Canopy Privacy Statement

1. Definitions

Unless otherwise provided herein, the definition of terminologies and uppercase words used in the Canopy Platform User Agreement shall also apply to this Statement.

2. Anonymous User Policy

No Personally Identifiable Information Required: Canopy’s Platform and Services are anonymous services and will not normally request your name, address, identification number, phone number, or other information by which you may be personally identified (collectively, your “Personally Identifiable Information”, or “PII”).

In fact, Canopy asks that you remove any such PII from the data that you provide to Canopy or otherwise authorize us to have access to (collectively, your “Data”). We are able to provide you with a software tool that will remove the PII from your data, and we can also recommend third party PDF text replacement or editing software that will do the same. For your added protection, please refrain from including any PII or other non-public information in your communication with us, including your emails.

In the event your Data contains any PII, Canopy will make best commercial effort not to read, process or store such information on Canopy, and prevent them from appearing in your Canopy user area or in the deliverables of the Services as provided by Canopy (“Deliverables”). Our Data Retention Policy as provided below in Section 6 further dictates that we will delete your original Personal Financial Data (as defined below in Section 3) within a reasonable time after the relevant necessary financial information therein has been extracted and processed into our database for the purpose of providing Services as agreed between you and Canopy.

Whilst Canopy will take all reasonable steps to implement and comply with the above measures, please be informed that these measures are provided on a best-effort basis and Canopy shall not be liable for any inadvertent use, disclosure or retention of any PII disclosed to Canopy by you, intentionally or otherwise. In the event any such PII is inadvertently captured either in your Canopy Platform interface or in any Deliverables, please immediately notify us so that we may promptly rectify the situation.

We offer a communication method that is designed to maintain your anonymity in the course of your interaction with us, that is via anonymous email:

• Upon opening your account, we may ask you to register an email address that will be linked to your Canopy account. We encourage you to set up an email address which contains no information from which your personal identity may be inferred, for the sole use of Canopy. If required, we can guide you on the setup of such an email address.
• Aside from the above, you may still communicate with us via telephone, third party internet voice and chat providers, social media communication channels or via any email address that you regularly use. In such cases, Canopy may receive information that discloses or could be used to establish your identity. We will, however, respect the confidentiality of such information (as with any other information that we receive from you) and will only use and/or retain the information strictly in accordance with this Statement.

3. Personal Identifiable Information We May Collect

Notwithstanding the foregoing, under certain circumstances, Canopy may collect, process your certain PII while providing Services to you. Below we outline the kinds of PII we may collect:

• Contact information: We may collect PII such as your name, email, company, and country when you request a demo, the trial usage of the Platform and/or the Services of Canopy, or register for an event hosted by Canopy, or intend to establish business communications with Canopy or interact with personnel of Canopy for business purpose.
• Account information: When setting up a new account, we may collect PII such as your name, email address, and company name. We may collect and store media, documents, or other information you provide to us, as well as commercial information, such as records of the purchased Services.
• Payment information: If you decide to make a purchase or Subscription directly via our Platform, we may collect contact information, and financial and billing information such as your card numbers and bank account information.
• Personal financial information: We may use the financial account statements and other financial data that you provide to us or authorize us to have access (collectively, the “Personal Financial Data”), in order to deliver the Canopy service you have subscribed to. For the avoidance of doubt, Personal Financial Data for this purpose does not include information that is aggregated with similar data from other users to produce Meta Data (as described below in Section 4), or is otherwise no longer identifiable to any specific Canopy user.
• Cookie information: When you visit our Platform, we may collect information through the use of cookies and other trackers. Such cookie information we collect may include IP address, browser type, and device characteristics.
• Device identifiers and tokens: When you use our mobile application, we may collect non-advertising device identifiers (such as iOS Identifier for Vendor (IDFV), Android ID, or other unique installation/device identifiers generated by the application) and push notification tokens (such as APNS and FCM tokens) to deliver in-app and push notifications, authenticate your device, prevent fraud, ensure platform security, and analyze app usage and performance. We do not collect advertising identifiers (such as IDFA or Google Advertising ID) as we do not engage in advertising or ad-based tracking.
• Usage information: When acting in our capacity as a data controller, we may collect the following when you use the Services:
  • User activity: We may keep track of user activity in relation to the types of Services our Customers use, the configuration of their computers, and performance metrics related to their use of the Services.
  • Log information: We log information about our Customers and their End Users when they use the Services, including their IP addresses.
  • Cookies and other tracking technologies: we may use various technologies to collect information, including saving cookies to users’ computers.
  • Customer feedback: While using the Services, you may be asked to provide feedback (e.g., in the application directly or after receiving help from our support team). Providing this feedback will be optional to you.

