Privacy policy

This policy explains what personal data Nebulus collects when you visit our site or send us a request for quotation, why we collect it, and the choices you have.

01Who we are

Nebulus Pte. Ltd. (UEN 202204244E) is a company incorporated in Singapore with its registered address at 10 Anson Road, #12-14 International Plaza, Singapore 079903 (“Nebulus”, “we”, “us”). We trade enterprise hardware and software with business customers.

This policy explains how we collect, use, disclose and protect personal data through www.nebulus.world (the “site”), our request-for-quotation (“RFQ”) form, and the email and phone contact that follows. We handle personal data in accordance with Singapore’s Personal Data Protection Act 2012 (the “PDPA”).

Our customers and suppliers are businesses. The personal data we handle is mostly business contact information of the people who work for them. It does not cover personal data we process under a separate contract with a customer or supplier; that contract governs.

02Personal data we collect

We do not ask for sensitive personal data, and we ask that you do not include it in RFQ specifications or attachments. We do not knowingly collect personal data from anyone under 18.

03How we use it

We use personal data to:

• respond to your RFQ, prepare quotations, and follow up on them;
• enter into and perform contracts with your organization, including ordering, logistics, customs clearance, invoicing and collecting payment;
• carry out customer and counterparty due diligence, and meet requests from our banks, auditors and tax advisers;
• comply with legal, tax, customs, export-control and sanctions obligations, and keep the records the law requires;
• operate, secure and improve the site, including detecting spam and abuse of the RFQ form; and
• establish, exercise or defend legal claims.

We do not sell personal data. We do not send marketing to you unless you have agreed to it, and you can opt out of any marketing email at any time.

04Consent and withdrawal

By submitting the RFQ form you consent to us collecting, using and disclosing the data you provide for the purposes in section 3. Where the PDPA allows it, we also rely on deemed consent or an exception to consent, for example for business contact information, for performing a contract with your organization, or for our legitimate interests.

You can withdraw consent at any time by writing to our Data Protection Officer (section 11). We will tell you the likely consequences before acting on it; for example, we may be unable to continue with a quotation or order. Withdrawal does not affect processing we are required or permitted by law to continue.

05Who we share it with

We share personal data only as needed for the purposes above, with:

• Service providers who host or process data for us under contract: Vercel Inc. (site hosting and privacy-preserving analytics), Resend (delivery of RFQ form submissions to our inbox, and of the confirmation email to you), Cloudflare (bot protection on the RFQ form), and our email and document storage providers;
• Suppliers, manufacturers, freight forwarders and customs brokers, where needed to price, source, ship or clear your order, or to verify product authenticity;
• Banks and payment providers, for payments and for their compliance checks;
• Professional advisers, including our accountants, corporate secretary, tax agents and lawyers; and
• Authorities, including regulators, tax and customs authorities, courts and law enforcement, where the law requires or permits it.

If Nebulus is involved in a merger, acquisition or sale of its business, personal data may be transferred to the other party subject to confidentiality commitments.

06Site analytics and cookies

We use Vercel Web Analytics to count page views and see which pages are useful. It does not set cookies and does not build a profile of you across sites. Fonts are served by Google Fonts, which means your browser sends your IP address to Google when it loads the fonts. The site itself does not set advertising or tracking cookies. Details are in our cookie policy.

07Transfers outside Singapore

Some of our service providers, suppliers and logistics partners are located outside Singapore, including in the United States, the European Union, Hong Kong and Vietnam, so your personal data may be transferred and stored abroad. When we transfer personal data out of Singapore, we take appropriate steps, such as contractual terms, to make sure it receives a standard of protection comparable to the PDPA, as the PDPA requires.

08How long we keep it

We keep personal data only as long as we need it for the purposes it was collected for, or as long as the law requires. As a guide:

• RFQs that do not lead to an order: up to 2 years after our last contact;
• data in contracts, invoices and accounting records: at least 5 years, as Singapore’s Companies Act and tax laws require;
• site analytics: aggregated, without identifying individual visitors.

After that we delete the data or anonymize it.

09How we protect it

We use reasonable administrative, technical and physical measures to protect personal data against unauthorized access, collection, use, disclosure, copying, modification, disposal or loss. These include encrypted connections (HTTPS), access limited to staff who need it, and account-level access controls with our service providers. No system is completely secure, so please do not send more personal data than your inquiry needs.

If a data breach is likely to cause significant harm to affected individuals, or is of a significant scale, we will notify the Personal Data Protection Commission and, where required, the affected individuals, as the PDPA requires.

10Your rights

Under the PDPA you may ask us:

• for access to your personal data in our possession or control, and how it has been used or disclosed in the past year;
• to correct an error or omission in your personal data; and
• to stop using your personal data by withdrawing consent (section 4).

We will respond within 30 days. If we need more time we will tell you when we expect to respond. We may charge a reasonable fee for an access request, and we will tell you the fee in advance. We may need to verify your identity before acting on a request.

If you are in the United Kingdom, the European Union or another country whose data protection law applies to our handling of your data, you may have additional rights, such as erasure, restriction or objection. Contact us and we will handle your request under the law that applies. You may also complain to your local data protection authority, or in Singapore to the Personal Data Protection Commission.

11Contact our Data Protection Officer

For questions about this policy, or to make an access, correction or withdrawal request, contact:

12Changes to this policy

We may update this policy from time to time. The version on this page, with its effective date at the top, is the current one. If we make a material change we will highlight it on the site.