This policy sets out the basis on which SUBQUERY PTE. LTD. (together with our subsidiaries, our holding company, or subsidiaries of our holding company from time to time, collectively “we”) collect Personal Data from you and how we process such data.

By using, visiting, accessing or registering to use, logging into the Platform found at our website at https://www.subquery.network/ (our “Website”), and/or any of its subdomains, and/or accessing any of the products or services available on our Website or the platform thereon (“Platform”), you accept the practices described in this policy whether you are a paying user or a non-paying visitor. You may not use the Website if you do not accept the terms of this Privacy Policy.

If you are located in the United Kingdom or the European Economic Area your attention is drawn to the section below headed “Additional information for users of our Website/Platform who are located in the United Kingdom or the European Economic Area”.

1. DEFINITIONS

In this Privacy Policy, unless the context otherwise requires, “Personal Data” means (a) data, whether true or not, about an individual who can be identified (i) from that data; or (ii) from that data and other information to which we have or are likely to have access, and (b) any other similar definition under any applicable Personal Data protection laws.

2. COLLECTION OF PERSONAL DATA

We may collect and process the following Personal Data that you give us. Information that you provide us (which may include your name, address, e-mail address, telephone number, credit card information, billing address, methods of payment used where payment is made through our Website, and other personal descriptions) by filling in forms on our Website, or by corresponding with us (by phone, email or otherwise), for example when you:

• register for an account with any of our applications on any subdomain;
• report any problem to us;
• use certain features on our Website;
• request any support from us;
• provide us with information via e-mail;
• complete any survey or questionnaire we send you;
• subscribe to our newsletters or mailing lists (if any);
• provide us with comments or suggestions;
• request for information about our Platform or services; or
• contact us via phone, email or other forms of communication.

We may collect and process the following Personal Data that we collect about you. Information automatically collected when you visit our Website, for example:

• technical information, including the Internet protocol (IP) address used to connect your computer to the Internet and your log-in information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
• details of any transactions, purchases and payments you made on our Website; and
• information about your visit, including the full Uniform Resource Locators (URLs), clickstream to, through and from our Website (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any phone number used to call our customer service number.

By visiting or using our Website/Platform or our services, you accept and acknowledge that we collect and process the above types of Personal Data and information.

3. COOKIES

Our Website uses cookies to distinguish you from other users of the Website. This helps us to provide you with a good experience when you browse our site and also allows us to improve our Website.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree to the use of cookies. Cookies contain information that is transferred to your computer's hard drive.

By continuing to browse the Website, you are agreeing to our use of cookies.

We use persistent cookies and session cookies. A persistent cookie stays in your browser and will be read by us when you return to our Website or a partner website that uses our services. Session cookies only last for as long as the session (usually the current visit to a website or a browser session).

We use the following cookies:

• Strictly necessary cookies - These are cookies that are required for the operation of our Website. They include, for example, cookies that enable you to log into secure areas of our Website, use a shopping cart or make use of e-billing services.
• Analytical/performance cookies - They allow us to recognise and count the number of visitors and to see how visitors move around our site when they are using it. This helps us to improve the way our Website works, for example, by ensuring that users are finding what they are looking for easily.
• Functionality cookies - These are used to recognise you when you return to our Website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

Cookies may be erased when you exit the Website or close the browser. Others are saved on your device for your next visit. You can delete all cookies placed by our Website on your device at any time. You can also set your browser to prevent all cookies from being placed by our Platform or to provide you with a warning before a cookie is placed. However, please note that some functionalities of the Platform may not work if all cookies are rejected. Please check your browser's instructions or help screen to learn more about these functions.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, which we do not have any control over. These cookies are likely to be analytical/performance cookies or targeting cookies.

