Data Protection Notice

RETONAI PTE. LTD. ("RETONAI", "we", "us" or "our") respects your personal data and is committed to handling it responsibly.

This Data Protection Notice explains how we collect, use, disclose, protect and retain personal data when you visit our website, use Online Support, contact us, attend a meeting or technical discussion with us, request a proposal or feasibility assessment, engage RETONAI for engineering or research services, or otherwise interact with us in a business capacity.

This notice is intended to support our obligations under Singapore's Personal Data Protection Act 2012 ("PDPA").

1. Personal data we may collect

Information you provide

We may collect information that you provide directly, including:

• Your name
• Business email address and telephone number
• Job title and organisation
• Company website
• Information contained in your enquiry
• Information about equipment, systems, projects or technical requirements
• Files or other materials you choose to provide through email, approved project channels or other permitted methods. File uploads are not permitted through Online Support.
• Meeting notes and business correspondence
• Proposal, contract, billing and administrative information
• Any other information you voluntarily provide

Please avoid submitting confidential information, credentials, security keys, sensitive personal data or production datasets through the general website enquiry form.

Technical and website information

Depending on how the website is hosted and configured, our service providers may automatically process limited technical information, such as:

• Internet Protocol address
• Browser and device type
• Operating system
• Referring page
• Pages requested
• Date and time of access
• Security, diagnostic and server-log information

We use such information where reasonably necessary to deliver, secure, maintain and understand the operation of the website.

Online Support information

When you use Online Support, we may process:

• Your messages
• Your name and email address, where provided
• A conversation identifier
• Date and time information
• IP address
• Browser, device and network information
• Security, spam and abuse-prevention signals

Online Support does not accept file uploads.

Project and engineering data

During an engineering engagement, a client may provide device logs, images, audio, video, sensor records, system identifiers, datasets or other technical information.

Where project data contains personal data, the respective responsibilities of RETONAI and the client should be addressed in the applicable contract, statement of work or data-processing terms. Where RETONAI processes personal data solely on a client's instructions, RETONAI may act as a data intermediary under the PDPA.

2. Why we use personal data

We may collect, use or disclose personal data for reasonable purposes including:

• Responding to enquiries
• Assessing whether RETONAI's services may be suitable for a project
• Arranging meetings and technical discussions
• Preparing proposals, quotations and statements of work
• Providing engineering, advisory, research and related services
• Providing Online Support and preliminary technical triage
• Maintaining conversation continuity
• Managing customer, supplier and professional relationships
• Administering contracts, payments and business records
• Maintaining and securing our website, systems and communications
• Detecting spam, malware, fraud, automated abuse and cyberattacks
• Applying rate limits, security challenges and access restrictions
• Investigating suspected misuse of our website, chat or communications systems
• Investigating suspected misuse, security incidents or unlawful activity
• Meeting legal, regulatory, accounting and reporting requirements
• Establishing, exercising or defending legal claims
• Other purposes that we notify you of when collecting the information

We do not sell or rent personal data.

We will not add website-enquiry details to a general marketing mailing list unless we have provided appropriate notice and obtained consent where required.

3. Consent and withdrawal

Where consent is required, we will notify you of the relevant purposes before or when collecting your personal data.

Consent may be provided expressly or may be deemed to have been given in circumstances permitted by the PDPA. We may also collect, use or disclose personal data without consent where an exception under applicable law permits or requires us to do so.

You may withdraw consent for the continued collection, use or disclosure of personal data by contacting us. We will inform you of any likely consequences of withdrawal and will process the request within a reasonable period.

Withdrawal does not affect processing that was lawfully carried out before the withdrawal or information that we must retain for legal or legitimate business purposes.

4. Online Support and AI use

Online Support is intended for general enquiries, preliminary technical questions, troubleshooting and project triage.

Online Support is not an NDA-protected or confidential communication channel. You should not submit:

• Trade secrets
• Passwords, tokens, private keys or credentials
• Proprietary source code
• Sensitive network diagrams
• Customer records
• Production datasets
• Unreleased designs
• Unnecessary personal data
• Information you are not authorised to disclose

You are responsible for reviewing your message before submission and ensuring that you are authorised to provide it. This does not remove RETONAI's obligations to protect personal data in its possession or under its control.

Automated tools may process a conversation where necessary to route, analyse or assist with a response. RETONAI does not use Online Support conversations, enquiry information or submitted personal data to train or fine-tune artificial-intelligence or machine-learning models.

If RETONAI proposes using conversations for AI training in the future, we will update this notice and establish an appropriate notification and consent process before beginning that use.

5. Disclosure to other organisations

We may disclose personal data where reasonably necessary to:

• Website-hosting, email, cloud, communications and IT-security providers
• Professional advisers, including legal, accounting and insurance providers
• Contractors or technical specialists supporting an authorised project
• Government authorities, regulators, law-enforcement agencies or courts where required or permitted by law
• A party involved in a proposed or completed corporate transaction, subject to appropriate safeguards
• Another organisation where you have requested or authorised the disclosure

We require service providers handling personal data on our behalf to use it only for authorised purposes and to apply appropriate protection.

RETONAI may change its hosting, email, security or infrastructure providers from time to time. We will assess providers according to the nature of their services and the personal data they may process.

The identity of a provider may change without individual notification, provided that the purposes and material characteristics of the personal-data processing do not change. We will update this notice where a provider change materially affects overseas transfers, retention, security practices or individuals' choices.

