01About this policy
Saibergard Pte. Ltd. (UEN 202425266M) (“Saibergard”, “we”, “us” or “our”) is committed to handling personal data responsibly and in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”) and its regulations.
If you are in Indonesia, section 17 also applies to you and sets out your rights under Indonesian law.
This Privacy Policy is our data protection notice. It explains how we collect, use, disclose, protect and retain personal data when you visit saibergard.com (the “Website”), contact us, or deal with us as a representative of a partner, vendor, customer or other organisation. It should be read with our Cookie Policy and Terms of Use.
“Personal data” has the meaning given in the PDPA: data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.
02Who we are
Saibergard Pte. Ltd. is a company incorporated in Singapore with its registered office at 59G Jalan Malu-Malu, Singapore 769674. We provide cybersecurity technology, engineering and testing services across Southeast Asia, working primarily through reseller partners. We are the organisation responsible for personal data collected through the Website and in the course of our business, unless we state otherwise.
03Business contact information
Much of the information we handle is business contact information, such as a person’s name, job title, business telephone number, business address and business email address, provided for business purposes. Under the PDPA, most data protection obligations do not apply to business contact information provided solely for business purposes. We nevertheless protect it to the same standard as other personal data described in this policy.
04Personal data we collect
We collect only personal data that is reasonably necessary for the purposes in this policy.
| Category | Examples | Source |
|---|---|---|
| Enquiry data | Name, company, work email address, country, phone number (optional), enquiry type and the content of your message. | You, through our contact form. |
| Business relationship data | Name, job title, organisation, business contact details, and records of correspondence and dealings. | You, your organisation, or our partners in the ordinary course of business. |
| Consent records | The consent wording you agreed to, and the date and time you agreed. | Created when you submit our contact form. |
| Security data | A one-way, salted cryptographic hash of your IP address, your browser’s user-agent string, the page you submitted from, and signals processed by our anti-bot check. | Collected automatically when you submit a form. |
| Aggregated analytics | Page views, referrers and performance measurements that do not identify you. | Collected automatically, without cookies. |
Please do not submit NRIC, FIN, Indonesian NIK or other national identification numbers, financial account details, health information or other sensitive personal data through the Website. We do not need it to respond to you, and if it is sent to us we delete it.
If you give us personal data about another person, such as a colleague, you confirm that you have their consent or are otherwise permitted under the PDPA to provide it to us for the purposes in this policy.
05Why we use personal data
We collect, use and disclose personal data for these purposes:
- to respond to your enquiry and route it to the right person in our team;
- to evaluate, establish and manage relationships with resellers, technology vendors, customers and other business contacts;
- to provide, administer and improve our services and the Website;
- to protect the security and integrity of the Website and our systems, including preventing spam, fraud and abuse;
- to keep records of consent and of our communications; and
- to comply with laws, regulations and the conditions of our licences, to respond to lawful requests from public authorities, and to establish, exercise or defend legal claims.
We will not use your personal data for a materially different purpose without first telling you and, where the PDPA requires, obtaining your consent.
06Consent and how to withdraw it
When you submit our contact form and tick the consent box, you consent to our collecting, using and disclosing your personal data for the purposes above. Where permitted, we may also rely on deemed consent or on an exception under the PDPA, for example where you voluntarily provide your details for an obvious purpose, or where the PDPA permits collection without consent.
You may withdraw your consent at any time by giving us reasonable notice through the channels in section 16. We will tell you the likely consequences of withdrawal, which may include our being unable to respond to your enquiry or to continue a business relationship, and we will stop collecting, using or disclosing your personal data for the affected purposes within a reasonable time. Withdrawal does not affect our ability to retain or use personal data where the law permits or requires it.
07Marketing messages
We do not use information submitted through our contact form to send marketing messages unless you have separately agreed to receive them. We do not send marketing messages to Singapore telephone numbers except in compliance with the Do Not Call provisions of the PDPA, and any marketing email complies with the Spam Control Act 2007, including clear labelling and an unsubscribe facility. Every marketing message we send will tell you how to opt out.
08Who we share personal data with
We do not sell personal data. We disclose it only where necessary for the purposes in this policy, to:
- service providers who process data for us, namely our website hosting, content delivery, database and security provider, our anti-bot verification service, our transactional email provider, and our business email and productivity provider;
- reseller partners, where you ask us to connect you with a partner in your market or where this is needed to respond to your enquiry;
- professional advisers, such as lawyers, auditors and insurers, who owe us duties of confidentiality; and
- regulators, law enforcement agencies, courts and other public authorities, where the law requires or permits it.
Our service providers are bound by written terms to protect personal data and to use it only to provide services to us.
09Transfers outside Singapore
Some of our service providers operate globally and may store or process personal data outside Singapore, including in the United States and in other countries where their data centres are located. Our partners and our Jakarta office are in Southeast Asia.
When we transfer personal data out of Singapore, we comply with the PDPA’s transfer limitation obligation. We take appropriate steps to ensure that the recipient is bound by legally enforceable obligations, such as contractual clauses, to protect the data to a standard at least comparable to the PDPA.
11How we protect personal data
We make reasonable security arrangements to protect personal data in our possession or under our control from unauthorised access, collection, use, disclosure, copying, modification or disposal, and from the loss of any storage medium on which it is held. These include:
- encryption in transit (HTTPS with HTTP Strict Transport Security) and encryption at rest within our providers’ platforms;
- a static website with no content management system or login page exposed to the internet, and a strict Content Security Policy;
- storing only a salted, one-way hash of IP addresses, never the addresses themselves;
- access to enquiry records limited to authorised staff, using multi-factor authentication; and
- keeping credentials and keys out of source code, in secured configuration only.
No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security.
