Responding to you
reply to enquiries, arrange demos, prepare proposals and follow up on the questions you raise.
Company · Legal
Privacy policy
This policy explains how RIOO handles personal data collected through its website and portals, why we use it, who we share it with and the choices and rights you have. It is written to meet Singapore's Personal Data Protection Act and the other privacy laws that apply where we work.
Privacy policy
How RIOO handles personal data
- ControllerRIOO
- RightsAccess, correction, deletion
- RetentionOnly as long as needed
- ContactData Protection Officer
PDPA · GDPR · UK GDPRCurrent
On this page
Who are we and what does this policy cover?
RIOO provides a property management platform built natively on Oracle NetSuite and is headquartered in Singapore. This policy covers personal data that RIOO collects as a business in its own right: through this website, our enquiry and demo forms, cookies and analytics, events, and our dealings with customers, prospects and partners.
In this policy, "RIOO", "we", "us" and "our" mean RIOO. For the purposes of Singapore's Personal Data Protection Act 2012 (PDPA), the EU General Data Protection Regulation (GDPR) and the UK GDPR, RIOO is the organisation responsible, or controller, for the website and business data described here.
The RIOO platform is different. When property companies use RIOO to manage leases, residents, vendors and staff, the property company decides what data goes into the platform and why. For that platform data, RIOO acts on the property company's behalf. The section on platform data below explains how this works and who to contact.
Compare
What personal data do we collect?
We collect personal data that you give us, data that is generated when you use the website or a portal, and limited data from other sources such as business contact databases and event partners. We collect only what we need for the purposes in this policy, and we ask you not to send sensitive information through our forms.
If you do not provide information that a form marks as required, we may not be able to respond to your enquiry or arrange the demo you asked for. Where you give us information about another person, such as a colleague, please make sure they are aware of this policy.
| Source | What we collect | Examples |
|---|---|---|
| Enquiry and demo forms | Contact and business details | Name, work email, phone number, company, role, country, portfolio type, and your message |
| Downloads and events | Registration details and interests | Which guide or brochure you requested, webinar attendance and the questions you ask |
| Cookies and analytics | Device and usage information | IP address, browser type, pages viewed, links clicked, referring site and approximate location |
| Portal accounts | Account and activity data | Name, email, role, sign-in times and security events, as set up by the customer |
| Business dealings | Professional contact information | Details of customer, partner and supplier contacts, and records of our correspondence |
| Other sources | Business contact details | Information from event organisers, referral partners and public professional profiles |
In detail
How do we use personal data?
We use personal data to answer your enquiries, arrange demos and proposals, run and secure the website and portals, and keep in touch with people who are interested in RIOO. We use it only for purposes that you would reasonably expect, that we have told you about, or that the law allows or requires.
We do not sell personal data, and we do not use it to make decisions about you that are based solely on automated processing and that have legal or similarly significant effects.
Running the website
operate, maintain and improve the website, fix problems and understand which content is useful.
Security
protect the website, portals and our systems against fraud, abuse, spam and unauthorised access.
Marketing
send news, guides and event invitations that you have asked for or that the law allows, with an easy way to opt out.
Customer relationships
manage our relationships with customers, partners and suppliers, including account administration and communication.
Legal duties
meet our legal, regulatory, tax and accounting obligations, and establish, exercise or defend legal claims.
Business changes
assess and carry out a merger, acquisition or reorganisation, with appropriate confidentiality protections.
Compare
What legal bases do we rely on?
Under the GDPR and UK GDPR we need a legal basis for each use of personal data. Under the PDPA we rely on consent, deemed consent or a legal exception. The table below shows the main purposes and the basis we usually rely on. Where we rely on consent, you can withdraw it at any time.
When we rely on legitimate interests, we balance our interests against your rights and expectations. You can ask us for more information about that assessment, and you have the right to object, as explained in the section on your rights.
| Purpose | Usual legal basis |
|---|---|
| Responding to enquiries and demo requests | Steps you ask us to take before entering into an agreement, and our legitimate interest in answering you |
| Marketing emails | Your consent, or our legitimate interest where the law permits marketing to business contacts |
| Non-essential cookies and analytics | Your consent, given through the cookie settings |
| Essential cookies and website security | Our legitimate interest in running a secure, working website |
| Managing customer and partner relationships | Performance of our agreement with the organisation, and our legitimate interests |
| Legal and regulatory obligations | Compliance with a legal obligation |
Explore by topic
Who controls the data in the RIOO platform?
The property companies that use RIOO control the personal data they put into the platform, including data about their residents, tenants, owners, vendors and staff. They decide what is collected and how it is used. RIOO processes that data on their behalf, under their instructions and the agreement we have with them.
Property companies as controllers
Each property company is the controller, or the organisation responsible under the PDPA, for the resident, owner, vendor and staff data in its RIOO account. Its own privacy notice explains how it uses your information, for example to manage your lease, collect payments or arrange maintenance.
RIOO as processor
RIOO acts as a processor, or data intermediary under the PDPA, for platform data. We process it only to provide and support the platform, under the customer's instructions and our agreement with that customer, and we apply the security measures described in this policy and in that agreement.