4. USE OF YOUR INFORMATION

We may use your Personal Data for the following purposes:

• providing, operating and administering the Website, Platform and/or services, which shall include the maintenance, servicing and termination of any accounts registered with the Platform;
• improving, enhancing and developing our Website, Platform and/or services;
• researching, designing and launching new features or products;
• processing applications for the use of the Website, Platform and/or services, including the facilitation execution, or administration of any transaction(s) requested and/or authorised by you;
• managing, administering or presenting content and information on our Website, Platform and/or services in the most effective manner for you and for the device you use;
• providing you with alerts, updates, materials or information about our services or other types of information that you requested or signed up to;
• carrying out our contractual obligations arising from contracts entered into between you and us and for the enforcement of our legal or contractual rights;
• collecting overdue amounts;
• to verify your identity so as to ensure the safety and integrity of the transactions made through our Platform (including through any payment processor);
• to monitor electronic communications and calls for management quality control and training;
• where applicable, for complying with applicable local and foreign laws and regulations applicable to us in or outside of Singapore that may include the conduct of due diligence procedures for opening of accounts and ongoing monitoring purposes;
• where applicable, for legal and compliance purposes under applicable local and foreign laws that include the monitoring and compliance procedures that is in line with the internal risk management procedures, audit/financial accounting and for management reporting purposes;
• to comply with any applicable legislation, law, regulations, codes of practice, rules, including where information is to be disclosed to law enforcement agencies and other relevant authorities for investigations, crime prevention and detection purposes;
• to prevent and/or detect fraudulent behaviour or transactions or potential illegal or criminal activity as part of our efforts to keep our Platform safe and secure;
• responding or taking part in legal proceedings, including seeking professional advice;
• for direct marketing purposes (please see further details below);
• communicating with you and responding to your questions or requests;
• for internal operations, including troubleshooting and data analysis to learn about and understand the behaviour and preferences of users, testing, research, statistical and survey purposes to identify products or services which we might offer to existing and future users; and
• purposes directly related or incidental to the above.

We may use your Personal Data in direct marketing (i.e. offering or advertising products or services by sending the relevant information directly to you). In relation to direct marketing, where we are required to do so, we will obtain your consent before using your Personal Data for this purpose. If you prefer not to receive our direct marketing communications and/or not have your Personal Data shared among the members of our group for the purpose of marketing, you can have your name deleted from our direct marketing and/or shared information lists by clicking ‘unsubscribe’ at the footer of our emails or submit a request to us at privacy@network.

By visiting or using our Website/Platform or our services, you expressly accept and acknowledge that we collect, use and/or disclose the Personal Data we collect in the ways listed above.

If we need to collect, use and/or disclose your Personal Data for additional purposes, unless excepted by law, we will seek prior consent from you where you will be informed of the new purposes, and we will obtain your consent before such Personal Data will be collected, used and/or disclosed by us.

5. SECURITY

We will use technical and organisational measures to safeguard your Personal Data, for example:

• access to your account is controlled by a password of your choice and which you are responsible for maintaining the security of;
• all Personal Data you provide to us is stored on our secure servers;
• any payment transactions will be encrypted using TLS/SSL technology;
• where possible, any communications will be encrypted using TLS/SSL technology;
• we restrict access to Personal Data to our employees, service providers and contractors on a strictly need-to-know basis and ensure that those persons are subject to contractual confidentiality obligations; and
• We review our Personal Data collection, storage and processing practices from time to time to guard against unauthorised access, processing or use.

Where we have given you (or where you have chosen) a password that enables you to access certain parts of the Website, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

While we will use all reasonable efforts to safeguard your Personal Data, you acknowledge that the transmission of information via the Internet is not completely secure and for this reason we cannot guarantee the security or integrity of any Personal Data that is transferred from you or to you via the internet; any transmission is at your own risk.

In the event that there is a security breach involving your Personal Data, we will inform you of the incident as soon as practicable and in accordance with the relevant data protection laws.

6. DISCLOSURE OF YOUR INFORMATION

We will keep your Personal Data we hold confidential but you agree we may provide your Personal Data to:

• any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in Section 5 of the Companies Act (Chapter 50);
• employees, agents, advisers, auditors, contractors, financial institutions, and third party service providers in connection with our operations or services (for example staff engaged in the fulfilment of your order, the processing of your payment and the provision of support services);
• our overseas offices, affiliates, business partners and counterparts (on a need-to-know basis only);
• persons under a duty of confidentiality to us;
• persons to whom we are required to make disclosure under applicable laws and regulations in or outside of Singapore; or
• actual or proposed transferees of our operations (or a substantial part thereof) in or outside of Singapore.

