Privacy Policy

1. About This Policy

This Privacy Policy explains how Ryse Cloud Pte. Ltd. ("Ryse Cloud", "Ryse", "we", "us", "our"), a company incorporated in Singapore, collects, uses, discloses, and protects personal data.

It is a single policy covering everything we do with personal data as a controller, across both our public website and our platform.

1.1 What this Policy covers

Where a section applies to only one of these contexts, it says so. Everything else applies to both.

1.2 What this Policy does not cover

Gift buyer data. When an Operator uses our platform to sell gift vouchers, the personal data of the people who buy or receive those vouchers is processed by us as a processor on behalf of that Operator, who is the controller. That processing is governed by the Data Processing Agreement at Schedule B of our General Terms & Conditions, not by this Policy. See section 8.

Hotel storefronts. Each Operator's gifting storefront publishes its own privacy notice, issued by that Operator. We are not the controller for data collected there, and this Policy does not apply to it.

Third-party sites. Our website and platform may link to third-party sites, including partner sites, industry publications, and social media platforms. We are not responsible for their privacy practices. Review their own policies before providing personal data.

2. Who We Are

Ryse Cloud Pte. Ltd. is the data controller for the personal data described in this Policy.

Registered address: 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051
UEN: 202611557W
Email: privacy@rysecloud.com

We are subject to the Personal Data Protection Act 2012 (Singapore) ("PDPA"). Where we interact with individuals in the European Economic Area or the United Kingdom, we also comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR as applicable.

2.1 Data Protection Officer

In accordance with section 11 of the PDPA, we have designated a Data Protection Officer responsible for our compliance with data protection law and for handling questions and complaints about how we use personal data.

Data Protection Officer: Matthew Howden, Chief Operating Officer
Email: privacy@rysecloud.com
Security incidents: security@rysecloud.com
Post: marked for the attention of the Data Protection Officer at our registered address above

3. Personal Data We Collect

3.1 Data you provide directly

Marketing site. When you use our contact form, request a demo, or use our ROI calculator:

• Identity data: your name
• Contact data: business email address, the name of your hotel, restaurant, or company, and (optionally, through the ROI calculator) your phone number
• Enquiry data: the subject and content of your message, the number of properties you operate, and the page you came from
• Business profile data: the answers you give in the ROI calculator, such as property type, room count, number of outlets, how you sell gifts today, and the volume of corporate orders
• Marketing preferences: your choices about hearing from us

Platform. When an Operator registers, or when Authorised Users are added to an account:

• Identity data: full name and job title
• Contact data: business email address and phone number
• Organisation data: company name, type, size, and registered address
• Credentials: username and hashed password, and access tokens for API integrations

3.2 Data collected automatically

Marketing site. Every time you visit, our hosting provider receives technical data needed to deliver the site to you (IP address, browser type and version, operating system, and the pages requested). If you accept analytics cookies, we also collect usage data (pages visited, time on page, links clicked, referring URL, device type, screen resolution, and approximate location). If you decline, usage data is not collected.

When you make a cookie choice, we keep a record of it. See section 10.

Platform. As you use the platform, we collect:

• Activity data: features accessed, actions taken (for example product uploads, storefront edits, order views), and timestamps
• Usage analytics data: how you navigate and use the platform, collected through our analytics provider and through our own server-side records
• Technical data: IP address, browser type and version, operating system, device identifiers, and session duration
• Log data: server-side access logs generated during use

3.3 Billing and subscription data

Platform only. Where an Operator has a paid subscription, we collect billing contact details (name, email, billing address) and payment method information. Payment details are processed securely by our payment providers. We do not store full payment card numbers.

3.4 Support and communications data

When you contact us by email, phone, or any other channel, we collect the content and metadata of those communications, including support ticket history, and any documents or files you share with us.