4. How We Use Your PII and On What Grounds

Canopy uses the PII we may collect for the following purposes:

• To provide the Services: We use information about you to provide you with access to the Platform and the Services, including to create and manage your accounts of the Platform, process transactions with you, and send you invoices. For the purpose of producing statistical collective data amongst Canopy users (“Meta Data”), we may aggregate your Personal Financial Data together with similar data from other Canopy users. Meta Data will be produced in such a manner that the underlying data will be no longer identifiable to any specific user. The lawful basis we rely on to process your PII for the purposes described above is either based on performance of a contract (i.e., the legal contract or agreement that we have in place with you), consent or our legitimate interests.
• For research and to improve and create new Services: We use the information we collect, including Usage Information, to improve the Services, including to monitor and analyze trends, usage, and other activities in connection with the Services so that we can continually improve them or create new ones. We may also link or combine information about you with information we get from others to help understand your needs and provide you with new and better services. The lawful basis we rely on to process your PII for the purposes described above is either consent or our legitimate interests.
• To communicate with you: We use information about you to communicate with you, including to send you technical notices, Service updates, security alerts, support communications, and administrative messages about the Services (including important changes to the Services). This also includes sending you information about your account and data, such as when we update our terms or when we materially change how we use your data. The lawful basis we rely on to process your PII for the purposes described above is either consent or our legitimate interests.
• For security: We may use information about you to maintain and increase the security of the Platform and the Services, including to detect, investigate, and prevent fraud and other illegal activities from occurring, as well as to protect the rights and property of you, Canopy, our customers, and third parties. The lawful basis we rely on to process your PII for the purposes described above is either consent or our legitimate interests.
• For sales and marketing: With your prior consent, we use information about you to advertise or market to you, conduct market research, and provide you with customized content. This may also include using information about you to create advertising and suggest Services that may be of interest to you. We may also use information about you to facilitate possible contests, sweepstakes, and promotions, and to process and deliver your entries and rewards. The lawful basis we rely on to process your PII for the purposes described above is either consent or our legitimate interests.
• To comply with legal obligations: We may use information about you to comply with our legal requirements. For example, we may process and retain information about your payments to us for tax and accounting purposes. The legal basis under data protection law for the above processing is complying with legal obligations or legitimate interest.
• With your consent: Finally, we use information about you for any other purposes that you have consented to. The lawful basis we rely on to process your PII for the purposes described above is consent.

5. How We Share Your PII

We may share your PII in the following limited circumstances:

• Vendors, consultants, and other service providers: We may disclose your PII to vendors, consultants, and service providers who perform services on our behalf. These services include processing payments, analyzing website usage/analytics, preventing spam and security threats related to abusive automated software, managing online activities, gathering product feedback, providing help desk support, operating our CRM, e-learning services, facilitating transactions, tracking marketing campaigns, and handling email communications, etc. We may also share your PII with banking, legal, insurance and accounting services (who may act as processors or controllers) to the extent we are legally obliged to share or have a legitimate interest in sharing your PII.
• Meta Data producing and sharing: As mentioned above, for the purpose of producing statistical collective data amongst Canopy users, i.e. Meta Data, we may aggregate your Personal Financial Data together with similar data from other Canopy users. We may share Meta Data amongst Canopy users as part of the service provided, and also with our business partners and other third parties to help us make improvements and/or enhancements to our products and services and for marketing, research and academic purposes.
• For legal reasons: In rare cases, we may share your PII in response to a request for information if we believe disclosure is permitted or required by an applicable law, regulation, or legal process, including to comply with a subpoena or applicable court order. Further, we may share your PII with any person to whom disclosure is necessary to enable us to enforce our rights under this Privacy Statement or under any agreement we enter with you or to protect the rights, property, or safety of Canopy or third parties.
• Consent: We may share your PII with your prior consent or at your direction.

