Introduction
This Privacy Policy explains how AAXPY Private Limited collects, uses, stores, shares and protects personal information when you visit our website, contact our team, or engage us for data parsing and computer integrated systems design work. The policy has been prepared by the developer Aaxpy and the internal privacy working group, and it is reviewed at least once each year or whenever a material change occurs in our services, our suppliers or the law that applies to us.
AAXPY Private Limited is a company registered and operating in Singapore. Our registered place of business is 152 Beach Road, #23-02 Gateway East, 189721, Singapore (SG). We run a parse workbench from that address, and the same desk is responsible for the privacy questions described in this document. You can reach the team by email at ask@aaxpy.lol or by telephone at +19085760212 during our stated business hours.
We have written this policy in plain English on purpose. Data protection notices are often long and legalistic, and that style tends to hide rather than reveal what actually happens. This document is long because our work touches many kinds of records and we would rather describe each of them honestly than compress everything into a single vague paragraph. If any part of it remains unclear after reading, please write to us and we will explain the point in direct language.
The policy applies to the website published at aaxpy.lol and to the professional services we deliver to clients. It does not replace any contract we sign with a client. Where a written services agreement contains stricter privacy terms than this policy, those stricter terms apply to the work described in that agreement. Where this policy is more protective than a contract in a matter not covered by the contract, this policy applies to our handling of personal information.
Who Controls Your Data
For the purposes of applicable data protection law, AAXPY Private Limited is the controller of personal information that we collect directly from visitors, prospective clients, suppliers and other individuals who deal with us. As controller, we decide why the information is collected and how it is used, and we remain accountable for those decisions even where a supplier carries out a technical task on our behalf.
In some engagements we act as a processor rather than a controller. This happens when a client sends us personal information inside a data feed and asks us to parse, map or validate it. In that situation the client decides the purpose and the permitted scope, and we act only on documented instructions. If you are an individual whose information appears inside a client feed, your request should normally be directed to that client first, because the client holds the relationship with you. We will still assist the client in responding, and we will forward your message to the client where appropriate.
Our privacy contact is reachable at ask@aaxpy.lol. Postal correspondence may be addressed to AAXPY Private Limited, 152 Beach Road, #23-02 Gateway East, 189721, Singapore (SG). Please mark privacy requests clearly in the subject line so they reach the correct person promptly.
Scope of This Policy
This policy covers personal information processed through our website, through email and telephone contact, through proposals and contracts, through our parse workbench when we operate it as a controller, and through general business administration. It does not cover information that a client processes inside its own systems after we have delivered a pipeline or a mapping ledger, because that processing is governed by the privacy notice of the client.
The policy does not cover anonymised or aggregated information that can no longer be linked to an identifiable individual. We may create aggregated statistics about the performance of a pipeline, the volume of records processed, or the frequency of errors, and such statistics are used for service improvement without restriction because they do not identify anyone.
We do not knowingly operate consumer facing products, and we do not run advertising networks. Our processing is professional and business oriented, but the individuals whose information appears in the records we handle are still entitled to protection, and this policy treats that entitlement seriously.
Information We Collect
We collect information in several distinct ways, and the categories differ depending on whether you are a website visitor, a client contact, a supplier contact, or an individual whose record arrives inside a feed. The following subsections describe each category in turn.
Information you give us directly
When you complete the contact form on our website, send us an email, telephone our desk or meet our team, you may provide your name, job title, employer, email address, telephone number, postal address and the content of your message. If you are discussing a project, you may also provide details about your organisation, your systems, your data sources and your commercial requirements. We keep this information because it is necessary to answer you and to decide whether we can help.
Information generated by your visit
When you browse our website, our hosting infrastructure records standard technical information such as the internet protocol address of the requesting device, the browser type and version, the operating system, the referring page, the pages requested and the time of each request. This information is used to keep the site available, to diagnose faults and to detect abusive traffic. We do not use it to build behavioural advertising profiles.
Information inside client feeds
Our work sometimes involves parsing feeds that contain personal information about third parties, such as customer records, employee records, patient administration records or applicant records. We treat all such information as confidential client data. We collect it only in the form and to the extent the client supplies it, we process it according to the client instructions, and we do not use it for our own purposes. Where a feed can be delivered without personal information, we encourage clients to reduce or pseudonymise it before transfer, and we are happy to advise on how to do that without undermining the parse.
Information from other sources
We may receive limited information about you from your colleagues, from public professional profiles, from company registries and from event organisers who introduce us. We use such information only to understand the business context of an enquiry and to respond appropriately. We do not purchase marketing lists and we do not use scraped contact data for unsolicited outreach.
How We Use Information
We use personal information for clearly defined purposes that a reasonable person would expect in a professional services relationship. Those purposes include responding to enquiries, preparing proposals, delivering contracted work, maintaining records of decisions, securing our systems, meeting legal obligations and improving the reliability of our services.