6. Overseas transfers

Our infrastructure providers, technical systems, personnel or subprocessors may process or store information in Singapore or other countries.

Where personal data is transferred outside Singapore, RETONAI will take reasonable steps to ensure that the recipient provides a standard of protection comparable to that required under the PDPA, except where an applicable legal exception applies.

A material change in hosting location or provider will be assessed for data-protection, security, retention and overseas-transfer risks.

7. Cookies and third-party services

RETONAI does not currently use its own advertising cookies and does not sell website-usage data.

The website may use essential technologies needed for security and operation. It may also include third-party resources or embedded content, such as Google Fonts or Google Maps. When these resources load, the third-party provider may receive technical information such as your IP address, browser information and the page being viewed, and may use cookies or similar technologies according to its own policies.

You may configure your browser to restrict cookies or similar storage. Some website functions may not operate correctly if essential technologies are blocked.

If RETONAI later introduces non-essential analytics, advertising or additional tracking technologies, we will update this notice and provide controls where appropriate.

8. Protection of personal data

We apply reasonable administrative, technical and physical safeguards appropriate to the nature of the personal data and the risks involved. These may include:

• Access controls
• Authentication measures
• Secure communications and storage
• Restricted access based on business need
• Software maintenance and security updates
• Service-provider assessment
• Backup and recovery procedures
• Processes for responding to suspected data breaches

No transmission or storage system can be guaranteed to be completely secure. You should use appropriate care when sending information electronically.

9. Retention

We retain personal data only for as long as reasonably necessary to:

• Fulfil the purposes described in this notice
• Maintain appropriate business and project records
• Meet contractual, legal, tax or regulatory requirements
• Establish, exercise or defend legal claims

When personal data is no longer required for a legal or business purpose, we will cease retaining it or remove the means by which it can be associated with an identifiable individual, where reasonably practicable.

Online Support retention and deletion

Online Support conversations are retained only for as long as reasonably necessary to:

• Respond to and manage the enquiry
• Maintain support continuity
• Protect our website and systems
• Investigate misuse or security incidents
• Maintain appropriate business records
• Meet legal or contractual requirements

RETONAI does not currently enable an optional automated backup service specifically for Online Support conversations.

Temporary maintenance snapshots, security logs or recovery copies may contain information from the chat system. Such copies are not used for ordinary support, marketing or AI training and will expire through the applicable operational lifecycle.

You may request deletion of a complete conversation by contacting:

Email: privacy@retonai.com — Subject: Chat conversation deletion request

Include the approximate date and time, the name or email used, and the conversation reference where available. Do not repeat confidential information in the request.

RETONAI may verify your identity and authority before processing the request.

The chat administration system supports deletion of an entire conversation only. Individual messages cannot currently be deleted separately.

Where continued retention is not required for security, legal or legitimate business purposes, RETONAI will delete or anonymise the complete conversation from the active chat system within a reasonable period.

Limited information may remain temporarily in security logs, system logs, temporary snapshots or a minimal record showing that the request was handled.

Online Support is not a permanent record-keeping service. RETONAI does not guarantee that a conversation will remain available or recoverable for any specific period.

10. Security screening and communications

RETONAI may process IP addresses, network information, request patterns, email addresses, domains, authentication results and third-party threat or reputation information to protect its website, Online Support, email and infrastructure.

Where activity presents a suspected spam, fraud, malware, denial-of-service or other security risk, RETONAI may:

• Apply rate limits
• Present a security challenge
• Delay or restrict requests
• Quarantine communications
• Reject messages
• Temporarily or permanently restrict an IP address, address range, email address or domain

The use of a VPN, proxy or shared virtual server does not itself constitute misuse. However, restrictions may affect legitimate users where a shared address is associated with abusive activity. A restriction does not necessarily indicate wrongdoing by every user sharing that address.

Email messages may also be rejected, delayed or quarantined because of sender reputation, spam blocklists, failed authentication, suspicious content or security policies. Email delivery is not guaranteed.

A person who believes access was restricted incorrectly may contact contact@retonai.com or write to RETONAI at the postal address below.

11. Access and correction

Subject to the PDPA and applicable exceptions, you may request:

• Access to personal data in our possession or under our control
• Information about how we used or disclosed that personal data during the applicable preceding period
• Correction of an error or omission in your personal data

We may need to verify your identity and request sufficient information to locate the relevant records. Where permitted by law, a reasonable fee may apply to an access request. If so, we will provide an estimate before processing it.

12. Data breaches

If we become aware of a personal-data breach, we will assess the incident and take appropriate containment and remediation measures.

Where the breach is notifiable under the PDPA, we will notify the Personal Data Protection Commission and affected individuals as required.

13. Third-party websites

Our website may contain links to websites operated by other organisations. RETONAI is not responsible for their content or data-protection practices. You should review the relevant third party's privacy or data-protection notice before providing personal data.

14. Changes to this notice

We may update this notice when our practices, services, providers or legal obligations change.

The revised notice will be published on this page with an updated revision date. Unless applicable law requires otherwise, changes may be made without individual advance notification.

Where a change materially affects the purposes of processing, categories of personal data, overseas transfers or individuals' choices, we may provide additional notice through an appropriate channel.

15. Contact our Data Protection Officer

For questions, complaints, withdrawal of consent, or access and correction requests, contact:

Data Protection Officer · RETONAI PTE. LTD. · 60 Paya Lebar Road · #06-28 Paya Lebar Square · Singapore 409051

Email: privacy@retonai.com — Subject: Data Protection Request