Privacy & Cookies Policy

1.1  Prime Move Pte. Ltd. ("we", "us", or "our") is the operator of the Indotrans Index platform (the "Platform"), an institutional benchmark service for Indonesian offshore commodity transshipment pricing. Our registered address is in Singapore.

1.2  We are committed to protecting the personal data of individuals who subscribe to, access, or enquire about the Platform ("you" or "your"). This Privacy & Cookies Policy describes what personal data we collect, why we collect it, how it is used, and your rights under Singapore's Personal Data Protection Act 2012 ("PDPA").

For enquiries, contact us at: support@indotrans-index.com

When you access the Platform, register for a subscription, or contact us, we may collect and process the following categories of personal data:

2.1 Identity Data

–     Full name

–     Company or organization name

–     Job title or role, where provided in connection with a subscription

–     Country

–     Company website, where provided

–     Business segment (for example commodity producer, trader, freight operator, or financial institution)

–     Intended use of the Platform, together with any additional information you choose to provide in free-text fields

2.2 Contact Data

–     Work email address

–     Business phone number and office or billing address, where provided in connection with a subscription

2.3 Subscription & Account Data

–     Subscription details associated with your account (such as start date and term)

–     Account login credentials (hashed; we do not store plain-text passwords)

–     Billing and invoicing information necessary to process your subscription payment by bank transfer (such as company billing name, registered address, and remittance or bank reference details). We do not collect or store payment card details, and we do not use third-party payment processors.

2.4 Usage & Audit Data

To protect the integrity of the index and enforce our anti-extraction controls, we collect:

–     Pages viewed and features accessed on the Platform

–     Query logs (including AI chatbot interactions where applicable)

–     IP address, browser type, and device identifiers

–     Session timestamps and duration

This data is used for platform security, audit logging, watermarking, and rate-limiting, not for advertising or profiling beyond your subscription context.

2.5 Data About Permitted Users

Where you subscribe on behalf of an organization, you may provide us with the names, job titles, and work email addresses of the individuals authorised to access the Platform (Permitted Users). This personal data is provided to us by the subscribing organisation rather than by the individuals themselves. The subscribing organisation is responsible for ensuring that it is entitled to provide such data to us and that the individuals concerned have been informed of this Policy. We use Permitted User data solely to create and administer Platform access and to maintain the audit records described in section 2.4.

3.1 We use your personal data only for the purposes described in this section. We will not use it for any other purpose without notifying you first.

4.1  We do not sell your personal data. We may share it in limited circumstances with:

–     Platform hosting and infrastructure providers: your data may be stored and processed on secure servers operated by our cloud infrastructure provider. All providers are contractually bound to process data only on our instructions and to maintain appropriate security standards.

–     Analytics and platform monitoring tools: limited usage data (such as session logs) may be processed by tools used to maintain platform performance and security.

–     Professional advisers: lawyers, auditors, and accountants, where necessary for business operations, under obligations of confidentiality.

–     Regulators or law enforcement: where we are required to do so by applicable law or a court order.

–     Industry partners: where you have given explicit consent and in connection with commercially agreed partnership activities (e.g. joint research). Partners are required to adhere to PDPA-equivalent data protection standards.

4.2  We will notify you before sharing your data with any new category of third party not listed above.

5.1  Our Platform is operated from Singapore. If personal data is transferred to a recipient outside Singapore, we will ensure that such transfer complies with the data portability provisions of the PDPA, including by implementing appropriate contractual protections (such as data transfer agreements incorporating PDPC-approved standard clauses) or by transferring only to jurisdictions that provide an adequate level of protection.

5.2  If you would like further information about how we protect your data in cross-border transfers, please contact us.

6.1  We retain personal data only for as long as is necessary for the purpose for which it was collected, subject to any legal, regulatory, or contractual obligations to retain it for a longer period. Our general retention guidelines are:

–     Active subscriber data: retained for the duration of the subscription and for seven (7) years after the end of the subscription relationship, in line with Singapore commercial record-keeping requirements.

–     Enquiry and marketing data: retained for up to three (3) years after the last meaningful contact, unless you withdraw consent earlier.

–     Usage and audit logs: retained for a minimum of two (2) years for platform integrity and dispute resolution purposes.

–     Anonymized or aggregated data: may be retained indefinitely as it no longer constitutes personal data.

6.2  At the end of the applicable retention period, personal data is securely deleted or anonymized.

7.1  We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Specific controls applied on the Platform include:

–     Server-side pagination and rate limiting to prevent bulk data extraction

–     Audit logging of all subscriber access and query activity

–     Watermarking of data outputs

–     Encrypted transmission (TLS) and encrypted storage for sensitive fields

–     Role-based access controls limiting staff access to personal data on a need-to-know basis

7.2  No transmission over the internet is completely secure. While we take appropriate steps to protect your data, we cannot guarantee absolute security and you provide personal data at your own risk.

8.1  Under the Personal Data Protection Act 2012 (Singapore), you have the following rights in relation to your personal data held by us:

–     Right of access: you may request a copy of the personal data we hold about you and information about how we use it.

–     Right of correction: you may request that we correct any inaccurate or incomplete personal data we hold about you.

–     Right of withdrawal of consent: where processing is based on your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

–     Right to data portability: where applicable under the PDPA, you may request that we transmit your personal data to another organisation in a commonly used machine-readable format.

–     Right to cease or limit use: in certain circumstances, you may request that we cease or limit our use or disclosure of your personal data.

8.2  To exercise any of the above rights, please contact us at support@indotrans-index.com. We will respond to all valid requests within thirty (30) days. We may need to verify your identity before processing your request.

9.1 What are cookies?

Cookies are small text files stored on your device when you visit a website. They allow the website to recognise your device and remember certain information about your visit to improve functionality and user experience.

9.2 Cookies we use

We do not use advertising or marketing cookies. We do not place cookies for third-party ad networks.

9.3 Managing cookies

Necessary cookies are required for the Platform to function and cannot be disabled. For all other cookie types, you may withdraw or change your consent at any time using the Cookie Settings control at the bottom of any page on the Platform.

You may also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For more information on managing cookies, visit www.allaboutcookies.org.

10.1 The Platform may contain links to third-party websites, including partner and data provider websites. This Privacy & Cookies Policy does not apply to those websites. We are not responsible for their privacy practices and encourage you to review their policies before submitting any personal data.

11.1 We may update this Privacy & Cookies Policy from time to time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will notify active subscribers by email and update the "Last updated" date at the top of this document. We encourage you to review this Policy periodically.

11.2 Continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy.

12.1 For any questions, complaints, or requests relating to this Policy or your personal data, please contact our Data Protection contact at:

Prime Move Pte. Ltd.

Email: support@indotrans-index.com

Website: www.indotrans-index.com

Singapore

12.2 If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.