More specifically, we use contact details to reply to messages and to arrange meetings. We use project information to scope a piece of work, to write a findings note, to build and test a pipeline, and to record the mapping decisions that support it. We use technical logs to monitor availability, investigate incidents and prevent misuse of our infrastructure. We use billing and contract information to issue invoices, satisfy accounting rules and resolve disputes.
We do not sell personal information. We do not rent contact lists. We do not use information from a client feed to market our services to the individuals whose records appear in that feed. We do not use personal information to train general purpose machine learning models, and we do not share client data with model providers for that purpose.
Where we wish to use information for a purpose that is genuinely new and not described in this policy, we will either obtain consent or rely on another lawful basis, and we will update this document before the new use begins.
Legal Bases for Processing
Different legal systems describe lawful grounds in different language, so this section names the common bases and explains when each is used. In Singapore, the Personal Data Protection Act provides a set of grounds including consent, the performance of a contract, legitimate interests and compliance with law. In other jurisdictions where we operate or where a client requires it, similar concepts apply under different names.
We rely on consent where you have clearly given it, for example when you ask to receive occasional service notes by email. You may withdraw consent at any time, and withdrawal does not affect processing that already took place on that basis.
We rely on the performance of a contract where processing is necessary to deliver services you or your organisation have engaged us to perform, or to take steps at your request before a contract is formed. We rely on compliance with a legal obligation where we must retain records for tax, corporate or regulatory purposes.
We rely on legitimate interests where processing supports the secure and efficient operation of our business in a way that does not override your rights. Examples include protecting our infrastructure from abuse, maintaining audit trails of mapping decisions and responding to a business enquiry that you initiated. We carry out a balancing assessment before relying on this basis and we record the conclusion.
Service Providers and Subprocessors
We use a small number of service providers to run our business. These include a web hosting provider, an email service provider, a cloud infrastructure provider for client environments where the client has approved one, and standard office productivity tools. Each provider is selected with security and privacy in mind, and each is bound by a written agreement that limits its use of information to the task we have asked it to perform.
Where a provider processes personal information on our behalf, we require it to apply appropriate technical and organisational measures, to notify us promptly of any incident, to assist us in responding to individual requests, and to delete or return information at the end of the engagement. We review the list of providers at least once each year and whenever a new provider is added to a client engagement.
Some clients require approval of every subprocessor before data is transferred. We accommodate that requirement by supplying a written subprocessor list during onboarding and by notifying the client before any change that affects their environment. If a client objects to a new subprocessor on reasonable grounds, we will work with the client to find an alternative or to keep the affected data outside that provider.
International Transfers
Our team works from Singapore, and our infrastructure may be located in Singapore or in another jurisdiction chosen to suit a client requirement. When personal information moves across borders, we take steps to ensure that the protection travels with it.
Where we transfer information to a country that does not have an adequacy finding recognised by the relevant authority, we rely on appropriate contractual clauses, binding corporate commitments or another lawful transfer mechanism. We assess the legal environment of the destination, including the risk of government access, and we apply supplementary measures where the assessment indicates a gap.
For client environments, the location of processing is recorded in the pipeline runbook, so the client always knows where its data is handled. If a client requires data to remain in a particular jurisdiction, we will design the engagement around that constraint rather than work around it later.
Retention of Information
We keep personal information only for as long as we need it for the purpose that justified collection, or for as long as the law requires. Retention periods differ by category because the underlying obligations differ.
Enquiry and correspondence records are normally kept for up to two years after the last meaningful exchange, so that we can pick up a conversation that resumes after a pause and answer questions about what was discussed. Contract and billing records are kept for the period required by accounting and corporate law, which in Singapore is normally at least five years after the end of the relevant financial year.
Project artefacts that contain client data, including sample payloads, mapping ledgers and harness fixtures, are retained for the duration of the engagement and for a short warranty period afterwards. Where the contract requires return or deletion at a set point, we follow the contract. Where no period is specified, we review the artefacts each year and delete anything that is no longer required to deliver or defend the work.
Technical logs are kept for a short rolling period unless an incident requires longer preservation. When a retention period ends, information is deleted from primary systems and from routine backups on the normal backup cycle, and any remaining copies are removed when the backup media is retired.
Security Measures
We treat the security of client and personal information as a core part of our professional duty. Our measures are proportionate to the sensitivity of the information and to the risk of harm if it were lost or misused.
Access to project environments is limited to named engineers who need it, protected by individual accounts, strong authentication and separation between production and staging. Personal information inside feeds is processed only in approved environments, and we favour encryption in transit and at rest where the platform supports it. Secrets and credentials are stored in a managed vault rather than in source code.
