Privacy Policy

1. Scope and Applicability

This Privacy Policy explains how Theos Cyber Holdings Pte. Ltd. (Singapore), Theos Cyber Solutions Limited (Hong Kong), Theos Solutions Sdn. Bhd. (Malaysia), and Theos Cyber Solutions Inc. (Philippines) (“Theos Cyber,” “we,” “us”) collect, use, disclose, and protect personal data. It applies to visitors to our websites, prospective and current clients, job applicants, employees and contractors, and individuals employed by our business partners.

This Policy governs personal data that Theos Cyber collects and controls in its own right, for example through our websites, marketing activities, recruitment process, and corporate operations. It does not govern personal data that Theos Cyber processes on behalf of a client while delivering a service, such as during a managed detection and response engagement, a penetration test, or a digital forensics and incident response investigation. That processing is governed by the data processing terms in the relevant master services agreement or statement of work, under which Theos Cyber acts as a data processor or data intermediary and the client remains the data controller.

This Policy is drafted to meet the requirements of the following laws:

• Singapore: the Personal Data Protection Act 2012 (PDPA), enforced by the Personal Data Protection Commission (PDPC).
• Hong Kong: the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO), enforced by the Office of the Privacy Commissioner for Personal Data (PCPD).
• Malaysia: the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 (PDPA), enforced by the Department of Personal Data Protection (JPDP).
• Philippines: the Data Privacy Act of 2012 (Republic Act No. 10173) (DPA), enforced by the National Privacy Commission (NPC).

Where local law requires additional or different treatment, that law governs for individuals in that jurisdiction.

2. Personal Data We Collect

What we collect depends on your relationship with us. It may include:

• Contact information: name, business address, phone number, email address, job title, and employer.
• Account and platform information: login credentials, client portal activity, and preferences, where you have access to a Theos Cyber client or partner portal.
• Commercial information: details of engagements, quotes, invoices, and contract records connected to your organisation’s relationship with us.
• Information you submit: messages sent through our contact forms, chatbot, or email, event registrations, and survey or feedback responses.
• Job applicant information: CV or resume content, education and work history, interview notes, references, and, where permitted and relevant to the role, background check results.
• Employee and contractor information: payroll and benefits data, identification numbers, work permit or visa status, performance and training records, and emergency contact details.
• Site and device information: IP address, browser and device type, log data, and cookie identifiers collected when you visit our websites.
• Event and marketing information: photographs or recordings from events we host or sponsor, and records of your engagement with our marketing communications.

We do not knowingly collect sensitive personal data, such as health information, biometric data, or criminal records, through our public websites. Where we collect this data from employees or job applicants, we do so only as permitted by local law and, where required, with consent.

3. How We Use Personal Data

• To respond to enquiries and manage the sales process, including scoping engagements and issuing proposals.
• To deliver and administer client engagements at a commercial level, such as contracting, invoicing, and account management. Personal data processed as part of the technical delivery of a service is handled under the applicable client agreement, not this Policy.
• To communicate with you about your enquiry, our services, technical notices, or changes to our terms and policies.
• To evaluate job applications and manage recruitment, onboarding, and employment administration.
• To operate, secure, and improve our websites and internal systems, including detecting and preventing fraud, unauthorised access, and misuse.
• To send marketing communications about our services, research, and events, where you have agreed to receive them or as otherwise permitted by law, and to allow you to opt out at any time.
• To comply with legal and regulatory obligations, including responding to lawful requests from courts, regulators, or law enforcement.

We rely on your consent, the steps necessary to enter into or perform a contract with you or your organisation, our legitimate business interests (such as direct marketing to existing business contacts, or maintaining the security of our systems), or a legal obligation, as the basis for these uses. Where consent is our basis for processing, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. How We Collect Personal Data

• Directly from you: when you contact us, complete a form, register for an event, or apply for a role.
• Automatically: through cookies, log files, and similar tracking technologies when you use our websites (see Section 6).
• From third parties: from your employer or the organisation that engaged us, from business partners and referral sources, from publicly available professional profiles, and, for job applicants, from references and background check providers where permitted by law.

