This Privacy & Data Use Notice (“Notice”) explains how ZETTA SOLUTION PTE. LTD. (UEN 201206718K) collects, uses, discloses, stores and protects Personal Data in connection with AveriWorks ERP, a product in the AveriWorks family, our website at www.averiworks.com, customer relationships, advertisements shown to Authorised Users, analytics and related services.
In this Notice, “we”, “us” and “our” refer to ZETTA SOLUTION PTE. LTD. Capitalised terms not defined in this Notice have the meanings given in the AveriWorks ERP Terms and Conditions. Where the Product Schedule in the AveriWorks ERP Terms and Conditions restricts our use of Customer Data more narrowly than this Notice, the Product Schedule prevails.
This Notice consists of Part 1 (Common Provisions), which are the same for every product in the AveriWorks family, and Part 2 (Schedule: AveriWorks ERP), which describes processing specific to AveriWorks ERP. Sections of Part 2 are numbered S1, S2 and so on.
Part 1 — Common Provisions
1. Scope and our two roles
This Notice applies to Personal Data relating to:
prospective customers;
customers and their representatives;
Account administrators and Authorised Users;
Respondents who complete forms published through the Services;
website and application visitors;
business partners, referrers and suppliers;
sales and support contacts;
recipients of marketing communications; and
other individuals who interact with us.
We act in two different roles:
As an organisation. We decide how and why we use Personal Data relating to our own customers, Authorised Users, website visitors, partners, referrers and contacts, such as Account, billing, support and marketing information. This Notice describes that processing.
As a data intermediary. Where a Customer enters Personal Data into the Product, or collects it through the Product (for example, records of its employees, customers and suppliers, or responses submitted by Respondents), the Customer decides what information is collected and how it is used. We process that Personal Data on the Customer’s behalf, in accordance with the Customer’s instructions and the AveriWorks ERP Terms and Conditions. The Customer’s own privacy notice governs its use of that information.
2. Personal Data we may collect
Depending on the interaction, we may collect the following types of Personal Data.
2.1 Identity and Account information: name; job title; company name; username; Account identifier; role and permissions; and verification information where required.
2.2 Contact information: email address; telephone number; business address; and communication preferences.
2.3 Subscription and billing information: selected plans; quotation and contract details; billing information; invoices; payment status; renewal and cancellation status; transaction references; referral identifiers; and limited payment information received from our payment processor.
2.4 Technical and usage information: IP address; device and browser information; operating system; login activity; audit records; feature usage; performance information; error records; security events; advertisement impressions and clicks by Authorised Users; and cookie and similar identifiers.
2.5 Communications: emails; support tickets; chat messages; abuse reports and complaints; feedback; surveys; and call recordings where appropriate notice is provided.
2.6 Information processed for Customers: Personal Data that Customers enter into, or collect through, the Product, which may include information about a Customer’s employees, customers, suppliers, contacts and Respondents. The exact information depends on how each Customer configures and uses the Product. Part 2 (the Schedule) describes the information typically processed for the Product.
3. How we collect Personal Data
We may collect Personal Data directly from an individual; from their employer or organisation; through our websites and the Product, including forms completed by Respondents; from sales and support interactions; through authorised partners, referrers or resellers; from payment and security providers; through cookies, logs and similar technologies; from publicly available business sources; and from other lawful sources.
4. Purposes of processing
In our role as an organisation, we may collect, use and disclose Personal Data to:
create and administer Accounts and Subscriptions;
verify users and organisations;
provide, configure and maintain the Services;
process subscriptions, renewals, automatic billing, failed-payment notifications, cancellations, invoices and payments;
administer referral programmes, including verifying referral identifiers and issuing credits or rewards;
provide implementation, data-conversion, form-conversion, training and support services;
respond to enquiries;
communicate service, security and maintenance notices;
monitor performance and availability;
protect Accounts, forms and individuals, and prevent fraud, phishing, spam or abuse;
investigate incidents, complaints and abuse reports;
comply with directions, orders and requests from courts and competent authorities;
enforce contractual rights;
measure how the Services are used and, using only cleaned information as described in Section 7, improve the Services and user experience;
administer customer, partner and referral relationships;
comply with legal, tax, audit and regulatory obligations;
establish, exercise or defend legal claims;
send marketing communications to customers, Authorised Users and prospects where permitted;
display and measure advertisements shown to Authorised Users on a Free Tier;
create aggregated and anonymised information as described in Section 7 and Part 2 (the Schedule); and
carry out other purposes notified at or before collection or otherwise permitted by law.
