Regulation (“GDPR”) — see Section 10.

This policy does not cover personal data processed by Balian AI purely as a data intermediary/processor on a client’s instructions (for example, personal data a client exposes to an AI system we help design or assure). That processing is governed by the applicable client contract and the client’s own privacy notice, not this policy.

2. Personal data we collect

The Site does not use a contact or enquiry form, does not use analytics or cookies of any kind, and does not operate a newsletter or mailing list. We do not knowingly collect personal data from children, and the Site is not directed at children.

3. How we use personal data

We use personal data to:

1. respond to enquiries and correspondence sent to us;
2. provide, manage and improve our advisory services under an engagement;
3. maintain business records, invoicing and legal/regulatory compliance; and
4. operate and secure the Site.

We do not use analytics, tracking, or cookies on the Site, and we do not send newsletters or marketing updates by email. We do not use personal data collected via the Site to train, fine-tune, or otherwise improve any AI model, and we do not sell personal data.

4. Legal bases / grounds for processing

• Singapore (PDPA): we rely on your consent (e.g., submitting an enquiry by email) or on the PDPA’s exceptions to consent that apply to reasonable business purposes, such as managing an existing engagement or complying with law.
• Where GDPR applies (see Section 10): we rely on one or more of: your consent; performance of a contract with you or your organisation; our legitimate interests (e.g., responding to enquiries, keeping the Site secure, direct marketing to existing business contacts within permitted limits); or a legal obligation.

5. Disclosure of personal data

We do not share personal data collected via the Site with any analytics provider. Personal data sent to us by email is processed through our email provider, Microsoft 365, acting as our data intermediary/processor for that purpose. We may otherwise disclose personal data to:

• our personnel who need it to perform their duties;
• professional advisers (legal, accounting, insurance) on a need-to-know basis;
• a prospective buyer or successor in the event of a corporate transaction (merger, acquisition, restructuring), subject to confidentiality; and
• regulators, courts or law enforcement where required by law.

Where we or an engagement requires us to share personal data with a service provider or data intermediary, including Microsoft 365, we require that party to protect the data to a standard comparable to the PDPA (and, where relevant, the GDPR), consistent with the PDPA’s Transfer Limitation Obligation described in Section 9.

We do not disclose personal data to third parties for their own independent marketing purposes.

6. Retention

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law (for example, Singapore’s accounting and corporate record-keeping requirements). Enquiry correspondence that does not lead to an engagement is retained for up to 24 months from the date of last contact, after which it is deleted or anonymised. Engagement-related records are retained in line with our client contracts and applicable professional and legal retention periods.

7. Your rights

Under the PDPA, you may:

• withdraw consent to our collection, use or disclosure of your personal data at any time, by contacting our Data Protection Officer (Section 11);
• request access to the personal data we hold about you and how it has been used or disclosed in the past year;
• request correction of an error or omission in your personal data.

We will respond to a valid request within 30 calendar days. We may charge a reasonable fee for an access request, which we will notify you of in advance.

Where GDPR applies to you (Section 10), you additionally have the right to:

• request erasure of your personal data (“right to be forgotten”);
• request restriction of, or object to, processing;
• receive your data in a portable format (“data portability”); and
• lodge a complaint with your local supervisory authority.

8. Security

We use reasonable technical and organisational measures (such as access controls and encryption in transit) appropriate to the sensitivity of the data involved, to protect personal data against unauthorised access, collection, use, disclosure, copying, modification or disposal.

Data breach notification: in the event of a notifiable data breach, we will assess and, where required, notify the Singapore Personal Data Protection Commission (PDPC) within the statutory timeframe (currently as soon as practicable and, where PDPC notification is required, within 3 calendar days of assessment), and notify affected individuals where the breach is likely to result in significant harm. Where GDPR applies, we will additionally notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach, as required by Article 33 GDPR.

9. Cross-border transfer of personal data

Personal data submitted to us via the Site (i.e., sent to info@balian.ai) is hosted through our email provider, Microsoft 365, whose infrastructure may store or process data outside Singapore, including within the EU/EEA and other jurisdictions in Microsoft’s global datacentre network.

Personal data connected with an advisory engagement may be transferred to, stored, or processed in other jurisdictions relevant to that engagement.

Before any such transfer of personal data outside Singapore, we take steps to ensure the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA — for example, through contractual clauses, participation in a recognised certification scheme (such as APEC Cross-Border Privacy Rules), or transfer to a jurisdiction assessed as offering comparable protection.

Where GDPR applies, transfers of personal data outside the EEA are made only on an approved basis, such as an adequacy decision, the EU Standard Contractual Clauses, or another safeguard recognised under Chapter V GDPR.

10. When GDPR applies to Balian AI

Balian AI is incorporated and operates in Singapore and does not have an establishment in the European Union. However, the GDPR can still apply to us on an extraterritorial basis under Article 3(2) where we:

(a) offer goods or services to individuals in the EU (whether or not payment is required); or (b) monitor the behaviour of individuals located in the EU (for example, through analytics or tracking on the Site).

Where this applies — for instance, because an advisory engagement involves personal data of individuals located in the EU — we assess on a case-by-case basis whether Article 27 GDPR requires us to designate a representative established in a Member State where the relevant data subjects are located. As at the date of this policy, Balian AI has assessed that its processing does not trigger this requirement, as any EU-connected processing to date has been occasional and low-risk (see our GDPR Statement for the full position). We will reassess this as our client base evolves. The Site itself does not use analytics or tracking technology and does not monitor the behaviour of EU-based visitors.

If your engagement or interaction with us has no connection to the EU (no EU-based individuals, no targeting of the EU market), GDPR does not apply to that processing, and the PDPA governs.

11. Data Protection Officer / contact

You may contact our Data Protection Officer with any question, concern, consent-withdrawal notice, or access/correction request:

Data Protection Officer
Balian AI (Shasana Balian AI Pte Ltd)
Singapore
Email: info@balian.ai

12. Changes to this policy

We may update this policy from time to time to reflect changes in law or our practices. The “Last updated” date above will be revised accordingly. Material changes will be highlighted on this page.

13. Related policies

See also our Terms of Service, AI Transparency Statement, and GDPR Statement.

This page is for general information and does not constitute legal advice.