Privacy Policy

1. Controller

Dammar & Partners Pte. Ltd. (trading as Artyql)
160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914
Represented by E. Jasmin

Email: privacy@artyql.com | DPO: dpo@artyql.com

European Representative under Article 27 of GDPR

We have appointed EU Rep as our Representative under Article 27 of the EU General Data Protection Regulation (GDPR). All GDPR queries from EU data subjects or data protection authorities should be submitted to eurep.ie via their dedicated form. BizLegal Ltd trading as EU Rep have their registered office at 27 Cork Road, Midleton, Co. Cork, Ireland. Company number 635921.

2. Scope

This Privacy Policy applies exclusively to the artyql.io marketing website (landing page).

3. Data We Collect

3.1 Contact and Demo Request Form

Name, business email, company name, message. Transmitted via Google Apps Script to Google Sheets; notification to mail@artyql.com (CC: hello@artyql.com).

3.2 Demo Booking (Calendly)

Name, email, selected time slot. Calendly Inc. is a separate controller; see calendly.com/privacy.

3.3 Analytics (Google Analytics 4)

Via Google Tag Manager (GTM-KJSJRJ7K) and GA4 (G-GYJ26WCQ1J): IP address (anonymised), browser, device, pages visited, referral source, session duration. Google processes as processor on our behalf.

3.4 Spam Protection (reCAPTCHA Enterprise)

Hardware and software information sent to Google solely for spam prevention. Not used for personalised advertising.

3.5 Server Log Data

IP address, browser, OS, referrer, pages, date/time. Collected automatically by Vercel (EU edge nodes in Frankfurt and Dublin) for security.

4. Purposes and Legal Bases

Art. 6(1)(b) GDPR — Contract / Pre-contractual

Processing your demo request or contact form to respond to your enquiry.

Art. 6(1)(f) GDPR — Legitimate Interests

Website usage analysis (GA4) to improve the site. Security and abuse prevention (server logs, reCAPTCHA). Object at any time: privacy@artyql.com.

Art. 6(1)(a) GDPR — Consent

Analytics cookies. Collected via cookie banner before any non-essential cookies are set. Withdraw any time via “Manage Cookies” in the footer.

For Singapore (PDPA), Japan (APPI), Australia (Privacy Act 1988), New Zealand (Privacy Act 2020): respective consent and notification requirements apply.

5. Recipients

• Google LLC (USA) — GA4, GTM, reCAPTCHA Enterprise. Transfer: EU-US DPF + SCCs.
• Calendly LLC (USA) — Demo booking. Separate controller. Transfer: SCCs.
• Google LLC (USA) — Apps Script + Sheets for forms. Transfer: EU-US DPF + SCCs.
• Vercel Inc. (USA) — Hosting. Transfer: SCCs.

We do not sell personal data or share it for third-party marketing.

6. International Data Transfers

6.1 Primary Data Location

All primary data processing infrastructure is located within the European Union: database servers in Frankfurt, Germany (eu-central-1) and Dublin, Ireland (eu-west-1). No personal data is stored outside the EU/EEA by default.

6.2 Transfers to Third Countries

Certain service providers process data in the United States. Where personal data is transferred to a country outside the EU/EEA that has not received an adequacy decision from the European Commission under Art. 45 GDPR, we rely on the following safeguards pursuant to Art. 46 GDPR:

• Standard Contractual Clauses (SCCs) adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, using the appropriate module for each transfer relationship (Module 2: Controller-to-Processor for direct service providers; Module 3: Processor-to-Processor for sub-processor chains).
• EU-US Data Privacy Framework (DPF) under Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, where the US recipient is certified under the DPF (applicable to Google LLC and Vercel Inc.).
• Transfer Impact Assessments (TIAs) conducted for each transfer to evaluate the legal framework of the recipient country and determine whether supplementary measures are necessary, in line with the EDPB Recommendations 01/2020.
• Supplementary technical measures including encryption in transit (TLS 1.2+) and at rest, pseudonymisation where feasible, and contractual commitments by processors to challenge government access requests.

6.3 Transfer Basis per Provider

6.4 United Kingdom

For transfers from the UK, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as approved by the UK Information Commissioner under s.119A of the Data Protection Act 2018, in accordance with the UK GDPR (Art. 46).

6.5 Switzerland

For transfers from Switzerland, we rely on the SCCs as recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) under Art. 16 of the Swiss Federal Act on Data Protection (nFADP/DSG), with the modifications specified in the FDPIC guidance (Swiss entity treated as data exporter, FDPIC as competent supervisory authority, Swiss law as governing law for data subject claims).

6.6 Singapore

For transfers from Singapore, we comply with the transfer limitation obligation under Section 26 of the Personal Data Protection Act 2012 (PDPA), ensuring that the recipient provides a comparable standard of protection through legally binding obligations (contractual or otherwise) consistent with the PDPA.

6.7 Japan

For transfers from Japan, we comply with Article 28 of the Act on the Protection of Personal Information (APPI) and the Supplementary Rules under the APPI for Handling of Personal Data Transferred from the EU Based on an Adequacy Decision (PPC Supplementary Rules), including obtaining consent or ensuring equivalent protections at the receiving end.

6.8 Australia

For transfers from Australia, we comply with Australian Privacy Principle 8 (APP 8) of the Privacy Act 1988 (Cth), taking reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to the transferred information.

6.9 Copies and Enquiries

A copy of the applicable SCCs, TIAs, and sub-processor list is available upon request at privacy@artyql.com.

7. Retention

• Contact form: 24 months in Google Sheets.
• Demo bookings: Per Calendly’s retention policy.
• Analytics: 14 months (GA4 default).
• Server logs: 30 days (Vercel).
• reCAPTCHA: Per Google’s privacy policy.

8. Your Rights

Under GDPR (and UK GDPR, PDPA, APPI, Australian Privacy Act, NZ Privacy Act 2020):

• Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18), Portability (Art. 20), Object (Art. 21), Withdraw Consent, Lodge Complaint.

Contact: privacy@artyql.com | dpo@artyql.com. Response within one month.

9. Cookies

No advertising or retargeting cookies are used on this website.

10. Changes

Updates indicated by changing the effective date above. Current version always at this URL.

11. Contact

Dammar & Partners Pte. Ltd. (trading as Artyql)
160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914
Represented by E. Jasmin

General: hello@artyql.com | Privacy: privacy@artyql.com | DPO: dpo@artyql.com