5. Customer-controlled Personal Data
Where we process Personal Data on behalf of a Customer, we:
process it only to provide the Services to that Customer, to act on the Customer’s instructions, to secure the Services and prevent abuse, to comply with law, and for any further purposes permitted by the Product Schedule in the AveriWorks ERP Terms and Conditions and described in this Notice;
make reasonable security arrangements to protect it;
restrict access to authorised personnel and service providers who need it;
do not sell it, disclose it to advertisers or data brokers, or use the contents of Customer Data to target advertising;
do not use the contact details of the Customer’s own customers, suppliers, employees, Respondents or other contacts to send our own marketing to them;
notify the Customer without undue delay after we have credible grounds to believe that a data breach affecting it has occurred;
assist with reasonable data-protection requests where applicable; and
delete it in accordance with the Customer’s retention settings, the Customer’s instructions and the applicable contractual and retention arrangements.
Customers are responsible for determining whether they have lawful authority to enter or collect Personal Data through the Product, for giving individuals the required notices, and for responding to their requests.
6. Platform analytics
We may analyse how the Services are used to improve performance; identify errors; enhance security and detect phishing, spam and abuse; develop new features and templates; improve automation and AI Features; provide Customers with reporting on their own use of the Services; and understand general usage trends. Analytics carried out to improve the Services, develop features and templates, or improve automation and AI Features use only cleaned information as described in Section 7. We use identifiable Platform Data only to operate, secure and support the Services, detect errors and abuse, provide Customers with reporting on their own use, and measure the use of features.
7. Aggregated and anonymised information
We may create aggregated and anonymised information from Platform Data and, to the extent permitted by the Product Schedule in the AveriWorks ERP Terms and Conditions, from Customer Data. Before using such information to improve or develop the Services, or disclosing it outside our organisation, we use measures intended to prevent the reasonable identification of individuals, Customers, specific businesses, counterparties, Respondents and individual transactions. These measures may include removing direct identifiers; combining information from multiple businesses; generalising dates, products, categories or locations; applying minimum sample thresholds; suppressing uncommon results; using ranges, averages, medians, percentiles or indices; delaying publication; limiting the contribution of any single source; and assessing identification and re-identification risk.
We use only information cleaned in this way, and never Personal Data, to improve or develop the Services and our other products, or to train, fine-tune, test or evaluate AI models. We may publish general statistics about the use of the Services, such as the total number of documents or forms processed. Aggregated information that cannot reasonably identify or be attributed to an individual, Customer, business, Respondent or transaction may be retained indefinitely.
Additional rules for the Product are set out in Part 2 (the Schedule).
8. Free Tier advertisements
A Free Tier may display advertisements, sponsored content, partner offers, product recommendations and messages promoting paid features to Customers and their Authorised Users, within areas of the Services that only they can access and in emails relating to the Free Tier. We do not display third-party advertisements to the Customer’s own customers, suppliers or Respondents, or to the recipients of documents, forms or messages sent through the Services.
We may use limited, Account-level information to select, display or measure these advertisements, including broad industry category, general business type, country or broad region, language, Account type, selected modules, feature usage, advertisement impressions and advertisement interactions. We do not use the contents of Customer Data, such as invoice contents, employee records, customer or supplier lists, confidential pricing or form submissions, for third-party advertising unless separate express authorisation has been obtained and the Product Schedule in the AveriWorks ERP Terms and Conditions permits it.
Advertisers may receive total impressions, total clicks, broad audience categories, campaign-performance statistics and aggregated conversion information. Advertisers do not receive direct access to Customer Data or Personal Data merely because their advertisements are displayed. When an Authorised User interacts with a third-party advertisement, the third party may independently collect information under its own privacy notice.
9. Cookies and similar technologies
Our websites and Services use cookies and similar technologies for authentication, security, session management, preferences, analytics, performance, advertising to Authorised Users, attribution and functionality. Further information is set out in our AveriWorks ERP Cookie Notice.
10. Marketing and service communications
We may use contact information, business contact information and Account information to send administrative, transactional, security, billing, support and service-related communications to Customers and Authorised Users. These communications are necessary for the operation, administration and security of the Services and may include account notices, billing and renewal reminders, payment-related communications, security alerts, maintenance notices, system incident notifications, support updates, feature-change notices, abuse, complaint and takedown notices, legal, policy and terms updates and other operational communications.
We may also use business contact information of Customers, Authorised Users, referrers and prospects to send product updates, feature announcements, educational content, event invitations, promotional offers, surveys and other marketing communications relating to our products, services, partners, events and business offerings.