6. How Long do We Store Your PII (Data Retention Policy)

We store your PII for different time periods depending on the category of PII and the nature of the relationship that you have with us. Our goal is to keep your PII for as short of a period as possible to achieve the purpose for which PII was collected. We consider the following criteria when determining how long we will retain your PII:

• The terms of the agreements you have with us;
• Our legitimate interests or legal purposes, such as network improvement, fraud prevention, record-keeping, promoting safety, security and integrity, or enforcing our legal rights;
• How long we need to retain the PII to comply with our legal obligations; and
• The amount, category and nature of your PII.

In some cases, we may anonymize your PII so that you are no longer identifiable, in which case we may use the resulting information without further notice to you.

7. Security

The security of your PII is incredibly important to us. We have implemented and we continually maintain a variety of technical and organizational measures to protect your PII from unauthorized access and against unlawful processing, accidental loss, damage, and unauthorized access, disclosure, alteration and destruction.

8. Children

Our Platform and Services are not directed at children. We do not knowingly collect PII from children under the age of 16. We do not knowingly collect PII for children between 16-18 unless we have obtained consent from a parent or guardian, such collection is subject to a separate agreement with us, or the visit by a child is unsolicited or incidental. If you are a child, please do not attempt to register for the Services or send any PII about yourself to us. If you believe we have mistakenly or unintentionally collected PII of a child without appropriate consent, please contact us by using the information in the “Contact Us” section below and we will take steps to delete their PII from our systems.

9. Your Privacy Rights

You may have certain rights related to your PII, depending on your location and the applicable data protection laws. These rights may include, subject to any exceptions or limitations:

• The right to know what PII is being collected and for what purpose.
• The right to know what PII is being distributed or shared, for what purpose and the categories of recipients of your PII.
• The right to access your PII.
• The right to have your PII rectified, corrected, or updated.
• The right to have your PII deleted, including from any third parties where your PII has been sold, shared, or disclosed.
• The right to restrict our processing of your PII.
• The right to opt out of the distribution or sharing of your PII.
• The right to withdraw your consent at any time (to the extent processing is based on consent).
• The right to object to the processing of your PII.
• The right not to be subject to any automated decision making and profiling.
• The right not to be discriminated against for exercising your rights.

If you or your authorized agent wishes to exercise any of these rights, you can contact us as outlined in the “Contact Us” section below. Our support team will review verified privacy rights requests and respond to you as quickly as possible. If we are unable to comply with your request due to an exception or limitation, we will explain this in writing. If we need more time, we will inform you of the reason and extension period in writing.

10. International Data Transfers

Canopy operates globally, therefore your PII may be transferred and accessed from around the world from countries where Canopy’s affiliates and subsidiaries are located and where our third-party providers operate. We will ensure that any transfer of your personal data outside Singapore complies with the requirements prescribed under the Personal Data Protection Act (PDPA). In particular, we will take appropriate measures to ensure that any overseas recipient provides a standard of protection for your personal data that is comparable to the protection under the PDPA. This may include entering into legally binding agreements with the overseas recipient to safeguard your personal data.

11. Changes to this Privacy Statement

We may change this Privacy Statement from time to time. We will alert you about material changes by, for example, placing a notice on our Platform and/or sending you an e-mail (if you have registered your e-mail with us) when we are required to do so by applicable law. You can see when this Statement was last updated by checking the date at the top of this page. You are responsible for periodically reviewing this Statement. If you disagree with any changes to this Statement, you should stop using the Services and deactivate your account.

12. Contact Us

If you have questions or concerns about this Privacy Statement, please contact us via email at Hello@canopy.cloud or via post mail, addressed to Canopy Pte. Ltd., Lazada One, 51 Bras Basah Road #05-01L, Singapore 189554.