Legal
Privacy Policy
How Cleo System collects, uses, and protects the personal data of visitors, applicants, and prospective clients across our Singapore and Türkiye entities.
- GDPR
- PDPA (Singapore)
- KVKK (Türkiye)
Who Controls Your Data
Cleo System operates through two legal entities, and which one controls your data depends on your region:
- Cleo System Pte. Ltd. (Singapore) is the data controller for visitors and applicants in the APAC region.
- Cleo System Bilişim Sistemleri A.Ş. (Türkiye) is the data controller for visitors and applicants in the EMEA region.
If you're contacting us from the EU or EEA, GDPR applies to how your data is handled regardless of which entity technically operates the site.
What We Collect
We only collect what's needed for the specific thing you're doing on the site:
| Touchpoint | Data collected |
|---|---|
| Contact form | Name, email, company, country, topic, message |
| Demo request | Name, email, company, interest |
| Careers application | Name, email, phone, LinkedIn URL, location, resume/CV, cover note, referral source |
| Newsletter signup | Email address |
| Site analytics | Only if you accept analytics: pages viewed, scrolling, and clicks on links that leave the site. See our Cookie Policy for full detail. |
Legal Basis for Processing
The three regimes that apply to us don't define "legal basis" identically, so we state ours per-regime rather than in one blended paragraph:
- Under GDPR: consent (for analytics, and for newsletter/marketing) or legitimate interest (for responding to your inquiry or application).
- Under PDPA (Singapore): consent, or the "reasonable purpose" exception where it applies to routine business communication.
- Under KVKK (Türkiye): explicit consent, or processing necessary for a contract or legitimate interest, as defined under Article 5.
Retention
For analytics, Google Analytics is set to keep event data for 2 months and user-level data for 14 months. For everything else we haven't finalized our retention schedule yet — this section will state exactly how long each of the other categories above is kept, and will be published here once decided rather than left as a placeholder in a live policy.
Third-Party Processors
We use a small number of processors to run the site and respond to you. As of this draft: our content management system, our hosting provider, Google Analytics (only if you accept analytics), and (once selected) an email service provider. We'll name each of the others specifically once our tooling stack is finalized, rather than listing placeholders.
Cross-Border Transfer
Because we operate across Singapore and Türkiye, your data may be processed in a different country than the one you're in. Where that happens, we use appropriate safeguards (such as Standard Contractual Clauses) — the specific mechanism will be named here once our processor stack is finalized. For Google Analytics, which is used only if you accept analytics, the mechanism is still being confirmed and will be named here once it is.
Your Rights
You have rights over your own data — but exactly what those rights are depends on which regime applies to you:
- GDPR: access, correction, deletion, portability, and objection to processing.
- PDPA: access and correction, and the right to withdraw consent.
- KVKK: the right to learn whether your data is processed, request correction or deletion, and object to automated decision-making.
If you accepted analytics, you can withdraw that at any time from Cookie Settings in the footer.
To exercise any of these, contact us using the details below.
Careers Applications
If you apply for a role with us, your resume/CV and any information in your application is treated as a distinct, more sensitive category of data than a general site inquiry. It's used solely to evaluate you for the role applied for (or future roles, if you submit a general application), and is not shared outside our hiring process.
Contact & Data Protection Officer
We haven't yet assigned a named privacy contact or DPO role — this section will list a specific contact (not just a generic "contact us" link) once that's decided.