Privacy notice: Singapore

1. Who this covers

People in Singapore whose personal data a Singapore organisation collects, uses or discloses through the service, and account holders in Singapore.

The law: Personal Data Protection Act 2012; Personal Data Protection Regulations 2021.

2. Who is responsible

• For the people a business calls or chats with, that business (the workspace) decides why and how the data is used. We process it on its instructions, under our Data Processing Agreement. Under the PDPA the workspace is the organisation responsible, and we are its data intermediary. As a data intermediary we are bound directly by the protection, retention-limitation and breach-notification obligations. (ss. 4(2), 24, 25, 26C)
• For the accounts of people who sign up with us, we are the organisation responsible.

3. Why we may use the data

• Account data is used for the purposes in our privacy notice: running the service, billing, security and answering requests. We collect it with your consent, which you may withdraw on reasonable notice. (ss. 13, 16, 20)
• People a workspace contacts: the workspace must have consent or another basis the PDPA allows, and must check the Do Not Call Registry before sending marketing messages to Singapore numbers. The service records do-not-call screening evidence for Singapore numbers. (Part 4; Part 9)
• Every call an agent makes or answers opens with a spoken statement that it is an automated AI assistant, and that the call may be recorded if recording is on. No workspace setting removes it.
• We do not sell personal data, use it for advertising, or train models on calls or chats.

4. Your rights

• Access to your personal data, and how it has been used or disclosed in the past year. An organisation that cannot answer within 30 days must tell you in writing when it will. (s. 21; Regulations)
• Correction of an error or omission. (s. 22)
• To withdraw consent. (s. 16)

If a business called or messaged you through Dialora AI, ask that business first: it decides what happens to your data, and the workspace has the tools to find, export and erase it. If you do not know which business it was, write to privacy@aicall.vitrano.in with the number that contacted you and the date, and we will pass your request on. If you hold an account with us, write to the same address.

5. Data leaving your country

• Our servers are in Ahmedabad, India, so using the service moves data to India. Services a workspace connects with its own account, such as Twilio, Deepgram, ElevenLabs or a hosted AI model, are mostly in the United States.
• An organisation that transfers personal data out of Singapore must make sure the recipient protects it to a standard comparable to the PDPA, for example by a contract with legally enforceable obligations. (s. 26; Regulations Part 3)

Where each service is: sub-processor list. Terms for businesses: Data Processing Agreement.

6. If there is a breach

• As a data intermediary, we tell the workspace without undue delay after we have credible grounds to believe a breach of its data has happened. (s. 26C(3))
• The organisation assesses a suspected breach within 30 days. A breach is notifiable if it is likely to cause significant harm or affects 500 or more people; the PDPC must then be told within three calendar days of that assessment, and the people affected as soon as practicable where significant harm is likely. (ss. 26B, 26D; PDPC guide)

7. Complaints

• Write to us, or to the business that contacted you, first. You can also complain to the Personal Data Protection Commission. (PDPC)

8. Still open