Recipients may opt out of marketing communications at any time by using the unsubscribe link provided, updating their communication preferences where available, or contacting us. Opting out of marketing communications does not prevent us from sending service-related communications.
Where required, we will obtain consent before sending marketing communications through channels such as email, SMS, telephone, WhatsApp or other messaging platforms. We may also check applicable do-not-call or preference registers where required before sending specified marketing messages.
Invoices, statements, confirmation emails and other messages that a Customer sends to its own contacts through the Services are sent on behalf of the Customer.
11. Disclosure of Personal Data
We may disclose Personal Data to:
hosting, infrastructure and storage providers;
communications and email-delivery providers;
payment processors and financial institutions;
security, malware-scanning, anti-spam and monitoring providers;
AI model providers engaged to provide AI Features;
electronic invoicing network operators and access point providers, where the Customer uses electronic invoicing functions;
implementation and support partners;
analytics providers and, in relation to Authorised Users on a Free Tier, advertising providers;
professional advisers, auditors and insurers;
affiliated companies;
a Linked Product, where the Customer instructs us to transfer information to it;
government, regulatory, law-enforcement and judicial authorities where required or permitted by law; and
purchasers or successors involved in a corporate transaction.
Customer Data is disclosed only to the Customer, to the persons the Customer authorises, to recipients the Customer instructs us to send it to, to our service providers as needed to operate the Services, and to authorities where required or permitted by law. Service providers are authorised to process Personal Data only for appropriate purposes and subject to applicable obligations. We do not sell Personal Data.
12. Information moved to or from Linked Products
Where a Customer connects the Product with a Linked Product and instructs us to transfer information between them, the information is, once transferred, held and used in accordance with the terms and conditions and the privacy and data use notice for the receiving product. Those documents may permit uses that differ from those described in this Notice, such as the use of cleaned, aggregated information for benchmarks and data products. Customers should review the receiving product’s documents before transferring information, and are responsible for ensuring that their notices to the individuals concerned cover any such transfer and use.
13. Artificial intelligence and automated features
We may use artificial intelligence, machine learning, optical character recognition, automation, generative AI or similar technologies to provide, support, secure and improve the Services. Depending on the Product, these technologies may support functions such as document processing, transaction classification, data entry assistance, report generation, converting paper forms into digital forms, extracting information from uploaded documents, summarisation, translation, recommendations, forecasting, anomaly and spam detection, workflow automation and customer support.
AI Features may process Account information, Customer Data, Personal Data contained in Customer Data, Platform Data, user prompts and instructions, system settings, usage interactions and aggregated information. AI Features may be provided using third-party AI model providers acting as our service providers, which may process information outside Singapore.
We do not use Personal Data, or Customer Data that identifies a Customer or an individual, to train, fine-tune, test or evaluate AI models, whether our own or a third party’s. We use only cleaned information, as described in Section 7, for those purposes. Further rules for the Product are set out in Part 2 (the Schedule) and in the Product Schedule in the AveriWorks ERP Terms and Conditions.
AI-generated outputs may not always be accurate or complete. Users should review and verify outputs before relying on, publishing or sending them.
14. Overseas transfers
Personal Data may be processed outside Singapore where our infrastructure, service providers or partners operate. Where we transfer Personal Data outside Singapore, we take reasonable steps to ensure that the transferred Personal Data receives a standard of protection comparable to that under the Personal Data Protection Act 2012, including through contractual obligations with our service providers.
15. Security
We use reasonable administrative, technical and physical safeguards appropriate to the nature of the information processed. These may include access controls; authentication measures; encryption in transit; encryption at rest where supported by our infrastructure; logging and monitoring; malware scanning of uploaded files; vulnerability management; backups; incident-response procedures; staff confidentiality obligations; and service-provider controls. Users must protect their credentials and notify us promptly of suspected unauthorised access.
16. Retention
We retain Personal Data that we process as an organisation only for as long as reasonably necessary for providing the Services; fulfilling the purpose for which it was collected; contractual and support requirements; legal, tax, audit and regulatory obligations; fraud, abuse and security prevention; resolving disputes; and enforcing agreements.
Customer Data is retained in accordance with the Customer’s retention settings and instructions, the limits of the Customer’s plan and the AveriWorks ERP Terms and Conditions, and is deleted after the end of the relevant Subscription and any applicable retrieval period, except where we are required to retain it by law or have preserved it in connection with an investigation or legal proceedings.
When Personal Data is no longer required, we will delete, anonymise or otherwise dispose of it according to our retention practices. Residual copies may remain temporarily in backups until overwritten through normal backup cycles.