We keep logs of administrative access to client environments, we review those logs during normal operations, and we retain the records needed to investigate an incident. Engineers are briefed on handling rules at onboarding and whenever a material change occurs in our practices. We do not allow client data to be copied to personal devices unless the client has approved the practice in writing and the device is managed.
No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to individuals, we will notify the affected client without undue delay, and we will notify the relevant authority and the affected individuals where the law requires it. Our notice will describe what happened, what we have done to contain it, and what we recommend the client do next.
Your Rights
Subject to the conditions set by applicable law, you may have the right to be informed about how your personal information is used, to request access to the information we hold about you, to ask us to correct information that is inaccurate, and to ask us to delete information that we no longer have a lawful reason to keep.
You may also have the right to restrict or object to certain processing, to withdraw consent where consent is the basis, to receive a portable copy of information you provided to us, and to lodge a complaint with a supervisory authority. The exact rights available depend on where you live and on which law applies to the particular processing.
To exercise a right, write to ask@aaxpy.lol with enough detail for us to identify you and understand the request. We may ask for reasonable proof of identity to protect against impersonation. We will respond within the period required by law, and where a request is complex we will tell you if we need more time and explain why.
There is normally no charge for a request, though we may charge a reasonable fee where the law permits and the request is manifestly unfounded or excessive. If we refuse a request, we will explain the reason and tell you how to complain or appeal.
If your information arrived inside a client feed, we will forward your request to the client where the client is the controller, and we will assist the client in responding. We will tell you that we have done so, unless the law prevents us.
Privacy for Children
Our services are designed for organisations, and our website is not directed at children. We do not knowingly collect personal information from anyone under the age of sixteen through our public pages or through our general business correspondence.
Some client feeds may contain records about minors, for example in education or healthcare administration. When that happens, we process the records strictly on the instructions of the client, under the client responsibility for having a lawful basis to share them with us. We apply the same confidentiality and security controls to those records as to any other client data, and we restrict access to the smallest group of engineers needed for the work.
If you believe that a child has provided personal information to us directly, please contact ask@aaxpy.lol so that we can investigate and, where appropriate, delete the information promptly.
Marketing Communications
We send occasional service notes to people who have asked for them, and we may follow up once with a business contact who has expressed interest in a specific piece of work. We do not send bulk marketing campaigns to purchased lists.
Every marketing message includes a way to opt out, and we honour opt out requests promptly. Opting out of marketing does not affect messages that are necessary to deliver a service you have engaged, to administer a contract, or to respond to a question you have asked.
Automated Decision Making
Our parse workbench uses automated rules to validate, transform and route records. These rules support operational work such as detecting a schema mismatch, rejecting a malformed record or raising an alert when a freshness threshold is crossed. They do not make decisions that produce legal effects about individuals, and they do not profile people for marketing or credit purposes.
Where a client asks us to implement a rule that could affect an individual in a significant way, we require the client to confirm that a human review step exists in the client process. We are willing to document the logic of a rule so that the client can explain it to an affected person, and we will not implement a hidden scoring mechanism that the client cannot describe.
Third Party Sites
Our website may link to external sites, such as a client website, a professional body or a documentation resource. We do not control those sites, and their privacy practices may differ from ours. This policy applies only to information processed by AAXPY Private Limited.
We encourage you to read the privacy notice of any external site before providing personal information to it. If you reach a third party site through a link from us and believe that site is misrepresenting a connection with AAXPY Private Limited, please tell us so that we can review the link.
Changes to This Policy
We review this policy at least once each year and whenever a change in our services, our suppliers or the law makes an update necessary. When we make a material change, we will update the effective date shown in this document and, where appropriate, notify active clients by email.
Minor clarifications that do not change how information is used may be published without individual notice. The current version is always the one available on our website, and we keep previous versions for reference so that a question about an earlier period can be answered accurately.
If a change would significantly affect how we use information already collected, we will give you a reasonable opportunity to object before the new use begins, unless the law requires the change to take effect immediately.
How to Contact Us
Questions, requests and complaints about privacy should be sent to ask@aaxpy.lol. You may also telephone the desk on +19085760212 during business hours, which are Monday to Friday from 09:00 to 18:00 Singapore time.
Postal correspondence may be addressed to AAXPY Private Limited, 152 Beach Road, #23-02 Gateway East, 189721, Singapore (SG). Please include your contact details and a short description of the matter so that we can route it to the right person without delay.
If you are not satisfied with our response, you may lodge a complaint with the data protection authority in your jurisdiction or, in Singapore, with the Personal Data Protection Commission. We will cooperate fully with any such authority.
Governing Law
This policy is governed by the laws of Singapore. Where a client contract specifies a different governing law for the processing of client data, that contract prevails for the work it covers, and this policy applies in a supporting role.
We aim to resolve any concern directly and early. Before starting formal proceedings, please contact us so that we have a fair opportunity to understand the issue and put it right.