3.5 Data received from third parties

We may receive limited data from:

• Our customer relationship management (CRM) system: where you have previously interacted with us through another channel
• LinkedIn and other professional networks: where you engage with our content or connect with us professionally
• Commercial partners, referral agents, or resellers: where they introduce you to Ryse Cloud

We combine data received from third parties with data we already hold where this is consistent with the purpose for which it was originally provided.

3.6 If you do not provide your data

You do not have to give us any personal data to browse the marketing site. If you do not provide the details a form asks for, we may not be able to respond to your enquiry. Operators must provide account and billing data to use the platform, because we need it to set up and run the account under our contract.

4. How We Use Your Personal Data

We use personal data only for the purposes set out below, and only where we have a lawful basis to do so.

We will not use your personal data for purposes incompatible with those above without telling you first and, where required, obtaining your consent.

5. CRM and Lead Management

Where you submit an enquiry, request a demo, or register for the platform, your details are recorded in our CRM system. The CRM provider acts as a processor on our behalf and processes data only on our instructions.

We may enrich your contact record with publicly available professional information (such as your LinkedIn profile or company details) where this is relevant to our business relationship.

Our CRM provider is listed at rysecloud.com/subprocessors. Transfers to it are made on the basis described in section 9.

6. Marketing Communications

Where you have opted in, we may send you:

• Product updates, new feature announcements, and case studies
• Industry insight and editorial content relevant to hospitality technology and digital gifting
• Invitations to events, webinars, or product demonstrations

You may withdraw consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email, updating your preferences in your account settings (platform users), or emailing privacy@rysecloud.com.

We will action your request within 10 business days. Withdrawing consent does not affect the lawfulness of processing carried out beforehand, and does not stop service communications necessary for the operation of a platform account.

We will never sell your personal data, and we will never share it with third parties for their own marketing purposes.

7. Sharing Your Personal Data

We share personal data only where necessary and only with parties bound by appropriate data protection obligations.

7.1 Service providers

We use service providers who process personal data only as we instruct, under written data processing agreements, except where a provider acts as an independent controller for its own regulatory purposes (for example, payment providers carrying out fraud prevention and anti-money-laundering checks).

Platform. We use service providers to host the platform, support and develop it, run our CRM, process payments, analyse usage, deliver email, and provide in-app help. The current list of these providers, what each does, the data it handles, the countries in which it processes or accesses personal data, and which of them act as independent controllers, is published at rysecloud.com/subprocessors. That page is the single, authoritative list for the platform. It is updated as our arrangements change, and this Policy does not repeat it.

Marketing site. We use service providers for the following purposes:

• hosting and delivering the website
• analysing how visitors use the website, if you accept analytics cookies
• delivering the enquiries you send through our website forms to our inbox
• storing records of cookie choices
• managing leads in our CRM

Some of these providers are based in, or process data in, the United States.

7.2 Professional advisors

We may share data with our lawyers, accountants, auditors, or insurers where necessary to obtain professional advice or to protect our legal rights.

7.3 Law enforcement and regulators

We may disclose personal data to courts, regulators, or law enforcement agencies where required by applicable law, or where necessary to protect the rights, property, or safety of Ryse Cloud, our customers, or others. Our approach to government access requests is described in section 9.1.

7.4 Business transfers

In the event of a merger, acquisition, investment, or sale of our business or assets, personal data may be transferred to the relevant successor entity. We will notify affected parties where practicable and ensure the successor provides equivalent data protection commitments.

We do not sell personal data.

8. Gift Buyer Data: Where We Act as Processor

When Operators use the platform to process personal data relating to gift buyers, Ryse Cloud acts as a processor and the Operator is the controller.

Gift buyer data (such as names, email addresses, and transaction records) is processed strictly in accordance with the Operator's instructions and the Data Processing Agreement at Schedule B of our General Terms & Conditions.

This Policy does not apply to that data. Operators are responsible for having a valid legal basis to collect and process it, and for ensuring their storefronts publish an appropriate privacy notice.

