Privacy policy.

1. Who we are

SAVVYTECH is IT Manager as a Service, operated by [legal entity name], registered in Singapore at [registered address]. In this policy “we” and “us” mean that company.

This policy covers both this marketing site and the SAVVYTECH platform at app.savvytech.ai. Where the two differ, we say so.

2. What we collect

If you only visit this site

Nothing, unless you send us something. This site has no analytics, no advertising pixels and no tracking of any kind — see cookies and tracking below.

If you complete a form on the contact page, we receive exactly the fields you filled in: your name, work email, company, an indication of headcount, and whatever you wrote in the message. Vendor enquiries also include a category. That is the whole list — the form sends what you can see and nothing else.

If your company uses the platform

Running an IT helpdesk and asset register means we hold operational records on your behalf:

• People — names, work email addresses and roles of your staff, so tickets have an owner and a requester.
• Tickets — what was raised, by whom, the correspondence on it, and how it was resolved.
• Assets and licences — devices, software subscriptions, telco and cloud services, seat counts and renewal dates.
• Contracts and vendors — agreements, contacts, quotes and performance records for the suppliers you work with.
• Usage and spend — what is being used and what it costs, which is what makes cost reviews and the health score possible.
• Access and audit records — who did what in the platform, kept for security.

Your company is the controller of that data and we process it on your instructions. [Confirm: is a separate data processing agreement offered, and is it referenced here?]

3. Why we hold it

• To reply to you. Enquiry details are used to answer the enquiry, and for nothing else. We do not add you to a mailing list unless you ask.
• To provide the service. Tickets, assets and contracts exist because that is the product.
• To report to you. The monthly report and the health score are built from your own operational data.
• To keep the platform secure. Access and audit records exist so we can investigate if something goes wrong.
• To meet legal obligations. Billing and tax records, where we are required to keep them.

Under Singapore’s Personal Data Protection Act we rely on your consent, and on the exceptions that allow processing necessary to provide a service you have asked for. [Confirm with counsel which PDPA bases are being relied on.]

4. Who else sees it

We do not sell personal data. It is shared only in these cases:

• Vendors you deal with. When a ticket or a quote goes to one of your suppliers through the Vendor Portal, that supplier sees what is needed to do the job — not your wider register.
• Our subprocessors. Hosting, email delivery and support tooling. [List the subprocessors, or link to a page that does.]
• Where the law requires it, or to protect the safety or rights of someone.
• If the business is sold or reorganised, in which case this policy travels with the data.

5. How long we keep it

• Enquiries — [retention period] after the last contact, unless they become an account.
• Account and operational data — for as long as your subscription runs, and then [retention period] so it can be recovered if you come back.
• Billing records — as long as Singapore tax and company law requires.
• Backups — deleted data can survive in backups for [backup retention] before rotating out.

You can ask us to delete your account data sooner. See your rights.

6. Where it is stored

We are based in Singapore and serve Singapore and Southeast Asia. Platform data is hosted in [region / provider]. Where data moves outside Singapore, we take the steps the PDPA requires to make sure it is protected to a comparable standard. [Confirm hosting region and transfer mechanism.]

7. Cookies and tracking

This marketing site sets no cookies. There is no analytics, no advertising or social pixel, and nothing is written to local or session storage. There is no cookie banner because there is nothing to consent to.

One third party is involved: the site loads its typefaces from Google Fonts, which means Google receives the IP address of anyone who loads a page. If that is not acceptable, the fonts can be self-hosted — it is a small change.

The platform at app.savvytech.ai does use cookies, because it has to keep you signed in. [Describe the platform’s cookies, or link to its own notice.]

8. Your rights

Under the PDPA you can ask us to:

• Tell you what we hold about you, and how it has been used or disclosed in the past year.
• Correct anything that is wrong.
• Withdraw your consent, which we will action — though it may mean we can no longer provide part of the service.
• Delete data we no longer have a reason to keep.

If you are a member of staff at a customer company, ask your own company first — they control that data and we act on their instructions. We will help them respond.

We will respond within [response time] of a verified request.

9. Contact and complaints

Write to enquiry@savvytech.ai, or to our data protection officer at [DPO name and email].

If we have not resolved something to your satisfaction you can complain to Singapore’s Personal Data Protection Commission.

If this policy changes we will update the date at the top of the page, and tell customers directly if the change is significant.