Requests about platform data
If you are a resident, owner, vendor or staff member and want to access, correct or delete information held in a RIOO portal, please contact the property company that gave you access. If you contact RIOO instead, we will pass your request to that property company and help it respond.
In detail
Who do we share personal data with?
We share personal data only with people who need it to help us run our business, and only as described in this policy. Our service providers must protect the data, use it only to provide services to us and follow our instructions. We do not sell or rent personal data to anyone.
Customer relationship management
our CRM and marketing platform, which stores enquiry and demo form submissions and sends our emails.
Hosting and infrastructure
providers that host the website, portals and our systems, including cloud infrastructure providers.
NetSuite and Oracle
the RIOO platform runs natively on Oracle NetSuite, so platform data is stored and processed in NetSuite under Oracle's own security commitments.
Analytics
tools that help us understand how the website is used, set only with your consent where the law requires it.
Communication tools
email, messaging, video meeting and scheduling services that we use to talk to you.
Professional advisers
lawyers, auditors and insurers, under duties of confidentiality.
Authorities
regulators, courts and law enforcement where the law requires it, or to protect rights, property and safety.
Successors
a buyer or successor if RIOO is involved in a merger, acquisition or reorganisation.
How do international transfers work?
RIOO is headquartered in Singapore, works with teams and customers in several countries, and uses service providers whose systems are located in other countries, including the United States. This means your personal data may be transferred to, stored in and accessed from countries other than the one where you live.
When we transfer personal data out of Singapore, we make sure the recipient is bound to protect it to a standard comparable to the PDPA, as the PDPA's transfer rules require. When we transfer personal data from the European Economic Area or the United Kingdom to a country without an adequacy decision, we use recognised safeguards such as the European Commission's standard contractual clauses and the UK International Data Transfer Addendum, together with additional measures where they are needed.
You can contact us to ask for more information about the safeguards that apply to a particular transfer.
Compare
How long do we keep personal data?
We keep personal data only for as long as we need it for the purposes in this policy, including to meet legal, accounting and reporting obligations. When we no longer need it, we delete it or anonymise it so that it can no longer identify you. The table below shows how we decide how long to keep each type.
Platform data is kept and deleted according to the property company's instructions and its agreement with RIOO.
| Type of data | How long we keep it |
|---|---|
| Enquiry and demo requests | For as long as the conversation is active, then for a reasonable period in case you contact us again |
| Marketing preferences | Until you opt out, after which we keep a suppression record so we do not contact you again |
| Cookie and analytics data | For the period set out in the cookie settings, which differs by cookie |
| Customer and partner contacts | For the life of the relationship and the period afterwards that the law or our agreements require |
| Records needed for legal reasons | For the period required by law, or until any legal claim is resolved |
How do we protect personal data?
We use reasonable administrative, technical and organisational measures to protect personal data against unauthorised access, loss, misuse and alteration. These measures are appropriate to the nature of the data and the risks involved, and we review them as our systems and the law change. No method of transmission or storage is completely secure.
You can read more about how RIOO protects platform data on our security page.
Explore by topic
What rights do you have?
Depending on where you live, you have rights over your personal data. These usually include the right to know what we hold, to get a copy, to correct it, and in some cases to delete it, restrict or object to its use, or move it elsewhere. You can always withdraw consent that you have given us.
Singapore
Under the PDPA you can ask to access the personal data we hold about you and how it has been used or disclosed, ask us to correct it, and withdraw your consent to its collection, use or disclosure. Withdrawing consent may affect our ability to respond to you or provide information you asked for.
European Economic Area and United Kingdom
Under the GDPR and UK GDPR you have the right of access, rectification, erasure, restriction, data portability and objection, including an absolute right to object to direct marketing. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
California and other US states
Residents of California and other US states with privacy laws can ask to know the categories and specific pieces of personal information we hold, ask for deletion or correction, and opt out of sale, sharing for targeted advertising or profiling. RIOO does not sell personal information, and we will not discriminate against you for exercising your rights.
Australia and the United Arab Emirates
Under the Australian Privacy Act you can ask to access and correct your personal information. Under the UAE data protection laws, including the federal law and the rules of free zones such as the DIFC and ADGM where they apply, you have similar rights of access, correction, deletion and objection.
How it works
How can you exercise your rights?
To exercise any of your rights, send us a request through our contact page and mention "Privacy request" in your message. We will confirm what you are asking for, check your identity, and respond as the law that applies to you requires. Making a request is free in most cases.
You can also ask an authorised agent to make a request for you where the law allows it. We may need written proof of their authority.
- 01
Send the request
use the contact page, choose the general enquiry option and start your message with "Privacy request", saying which right you want to exercise.
- 02
Verify identity
we may ask for information to confirm that you are the person the data relates to, or that you are authorised to act for them.
- 03
Review
we search our systems, consider any legal exemptions and, for platform data, involve the property company that controls it.
- 04
Respond
we provide the information or confirm the action we have taken, or explain why we cannot, and tell you how to complain if you are unhappy.