17. Access and correction
An individual may request access to Personal Data we hold about them or request correction of inaccurate or incomplete Personal Data, subject to applicable legal exceptions. Requests must contain sufficient information to verify the requester and identify the relevant data.
Where the request concerns Personal Data controlled by one of our Customers, such as an employee record or a form submission, we will refer the request to that Customer, or ask the requester to contact the Customer directly, as the Customer is responsible for responding. A reasonable fee may be charged for an access request where permitted.
18. Withdrawal of consent
Where our processing is based on consent, an individual may withdraw consent by contacting us. We will explain the likely consequences and cease the affected processing within a reasonable period unless continued processing is required or permitted by law.
An individual who wishes to withdraw consent for a Customer’s use of their information, including a Respondent who completed a form, should contact that Customer.
Withdrawal does not require us to delete information that has already been lawfully transformed into aggregated and anonymised information that cannot reasonably identify the individual.
19. Data breaches
We maintain procedures to assess and respond to suspected Personal Data breaches. Where a data breach affects Personal Data that we process on behalf of a Customer, we will notify the affected Customer without undue delay after we have credible grounds to believe that the breach has occurred, and provide reasonably available information to assist the Customer in meeting any notification obligations it may have under applicable law. The Customer is responsible for assessing whether the breach is notifiable and for notifying the Personal Data Protection Commission and affected individuals where required, and we will not notify affected individuals directly on the Customer’s behalf unless the Customer instructs us to do so or we are required by law to do so.
Where a data breach affects Personal Data that we process as an organisation, we will assess it and, where required by law, notify the Personal Data Protection Commission and affected individuals.
20. Children
The Services are intended for business users and are not directed at individuals below 18 years old. An individual must be at least 18 years old to create or administer an Account, as set out in Section 6 (Accounts and security) of the AveriWorks ERP Terms and Conditions. If we learn that an Account has been created or is administered by an individual below 18 years old, we may suspend or close it. Customers may, however, hold records about children or publish forms that are completed by or about children, such as enrolment or consent forms. Where a Customer processes Personal Data relating to children, the Customer is responsible for ensuring that it has lawful authority to do so, including any required parental or guardian consent.
21. Business transfers
Information may be transferred as part of a proposed or completed merger, acquisition, financing, restructuring, sale of assets or other corporate transaction, subject to applicable confidentiality and legal requirements.
22. Changes to this Notice
We may update this Notice to reflect changes to the Services or the Product, advertising practices, analytics, data products and AI Features, processing activities, service providers, or applicable legal requirements. The updated version will display a revised “Last Updated” date. Material changes may be communicated by email, through the Services or through another appropriate channel.
23. Contacting our Data Protection Officer
Questions, complaints and requests may be directed to our Data Protection Officer. Please provide sufficient information for us to identify and respond to the request. Individuals with questions about a Customer’s use of their information, such as a Respondent with a question about a particular form, should first contact that Customer.
Data Protection Officer
ZETTA SOLUTION PTE. LTD.
Email: dpo@zetta-solution.com
Address: 18 Sin Ming Ln, #06-22, Singapore 573960
Telephone: 6334 1013
Part 2 — Schedule: AveriWorks ERP
S1. Information processed in AveriWorks ERP
In AveriWorks ERP, the Personal Data that Customers enter or process may include information about their employees, customers, suppliers, directors, shareholders, contractors and contacts, including where such information appears in transaction, invoicing, payment and other business records.
S2. Benchmarks and data products
As described in the Product Schedule in the AveriWorks ERP Terms and Conditions, we may use aggregated and anonymised information created from ERP Data to:
improve the Services and develop new features;
provide industry benchmarks, pricing and market comparisons, payment-performance benchmarks, sales and purchasing trends, inventory and cash-flow indicators and other business recommendations;
provide premium analytics;
prepare economic or industry reports and conduct research;
create forecasts and models;
develop, publish, license, distribute or sell data products; and
carry out lawful commercial and analytical activities.
Recipients of data products may include customers, businesses, professional advisers, researchers, financial institutions, industry organisations, government agencies, technology providers, advertisers and other lawful recipients.
We do not knowingly sell or disclose as a data product any Personal Data; raw Customer Data; identifiable business records or individual transactions; identifiable customer or supplier lists; confidential pricing attributable to a specific Customer; information identifying which Customer supplied a particular transaction or price; or information that could reasonably reconstruct a specific Customer’s transaction history.
Benchmarks and recommendations may be based on historical, sampled, estimated or modelled information and may not represent the entire market. Each Customer remains responsible for its own commercial, pricing, purchasing and operational decisions.