We will also need to share your Personal Data if we are under a duty to disclosure or share it to comply with a legal obligations, in which case we will share your information with law enforcement agencies in connection with any investigation to help prevent unlawful activity.

We will also share your information with third parties in the event that:

• we sell or buy any business or assets, in which case we will disclose your Personal Data to the prospective seller or buyer of such business or assets (but only to the extent we need to, and always in accordance with data protection legislation) and/or
• if we or substantially all of our assets are acquired by a third party, in which case Personal Data held by us about our customers will be part of the assets transferred to such third party.

We process your Personal Data for this purpose because we have a legitimate interest to ensure our business can be continued by the buyer. If you object to our use of your Personal Data in this way, the relevant buyer of our business may not be able to provide services to you.

Where applicable, we will ensure that the Personal Data enjoys the same standards of protection as set out in this Policy.

If we transfer any of your Personal Data to a country or territory outside Singapore, or to our group or affiliates companies located outside Singapore, or to a permitted third party located outside of Singapore, we will only do so if we ensure that the overseas receiving party is bound by legally enforceable obligations to afford the transferred data a standard of protection that is comparable to that under Singapore law. We will also ensure that any overseas recipient is able to provide appropriate technical and organisational measures to protect your Personal Data and its confidentiality.

7. YOUR RIGHTS

You may withdraw your consent and request us to stop using and/or disclosing your Personal Data for any or all of the purposes listed above by submitting your request via email to our Data Protection Officer at the contact details provided below. We will endeavour to process your request within ten (10) business days from the day of receipt of your request, otherwise, we will provide you with the estimated time frame for us to carry out your request.

If you have consented or signed up to receive marketing materials, you may withdraw your consent at any time and request us to stop sending you marketing materials or to stop using your Personal Data for any other marketing activities by submitting your request via email to our Data Protection Officer at the contact details provided below. We will endeavour to process your request within seven (7) business days from the day of receipt of your request.

Please note that depending on the nature and scope of your request for withdrawal of consent, we may not be in a position to continue providing the Platform or our services to you. In our acknowledgement email to you upon your request for withdrawal of consent, we will inform you of the likely consequences of withdrawing consent.

If you do withdraw your consent, we will work with all relevant stakeholders such as data intermediaries and agents who have been authorised to collect, process or use your Personal Data to ensure that such relevant stakeholders also cease to collect, process or use your Personal Data.

You may have additional rights if you are located in the United Kingdom or the European Economic Area (see the section below headed “Additional information for users of our Website/Platform who are located in the United Kingdom or the European Economic Area”).

8. ACCESS

You may send our Data Protection Officer requests for:

• access to Personal Data which we hold about you; and/or
• access to information about the ways in which we use or disclose or may have used or disclosed your Personal Data for the year immediately preceding the date of your request.

Subject to unforeseen circumstances, any access request may be subject to a reasonable fee to meet our costs in providing you with details of the information we hold about you.

If we are unable to respond to your requests within thirty (30) days after receipt of your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to the request.

If you are in the United Kingdom or the EEA you should refer to the section below headed “Additional information for users of our Website/Platform who are located in the United Kingdom or the European Economic Area”.

9. RETENTION OBLIGATIONS

We will only retain and use Personal Data for as long as is required by law or for other legitimate business purposes including complying with our legal obligations, resolving disputes and enforcing our agreements.

We will ensure that your Personal Data is destroyed, remove them from our records, and/or ensure that it no longer contains personally identifiable information, as soon as it is reasonable to assume that:

• the purpose for which the Personal Data was collected is no longer relevant; or

• where you have deleted your account with us, whichever is later.