Does RIOO collect data about children?
No. The RIOO website and our marketing are aimed at businesses and the professionals who work in them, not at children. We do not knowingly collect personal data from children through the website. If you believe a child has sent us personal data, please contact us and we will delete it.
Property companies may hold information about members of a household, including children, in the RIOO platform for purposes such as lease occupancy records. That information is controlled by the property company, which is responsible for handling it lawfully and for responding to questions about it.
In detail
How can you stop marketing messages?
You can stop receiving marketing messages from RIOO at any time, and it will not affect any service you receive from us. When you opt out, we keep a short suppression record of your email address so that we respect your choice in future campaigns and imports. You can use any of these options:
Even after you opt out, we may still send you messages that are necessary for something you asked for, such as confirming a demo time.
Unsubscribe link
every marketing email we send includes an unsubscribe link at the bottom.
Form preferences
tick or untick the marketing option when you submit a form on the website.
Contact us
send a message through the contact page asking us to stop marketing to you.
Cookie settings
change your choices to stop analytics and advertising cookies that help us tailor content.
Compare
How does RIOO use cookies?
Cookies are small files that a website stores on your device. We use them, and similar technologies, to make the website work, remember your choices and understand how people use our pages. Essential cookies are always on. Analytics and marketing cookies are set only if you allow them, where the law requires your consent.
You can change your choices at any time in the cookie settings, and you can block or delete cookies in your browser. Blocking some cookies may affect how the website works.
| Type of cookie | What it does | Can you turn it off? |
|---|---|---|
| Essential | Keeps the website secure, remembers your cookie choices and makes forms work | No, the website needs these to work |
| Preferences | Remembers settings such as your chosen region or dismissed messages | Yes, through cookie settings or your browser |
| Analytics | Measures visits, page views and traffic sources so we can improve the website | Yes, they are off unless you allow them |
| Embedded content | Lets videos and other embedded content play, and may set the provider's own cookies | Yes, the content loads only when you choose to play it |
How will we tell you about changes to this policy?
We may update this policy from time to time to reflect changes in the law, our services, our service providers or how we handle personal data. The version on this page is the current version. If we make a significant change, we will make it visible on the website and, where appropriate, tell you directly.
We encourage you to review this page from time to time so that you stay informed about how we protect your personal data. Where the law requires your consent to a change, we will ask for it before the change applies to you.
How can you contact RIOO and our Data Protection Officer?
You can contact RIOO, and our Data Protection Officer, through our Contact page. Choose the general enquiry option and begin your message with "Privacy request" or "For the attention of the Data Protection Officer". Tell us how you would like us to reply, and we will respond using the contact details you provide.
RIOO is headquartered in Singapore. If you are in the European Economic Area or the United Kingdom and we are required to appoint a local representative, we will publish their details on this page. For questions about data held in a property company's RIOO portal, please contact that property company first, because it controls that data.
In detail
How can you complain to a regulator?
If you are unhappy with how we have handled your personal data, please contact us first so that we can try to put things right. You also have the right to complain to a data protection regulator, usually the one in the country where you live or work, or where you believe a breach happened.
Singapore
the Personal Data Protection Commission (PDPC).
United Kingdom
the Information Commissioner's Office (ICO).
European Economic Area
the data protection supervisory authority in your member state.
Australia
the Office of the Australian Information Commissioner (OAIC).
United States
the California Privacy Protection Agency or the Attorney General of your state.
United Arab Emirates
the UAE Data Office, or the Commissioner of Data Protection in the DIFC or the Office of Data Protection in the ADGM, where they apply.
Talk to a specialist
See privacy policy on your own portfolio.
It is written to meet Singapore's Personal Data Protection Act and the other privacy laws that apply where we work.
Does RIOO sell my personal data?
No. RIOO does not sell or rent personal data to anyone, and we do not share it for cross-context behavioural advertising in exchange for money. We share personal data only with service providers who help us run our business, with professional advisers and with authorities where the law requires it, as this policy explains.
I use a resident portal. Who is responsible for my data?
The property company that gave you access is responsible for your data in its RIOO portal. It decides what is collected and how it is used, and RIOO processes the data on its behalf. Contact the property company with requests about your account; if you contact RIOO instead, we will pass your request on.
What happens to the details I enter in a demo request form?
Your details are stored in our customer relationship management system so that our team can contact you, arrange the demo and prepare for it. We use them to follow up on your request and, if you agree or the law allows, to send relevant updates. You can opt out at any time.
How do I withdraw my consent or stop marketing emails?
Click the unsubscribe link in any marketing email, change your cookie settings, or send a message through the contact page asking us to stop. Withdrawing consent does not affect processing that happened before, and we keep a short suppression record so that we can respect your choice in the future.
Where is my personal data stored?
RIOO is headquartered in Singapore, and our service providers, including NetSuite and our hosting and CRM providers, may store data in other countries such as the United States. When data leaves Singapore, the EEA or the UK, we use the safeguards those laws require, such as standard contractual clauses.
Related
Related to privacy policy