If you bought or received a gift voucher and want to exercise your rights, contact the hotel or restaurant that issued it. If you contact us instead, we will pass your request to them.

9. International Transfers

Ryse Cloud is incorporated in Singapore and operates a global platform.

Platform data is hosted in Singapore. Our marketing website is served through a global content delivery network. Some of our service providers, and some of our team, process or access personal data from other countries, including the United States. The countries for each platform provider are listed at rysecloud.com/subprocessors, and we may add or change them as we expand.

Using our website and platform therefore involves transfers of personal data across borders on an ongoing basis. Where we transfer personal data internationally, we put appropriate safeguards in place:

• EEA and UK personal data. We rely on the Standard Contractual Clauses approved by the European Commission and, for UK transfers, the UK International Data Transfer Addendum issued by the Information Commissioner's Office.
• United States. Transfers are made on the basis of the Standard Contractual Clauses. Where a provider is self-certified under the EU-U.S. Data Privacy Framework or its UK Extension, we treat that certification as an additional safeguard rather than as the basis for the transfer. Our transfers therefore remain lawful even if a Data Privacy Framework adequacy decision is later withdrawn or invalidated.
• Singapore personal data. We comply with the cross-border transfer requirements of the PDPA, including by ensuring through legally enforceable obligations that recipients provide a standard of protection comparable to that under the PDPA.
• Adequate countries. Where a country has been recognised as providing an adequate level of protection, we may rely on that recognition.

You can ask our Data Protection Officer for a copy of the safeguards that apply to a transfer of your data.

Before transferring personal data to a country not subject to an adequacy decision, we assess whether local laws and practices would prevent the recipient from meeting its obligations, and apply supplementary technical, organisational, or contractual measures where needed.

9.1 Government and law enforcement access

If we receive a legally binding request from a public authority for access to personal data, we will notify the affected party unless prohibited from doing so, challenge the request where there are reasonable grounds to consider it unlawful, and disclose only the minimum data necessary. We do not grant any public authority direct, unrestricted, or bulk access to personal data.

10. Cookies and Tracking Technologies

Cookies are small text files placed on your device when you visit a website. They let a site recognise your browser and remember information between visits. We also use similar technologies, such as local storage, in the same way.

10.1 Marketing site (rysecloud.com)

A cookie banner appears on your first visit and lets you accept or decline analytics cookies. Analytics only load if you accept. If you decline, they do not run. You can change your choice at any time by reopening the cookie preferences from the site footer, or through your browser settings.

When you make a choice, we record it so that we can show we respected it. The record holds your choice, a random identifier stored in your browser, the version of this notice you saw, your browser's user agent, the country your connection came from, and a one-way hash of your IP address. We do not store your IP address itself.

10.2 Platform (ryse.today)

The platform uses:

• Strictly necessary cookies, to maintain your authenticated session, protect forms against misuse, and enable secure API interactions. These do not require consent.
• Functional cookies and similar storage, to remember settings you choose, such as display preferences. They support features you have asked for and are not used to track you.
• Analytics cookies, to understand how the platform is used so that we can improve it. Where the law requires it, including for users in the European Economic Area and the United Kingdom, we ask for your consent before analytics load, and they do not run if you decline.

We do not use any other tracking on the platform.

We do not use third-party advertising or marketing cookies on the website or the platform.

You can block or delete cookies through your browser settings, though doing so may prevent parts of the website or platform from working. For more information, visit www.allaboutcookies.org.

11. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, and in compliance with applicable legal requirements.

Unless the table says otherwise, retention periods run from the later of the date the data was collected and the date the relevant relationship ended. Data deleted from live systems remains in backups until the backup cycle expires.

Retention of gift buyer data, where we act as processor, is governed by the Data Processing Agreement at Schedule B of our General Terms & Conditions rather than by this table.

When personal data is no longer required, it is securely deleted or anonymised.

12. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit (TLS 1.2 or higher) and at rest
• Role-based access controls limiting data access to authorised personnel
• Multi-factor authentication for administrative access to production systems
• Logging and monitoring of access to our systems
• Regular security reviews and vulnerability assessments

Operators are responsible for the security of their own account credentials and for ensuring Authorised Users follow appropriate security practices.

No method of transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. If you become aware of any unauthorised access to your account, notify us immediately at security@rysecloud.com.

12.1 If a data breach occurs

If a breach affecting personal data for which we are the controller occurs, we will:

• notify affected Operators without undue delay once we have established that a breach has occurred and assessed its likely scope;
• notify the Personal Data Protection Commission, and where applicable the relevant EEA or UK supervisory authority, where the breach is notifiable and within the statutory deadlines;
• notify affected individuals directly where the breach is likely to result in significant harm or a high risk to their rights and freedoms; and
• tell you what happened, what data was involved, what we are doing about it, and what steps you should take.

Breaches affecting gift buyer data, where we act as processor, are handled under the Data Processing Agreement at Schedule B, which requires us to notify the Operator so that the Operator can meet its own regulatory obligations.

13. Your Rights

Depending on your location and applicable law, you may have the following rights in relation to your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate or incomplete data
• Erasure: request deletion of your data where we no longer have a lawful basis to retain it (some data may be retained for legal or contractual reasons)
• Restriction: request that we restrict processing while a concern is being resolved
• Portability: receive your data in a structured, machine-readable format (where applicable under the GDPR or equivalent law)
• Objection: object to processing based on legitimate interests, including direct marketing
• Withdrawal of consent: withdraw any consent given, without affecting prior processing

To exercise any of these rights, contact our Data Protection Officer at privacy@rysecloud.com.

We will respond within 30 days. Where a request is complex, or where we have received a number of requests from you, we may extend that period by up to a further two months as permitted under the GDPR and UK GDPR, and we will tell you within the first 30 days if we need to do so and why. We may need to verify your identity before proceeding. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.

13.1 Legitimate interests

Where we rely on legitimate interests as our lawful basis, we have assessed that our interests are not overridden by your interests, rights, and freedoms. You may request a summary of that assessment from our Data Protection Officer.

13.2 Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not use your personal data for profiling of that kind. If this changes, we will update this Policy and tell you before the change takes effect.

13.3 Complaints

If you are not satisfied with our response, you may complain to a supervisory authority:

• Singapore: Personal Data Protection Commission
• United Kingdom: Information Commissioner's Office
• EEA: the data protection authority in the country where you live, work, or where you believe the issue arose

We would ask you to raise the matter with us first so that we have the opportunity to put it right.

14. Children

Our website and platform are intended for business professionals and are not directed to anyone under the age of 18. We do not knowingly collect personal data from individuals under 18. Operators are responsible for ensuring that Authorised Users they add are at least 18.

If you believe a child has submitted personal data to us, contact privacy@rysecloud.com and we will delete it promptly.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, services, legal requirements, or other factors. Where changes are material, we will post a notice on our website and notify affected Operators by email. The date at the top of this document shows when it was last updated.

The list of platform service providers at rysecloud.com/subprocessors is maintained separately and may change between updates to this Policy.

This Policy explains how we handle personal data. It is a notice rather than a contract, so it is not something you agree to. Where a change to our practices requires your consent, we will ask for it separately before making the change. Your rights under section 13 are unaffected by any update.

Where this Policy forms part of a signed agreement with an Operator, the revision provisions of that agreement apply in addition.

16. Contact Us

For any questions, concerns, or requests relating to this Policy or the processing of your personal data, contact our Data Protection Officer:

Ryse Cloud Pte. Ltd.
Data Protection Officer: Matthew Howden, Chief Operating Officer
Email: privacy@rysecloud.com
Security incidents: security@rysecloud.com
Address: 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051
UEN: 202611557W