Privacy Policy

It is important to distinguish between Personal Data (protected under the PDPA) and Corporate Data (protected by contractual confidentiality).

• Corporate Data: Information pertaining strictly to corporate entities — including ACRA company profiles, statutory resolutions, corporate filings, and entity UENs — is governed by strict contractual confidentiality under our Terms of Use.
• Personal Data: The PDPA protects data relating to an identifiable natural person. Personal identification details embedded within corporate dockets (such as director NRIC numbers, passport copies, residential addresses, and dates of birth) remain Personal Data governed by the PDPA.

Under the PDPA, Business Contact Information (BCI) (e.g., name, work title, business email, business phone) provided solely for business communications is exempt from consent requirements. However, corporate secretarial and accounting operations necessitate processing non-BCI personal data.

• Business Contact Information (BCI): We collect staff and client contact details for authentication, communications dispatch, and role-based access control (RBAC).
• Statutory Compliance & KYC Data: We process director/shareholder identity documents, NRICs, passport particulars, and proof of address under the Legal and Regulatory Compliance Exception (PDPA Second Schedule) and Legitimate Interests Exception, pursuant to obligations under the Singapore Companies Act 1967 and the Corporate Service Providers Act 2024.
• Automated Processing Data: Inbound communications (WhatsApp, email) and document attachments are processed for automated classification, draft compilation, and audit trail generation.

Tokatos operates primarily as a Data Intermediary processing data on behalf of professional Firms (the Data Controllers).

• Statutory Mandate: The collection and verification of officers' and controllers' identities are legally required by ACRA and Singapore anti-money laundering (AML/CFT) laws.
• Contractual Necessity: Processing of client staff and director contact information is necessary to deliver statutory document execution, AGM notices, and annual filing approvals pursuant to Section 15A of the PDPA.
• Deemed Consent by Notification: Where applicable for operational reminders and service communications, deemed consent applies pursuant to Section 15B of the PDPA.

• Sovereign Data Storage: All primary databases and document vaults are hosted exclusively in Google Cloud Platform, Singapore region (asia-southeast1).
• Encryption: Data is encrypted at rest using AES-256 and in transit using TLS 1.3.
• Tenant Isolation: Database-level Row-Level Security (RLS) ensures absolute data isolation between different Firms.
• Breach Notification SLA: As a Data Intermediary, in the event of a confirmed security incident affecting personal data, Tokatos will notify the affected Firm within 24 to 48 hours of confirmation, enabling the Firm to fulfill its statutory notification obligations under PDPA Part 6A (Mandatory Data Breach Notification).

Tokatos utilizes Enterprise Google Cloud Vertex AI foundation models (Gemini Flash / Pro) across tiered operational workloads.

• Zero Model Training: All AI workloads execute under Google Cloud Enterprise privacy terms. We contractually guarantee that your Personal Data and Corporate Records are never logged, cached for foundation training, or used to train public or proprietary models.
• Tiered Model Execution & Sovereign Data Protections: Core relational databases, documents, and audit logs remain sovereign and encrypted in Singapore (asia-southeast1). Depending on model tier capabilities, ephemeral AI inference requests are processed via Google Cloud's sovereign, global, or regional enterprise Vertex AI endpoints in compliance with the PDPA Transfer Limitation Obligation (Regulation 9 of the Personal Data Protection Regulations 2021) via Google Cloud's Enterprise Data Processing Addendum.
• Human-in-the-Loop Filings: AI outputs are strictly drafts. Zero autonomous ACRA or IRAS filings occur without explicit review, edit, and authorization by the Firm's qualified staff.

We never sell, rent, or monetize client data. We engage only vetted sub-processors essential to operating the platform:

• Google Cloud Platform (Singapore): Primary cloud infrastructure, PostgreSQL/AlloyDB database hosting, Cloud Storage, and isolated Vertex AI processing.
• Didit (Didit Identity SL, Spain/EU): Biometric identity verification (liveness check) and global PEP/sanctions database screening. Cross-border transfers comply with PDPA Section 26 via Standard Contractual Clauses guaranteeing comparable protection standards.
• Self-Hosted Documenso v2: Tokatos utilizes the open-source Documenso e-signature engine, 100% self-hosted within Tokatos's isolated Google Cloud Singapore VPC (sign.tokatos.com). Documenso Inc. has zero access to your documents, keys, or signature audit trails.
• Meta Platforms (WhatsApp Cloud API): For delivering zero-login mobile signing links and client notifications.
• SendGrid: For transactional email delivery with TLS enforcement.

Individuals have rights to access, correct, and withdraw consent under the PDPA, subject to statutory retention exceptions:

• Statutory Retention Exception: Personal data embedded within statutory corporate registers, filed annual returns, and AML/CFT customer due diligence files must be retained for at least 5 years pursuant to ACRA regulations and the Companies Act 1967, and cannot be deleted upon individual request until the statutory retention period expires.
• Channel for Requests: Because Tokatos processes data as a Data Intermediary, access and correction requests should be submitted to your Corporate Services Provider (the Firm), who will instruct Tokatos accordingly.

In compliance with Sections 11(3) and 12 of the Personal Data Protection Act 2012, Nusax Pte. Ltd. has designated a Data Protection Officer to oversee compliance with this Policy.

For inquiries, access/correction requests, or complaints regarding personal data, please contact our DPO:

• Attention: The Data Protection Officer
• Organisation: Nusax Pte. Ltd.
• Email: dpo@tokatos.com
• Jurisdiction: Republic of Singapore