Privacy Policy

1. Who we are

This website, rnatech.io, is operated by RNA Technology Pte. Ltd.(“RNA Technology”, “we”, “us” or “our”), a technology consulting and systems integration company registered in Singapore. We provide AI automation, cloud computing, AI evaluation and security, and embedded engineering services to businesses across Southeast Asia and beyond.

We are the organisation responsible for (the “data controller” of) the personal data described in this policy. We handle personal data in accordance with Singapore’s Personal Data Protection Act 2012 (“PDPA”) and, where they apply, the EU and UK General Data Protection Regulation (“GDPR”) and Indonesia’s Personal Data Protection Law (Law No. 27 of 2022).

2. What this policy covers

This policy applies to personal data we collect about:

• visitors to our website;
• people who contact us, request a consultation, or respond to our advertising, including through Google Ads lead forms;
• business contacts at our clients, prospective clients, partners and suppliers; and
• people who subscribe to or receive our marketing emails.

It does not cover data we process on behalf of our clients during a project, or data processed by our products (such as Throughline) for a customer. That data is governed by our contract and data processing agreement with the client, and the client’s own privacy policy applies to it.

3. Personal data we collect

Information you give us

• Contact and consultation forms: your name, work email, company, phone or WhatsApp number, the service you’re interested in, and the message you write to us.
• Google Ads lead forms: when you submit a lead form shown in a Google ad, Google passes us the details you submitted, typically your name, email address, phone number, company, job title and any answers to the form’s questions.
• Emails, calls and meetings: the information you share when you correspond or speak with us, including notes we take about your business needs.
• Business relationships: contact and billing details for people at clients, partners and suppliers, needed to manage our contracts.

Please don’t send us sensitive personal data (such as health, financial account or national identification details) through our website forms. We don’t need it to respond to an enquiry.

Information collected automatically

When you visit our website, we and our analytics and advertising providers collect technical information such as your IP address, browser and device type, approximate location (city or country), pages viewed, referring website, the ad or campaign that brought you to us, and how you interact with the site. This is collected using cookies and similar technologies, described in section 7.

4. How we use your data

We use personal data to:

• respond to your enquiry and schedule consultations;
• understand your requirements, prepare proposals and quotes, and deliver and support our services;
• manage our relationship with you, including contracts, invoicing and payments;
• send you service-related messages, such as replies to your requests and meeting confirmations;
• send you marketing emails where you have agreed to receive them (see section 6);
• measure and improve our website and the effectiveness of our advertising;
• keep our website and systems secure and prevent spam and misuse; and
• comply with our legal, tax and regulatory obligations, and establish or defend legal claims.

We do not use your personal data for automated decision-making that has legal or similarly significant effects on you.

5. Consent and legal basis

Under the PDPA, we collect, use and disclose personal data with your consent, including consent you give by submitting a form or contacting us for a stated purpose, or where the PDPA otherwise permits it, for example for our legitimate interests or to perform a contract with you.

Where the GDPR applies, we rely on the following legal bases:

• Contract: to take steps you request before entering into a contract, such as preparing a proposal, and to perform our contract with you.
• Legitimate interests: to respond to business enquiries, run and secure our website, and understand how it is used, where those interests are not overridden by your rights.
• Consent: for marketing emails and for non-essential cookies, where consent is required.
• Legal obligation: to keep records required by law.

You may withdraw your consent at any time (see section 12). Withdrawing consent does not affect processing that took place before you withdrew it.

6. Marketing emails

With your permission, we may send occasional emails about our services, insights, events and case studies, including follow-up emails after you enquire. Every marketing email includes an unsubscribe link, or you can email contact@rnatech.ioto opt out. We will not send marketing messages to Singapore telephone numbers in breach of the PDPA’s Do Not Call provisions.

7. Cookies, analytics and advertising

Our website uses cookies and similar technologies from the following providers:

• Google Analytics 4 helps us understand how visitors use our website, such as which pages are popular and where visitors come from. We use the aggregated reports to improve the site.
• Google Ads conversion tracking and remarketing help us measure which ads lead to enquiries, and may show our ads to people who have previously visited our website as they browse other sites in Google’s network.

Google may collect and process this data in line with its own policies. You can learn more at How Google uses information from sites that use its services.

You can control or opt out of these technologies by:

• adjusting your browser settings to block or delete cookies;
• turning off personalised ads in Google Ad Settings;
• installing the Google Analytics opt-out browser add-on; or
• visiting aboutads.info or youronlinechoices.eu to manage interest-based advertising.

Blocking cookies may affect how parts of the website work.

8. Who we share data with

We do not sell or rent your personal data. We share it only with the following parties, and only as needed for the purposes in this policy:

• Service providers who process data for us under contract, including website hosting, form handling (Formspree), email and productivity tools, analytics and advertising (Google), and email marketing platforms. They may use the data only to provide their services to us.
• Our engineers and subcontractors working on your engagement, who are bound by confidentiality obligations.
• Professional advisers such as lawyers, accountants and auditors.
• Authorities and regulators where we are required by law, or to protect our rights, property or safety, or those of others.
• A buyer or successor in connection with a merger, acquisition or sale of our business, who will be bound by this policy for the data transferred.

9. International transfers

We are based in Singapore, and some of our service providers (including Google and Formspree) store or process data in other countries, such as the United States. When we transfer personal data outside Singapore, we take steps to ensure it receives protection comparable to the PDPA, as required by the PDPA’s Transfer Limitation Obligation. For data subject to the GDPR, we rely on adequacy decisions or standard contractual clauses where required.

10. How long we keep data

We keep personal data only for as long as it is needed for the purpose we collected it for, or as required by law. As a guide:

• Enquiries and leads that don’t become a client: up to 24 months after our last contact with you.
• Client and supplier records: for the duration of the relationship and up to 5 years afterwards, in line with Singapore record-keeping requirements.
• Marketing preferences: until you unsubscribe. We then keep a minimal record so we don’t email you again.
• Analytics data: retained in Google Analytics for up to 14 months.

After that, we delete or anonymise the data.

11. How we protect data

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include encryption in transit, least-privilege access controls, multi-factor authentication on our business systems, and choosing service providers with appropriate security commitments. No method of transmission or storage is completely secure, but if a data breach occurs that is likely to cause you significant harm, we will notify you and the relevant authorities as required by law.

12. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you, and learn how it has been used or disclosed in the past year;
• Correct personal data that is inaccurate or incomplete;
• Withdraw consent to our collection, use or disclosure of your data. We will tell you about the likely consequences before acting on your request;
• Delete your personal data, or restrict or object to how we use it;
• Data portability, meaning you receive a copy of your data in a commonly used format; and
• Complain to a data protection authority, such as Singapore’s Personal Data Protection Commission (PDPC) or your local supervisory authority.

To exercise any of these rights, email contact@rnatech.io. We may need to verify your identity before acting on your request. We aim to respond within 30 days and will tell you if we need more time. We may charge a reasonable fee for complex access requests, as the PDPA permits, and will tell you about it before proceeding.

13. Children

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

14. Third-party links

Our website may link to other websites, such as our blog references or social media profiles. We are not responsible for their privacy practices, so please review their privacy policies.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The “Last updated” date at the top shows when it was last changed. For significant changes, we will take reasonable steps to let you know.

16. Contact our Data Protection Officer

If you have questions about this policy or how we handle your personal data, or want to exercise your rights, please contact our Data Protection Officer:

Data Protection Officer
RNA Technology Pte. Ltd.
Singapore
Email: contact@rnatech.io

Prefer to talk first? You can also reach us through our contact page.