To determine the appropriate retention period for the Personal Data we hold, we will consider the amount, nature and sensitivity of the Personal Data, the risk of harm from unauthorised use or disclosure of your Personal Data, the reasons why we handle your Personal Data, whether we can achieve those purposes through other means, and the applicable legal requirements.

We may also anonymise your Personal Data so that it can no longer be associated with you, in which case we may retain and use this information indefinitely without further notice to you.

10. THIRD-PARTY SITES

Our Platform/Website or our communication with you may, from time to time, contain links to third-party websites and/or websites of our partner networks, advertisers, affiliates and third party service providers, over which we have no control.

If you follow a link to any of these websites, please note that they have their own practices and policies. We encourage you to read the privacy policies or statements of these websites to understand your rights. We accept no responsibility or liability for your access of third-party websites.

11. ACCURACY OF AND CORRECTION OF PERSONAL DATA

We will make reasonable efforts to ensure the accuracy and completeness of the Personal Data you provide to us and/or update your Personal Data associated with your account on the Platform. However, we also will require you to provide us with accurate, up-to-date and complete information. In order to ensure that the Personal Data that we maintain is accurate, you may send our Data Protection Officer at any time requests to update your information or for correction of errors or omissions in Personal Data which we hold about you.

We will generally not charge for correction requests, although we reserve the right to do so under unforeseen circumstances. If we are unable to respond to your requests within thirty (30) days after receipt of your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to the request.

If you are in the United Kingdom or the EEA you should refer to the section below headed “Additional information for users of our Website/Platform who are located in the United Kingdom or the European Economic Area”.

12. CHANGES TO OUR PRIVACY POLICY

We may amend this policy from time to time by posting the updated policy on our Website and/or Platform. Any changes that we make will be posted on this page and, where appropriate, notified to you by e-mail or post. You should check this policy frequently to ensure you are aware of the most recent version that will apply each time you access the Website/Platform. By continuing to use our Website/Platform after the changes come into effect means that you agree to be bound by the revised policy.

13. CONTACT US

If you have any questions, comments or requests regarding Personal Data, please address them to:

James Bayly – privacy@subquery.network (Data Protection Officer)

14. ADDITIONAL INFORMATION FOR USERS OF OUR WEBSITE/PLATFORM LOCATED IN THE UNITED KINGDOM OR EUROPEAN ECONOMIC AREA

If you are in the United Kingdom or European Economic Area the GDPR will apply to our use of your Personal Data. The “GDPR” means the EU General Data Protection Regulation which applies to the European Economic Area and the UK GDPR which applies in the United Kingdom.

For the purposes of the GDPR, SubQuery Pte. Ltd. is the controller of the Personal Data about you that we process. Please refer to Section 13 of this Privacy Policy for our contact details.

We only process your Personal Data where applicable law permits or requires it, including where the processing is necessary for the performance of our contract to provide services to you, where the processing is necessary to comply with a legal obligation that applies to us, for our legitimate interests or the legitimate interests of third parties, or (in a few cases) with your consent. Our legitimate interests include to administer and market our business, improve, enhance and develop our Website and Platform and provide customer support. Please contact our Data Protection Officer if you require more details of the lawful basis we use to process your Personal Data in the ways described in Section 4 of this Privacy Policy.

Subject to applicable law, you may have the following rights with regard to the Personal Data we control about you:

• The right to request confirmation of whether we process Personal Data relating to you, and if so, to request a copy of that Personal Data;
• The right to request that we rectify or update your Personal Data that is inaccurate, incomplete or outdated;
• The right to request that we erase your Personal Data in certain circumstances provided by law;
• The right to request that we restrict the use of your Personal Data in certain circumstances, such as while we consider another request that you have submitted (including a request that we make an update to your Personal Data);
• The right to request that we export your Personal Data that we hold to another company, where technically feasible;
• Where the processing of your Personal Data is based on your previously given consent, you have the right to withdraw your consent at any time; and/or
• In some cases, you may also have the right to object to the processing of your Personal Data.

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). We may however charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is to ensure that personal data is not disclosed to any person who has no right to receive it.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.