12How long we keep personal data
We keep personal data only for as long as it serves the purpose for which it was collected, or as long as we need it for legal or business purposes. After that we delete it or anonymise it.
| Data | Retention |
|---|---|
| Hashed IP address and browser user-agent from form submissions | 90 days, then cleared automatically. |
| Enquiries that do not lead to a business relationship | 24 months from our last contact with you. |
| Business relationship records | For the duration of the relationship, then as long as required by law, which for accounting and tax records is generally five years. |
| Consent records and data protection requests | As long as we hold the related personal data, and for a reasonable period afterwards to show compliance. |
Copies of enquiries held in our email systems, including notification emails, follow the same periods. Each automated deletion is recorded in a deletion log.
13Access and correction
Subject to the exceptions in the PDPA, you may ask us:
- for access to personal data about you that is in our possession or under our control, and for information about how it has been used or disclosed in the year before your request; and
- to correct an error or omission in personal data about you that is in our possession or under our control.
We will respond to an access request as soon as reasonably possible and within 30 days. If we cannot do so within 30 days, we will tell you in writing within that period when we will be able to respond. We will correct personal data as soon as practicable and within 30 days. If we cannot do so within 30 days, we will tell you in writing within that period when we will be able to make the correction. We may charge a reasonable fee for an access request and will tell you the amount before we proceed. We may need to verify your identity before acting on any request. Shorter deadlines apply to individuals in Indonesia (see section 17).
14Accuracy
We make reasonable efforts to ensure that personal data we collect is accurate and complete, particularly where it is likely to be used to make a decision that affects you or to be disclosed to another organisation. Please tell us if your details change.
15Data breaches
We maintain a procedure to assess and respond to data breaches. If we assess that a data breach results in, or is likely to result in, significant harm to affected individuals, or is of a significant scale, we will notify the Personal Data Protection Commission as soon as practicable and in any case within three calendar days of that assessment. Where a breach is likely to result in significant harm to you, we will also notify you, unless an exception under the PDPA applies. For individuals in Indonesia, the notification timeline in section 17 applies.
16Data Protection Officer
Our Data Protection Officer is Tan Seng Fei. For any question, request (including access, correction or withdrawal of consent) or complaint about personal data, please contact our Data Protection Officer:
Email: dpo@saibergard.com
Online: use our contact form and choose Data protection request. These requests are routed to the Data Protection Officer, and you do not need to give a company name.
By post: Data Protection Officer, Saibergard Pte. Ltd., 59G Jalan Malu-Malu, Singapore 769674.
If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore.
17Individuals in Indonesia
If you are in Indonesia, or if our processing of your personal data has legal effect in Indonesia, we also process it in accordance with Law No. 27 of 2022 on Personal Data Protection (“UU PDP”) and its implementing regulations, including Government Regulation No. 33 of 2026 from its effective date of 16 January 2027. Where Indonesian law sets a stricter standard than the rest of this policy, we apply the stricter standard to your personal data.
Controller and contact
The controller is Saibergard Pte. Ltd., Singapore, which has an office presence in Jakarta. Our Data Protection Officer is Tan Seng Fei: dpo@saibergard.com, or our contact form (choose Data protection request).
Legal bases
Our dealings in Indonesia are business-to-business. We process the personal data of people who contact us or who represent our partners and customers on the basis of our legitimate interests in responding to enquiries and managing business relationships, steps taken at the request of you or your organisation before entering into a contract, the performance of a contract, and compliance with our legal obligations. We assess and document our legitimate interests to make sure they are balanced against your rights.
Your rights under UU PDP
- to obtain information about our identity, the legal basis and purpose of processing, and our accountability;
- to complete, update or correct inaccurate personal data;
- to access and obtain a copy of your personal data;
- to end processing and have your personal data deleted or destroyed;
- to withdraw your consent;
- to object to decisions based solely on automated processing, including profiling, that have legal effects or significantly affect you (we do not make such decisions);
- to suspend or restrict processing in proportion to its purpose;
- to obtain and use your personal data in a commonly used, machine-readable format, and to have it sent to another controller where technically feasible; and
- to claim compensation for violations of the processing of your personal data, in accordance with law.
Response times
We will act on a verified request to access or obtain a copy of your personal data, to correct it, to delete or destroy it, to withdraw consent, or to suspend or restrict processing within 3 × 24 hours of receiving it. Other requests are handled within the time Indonesian law requires.
Data breaches
If a failure of personal data protection affects your personal data, we will notify you and the personal data protection authority in writing within 3 × 24 hours, stating the personal data involved, when and how it was disclosed, and the steps we are taking to handle and recover from it. Where Indonesian law requires, we will also inform the public.
Transfers outside Indonesia
Personal data you submit is processed in Singapore and by our service providers in other countries, including the United States. We follow the order UU PDP requires. We transfer your personal data where the recipient’s country provides a level of protection equivalent to or higher than UU PDP. If it does not, we put adequate and binding safeguards in place. Only if neither is possible would we ask for your consent before the transfer. You may ask us for details of the safeguards we use.
Retention
The retention periods in section 12 apply. When they end, we delete or destroy your personal data and record each deletion or destruction in written minutes (berita acara pemusnahan), as Indonesian law requires.
18Visitors in other countries
The Website is operated from Singapore and is intended for business audiences in Southeast Asia. If you are in a jurisdiction other than Singapore or Indonesia, local data protection laws may give you additional rights. Contact our Data Protection Officer and we will handle your request in line with the law that applies to it.
19Minors
The Website is intended for business audiences and is not directed at individuals under 18. We do not knowingly collect personal data from minors through the Website.
20Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or the law. The current version, its version number and its effective date are always shown on this page. If a change is material, we will take reasonable steps to bring it to your attention.