5. Cookies and Tracking Technologies

Our websites use cookies and similar technologies to operate core functionality, remember preferences, and understand how visitors use our site. [Insert cookie category table and vendor list, e.g., strictly necessary, analytics, and marketing cookies, once the site’s cookie audit is complete.] You can manage cookie preferences through the cookie banner on our website and through your browser settings. Blocking certain cookies may affect site functionality.

6. Disclosure of Personal Data

We disclose personal data only where necessary and to the following categories of recipient:

• Affiliates: our offices in Singapore, Hong Kong, Malaysia, and the Philippines, for group-wide operations and account management.
• Service providers: vendors who support our operations, such as cloud hosting, IT infrastructure, email and communications platforms, payroll processors, and recruitment platforms, bound by contractual confidentiality and data protection obligations.
• Professional advisers: lawyers, auditors, and insurers, where necessary for our business or to obtain advice.
• Regulators and authorities: where required by law, court order, or a valid request from a regulator or law enforcement body, or to establish, exercise, or defend legal claims.
• Business transaction counterparties: in connection with a proposed or actual merger, acquisition, financing, or sale of business assets.

Theos Cyber does not sell personal data to third parties for monetary or other valuable consideration.

7. Cross-Border Transfer of Personal Data

As a regional business, we transfer personal data between our offices in Singapore, Hong Kong, Malaysia, and the Philippines, and to service providers located outside these jurisdictions, including in the United States and other countries where our infrastructure and vendors operate. Where we transfer personal data across borders, we take steps required by the applicable law of the originating jurisdiction, which may include:

• Confirming that the recipient jurisdiction has data protection laws that are comparable to, or that provide protection at least as good as, the originating jurisdiction’s law.
• Putting in place contractual obligations with the recipient, such as data processing agreements or standard clauses, requiring a comparable standard of protection.
• Conducting a transfer risk assessment where required, for example under Malaysia’s PDPA following the 2024 amendments.
• Relying on your consent or another exception permitted under the relevant law, where applicable.

8. Retention

We keep personal data only for as long as necessary to fulfil the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements. [Insert specific retention schedule once confirmed, e.g., job applicant data retained for 12 months; client contact data retained for the duration of the commercial relationship plus a defined period; website enquiry data retained for a defined period.] Where a specific retention period is required by local law, such as employment or tax record obligations, we retain the data for that period.

9. Security Measures

As a cybersecurity firm, we hold our own handling of personal data to the standard we advise our clients to meet. We apply administrative, technical, and physical safeguards proportionate to the sensitivity of the data, including access controls, encryption in transit, and monitoring of our systems. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting personal data, we will notify the relevant regulator and affected individuals where required by the applicable law, including within the 72-hour window required under Malaysia’s PDPA and the timeframes required under the PDPA in Singapore, the DPA in the Philippines, and the PDPO in Hong Kong.

10. Your Rights

Subject to the exceptions and limitations set out in the applicable law, you have rights over the personal data we hold about you. These rights differ by jurisdiction, summarised below.

To exercise any of these rights, contact us using the details in Section 14. We may need to verify your identity before acting on a request, and we may decline a request where a legal exception applies, in which case we will explain why.

11. Job Applicants and Employees

If you apply for a role with us, we use the information you provide to assess your suitability, and we may contact references or conduct background checks where permitted by local law. If you are an employee or contractor, we process your personal data to administer your employment, including payroll, benefits, performance management, and compliance with our policies. Where required by local law, we will identify a specific legal basis or obtain your consent before processing sensitive categories of employee data, such as health information connected to leave or accommodation requests.

12. Children’s Data

Our websites and services are directed at businesses and professionals. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without appropriate consent, contact us and we will take steps to delete it.

13. Third-Party Links

Our websites may link to third-party sites, including client and partner portals. This Policy does not apply to those sites. We encourage you to review the privacy policy of any third-party site you visit.

14. How to Contact Us

For questions about this Policy or to exercise your rights, contact our Data Protection Officer:

• Email: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant regulator: the PDPC in Singapore, the PCPD in Hong Kong, the JPDP in Malaysia, or the NPC in the Philippines.

15. Updates to This Policy

We may update this Policy from time to time to reflect changes in our practices or in the law. We will post the updated version on our website with a revised effective date, and where changes are material, we will provide additional notice as required by law.