Effective Date: 18 June 2025

1. Introduction

Monsoon Carbon Pte Ltd (“Monsoon Carbon,” “we,” “our,” or “us”) is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the requirements of:

Singapore’s Personal Data Protection Act 2012 (PDPA)

Vietnam’s Decree 13/2023/ND-CP on Personal Data Protection (PDPD)

This policy applies to all individuals who interact with Monsoon Carbon, including customers, business partners, contractors, and website visitors. By using our services, communicating with us, or visiting our website, you agree to the collection and use of your personal data as described in this policy.

2. Our Commitment to Privacy

We respect the confidentiality of your personal data and are committed to protecting it. Our internal practices ensure data is handled responsibly, with access restricted to authorized personnel and in compliance with applicable data protection laws in Singapore and Vietnam.

We regularly review and update our privacy measures to reflect regulatory changes and best practices.

3. Types of Personal Data We Collect

Depending on your interaction with us, we may collect the following types of personal data:

• Personal Identification Information: Full name, nationality, job title
• Contact Information: Full name, email address, phone number, and company name
• Employment & Business Information: Company details, business communications
• Financial Information: Limited billing or remittance information exchanged through invoice and email correspondence
• Website and Digital Information: IP address, device/browser type, and cookie activity (used for analytics and ad tracking)
• Communications and Correspondence: Emails, form submissions, and other communications exchanged with our team

We do not intentionally collect sensitive personal data (e.g., health, biometric, religious, or political data).

4. Collection of Personal Data

We collect data in the following ways:

• Direct Interactions: When you contact us, complete our website forms, send invoices, or correspond via email
• Website & Digital Platforms: When you browse our website or engage with our digital tools (e.g., analytics or cookies)
• Business Engagements: When you engage with us as a customer, supplier, or partner
• Public Sources & Referrals: From publicly available business directories or third-party referrals

If you submit someone else’s data, you must ensure they have been informed and have consented.

5. Purpose of Collecting and Using Personal Data

We use your personal data for the following legitimate business purposes:

a) Business Operations & Services

1. Managing contracts and transactions
2. Delivering environmental-commodity services, including Renewable Energy Certificate (REC) and carbon-credit transactions, plus related advisory
3. Issuing and processing invoices or payments

b) Communication & Support

1. Responding to inquiries and requests
2. Providing updates related to our services
3. Enhancing customer experience

c) Marketing & Promotions

1. Sending service announcements, industry insights, or promotional content about our REC and carbon-credit offerings — only with your prior consent
2. Conducting market research and surveys

d) Compliance & Security

• Meeting legal or regulatory obligations in Singapore and Vietnam
• Verifying business credentials and conducting due diligence
• Preventing fraud, unauthorized access, or security risks

e) Website Analytics & Cookies

• Improving website performance and user experience
• Measuring campaign results and traffic using cookies and third-party analytics
• Supporting targeted advertising through platforms such as Google Ads or LinkedIn Ads

You may manage cookie preferences through your browser or our cookie banner (where available). Disabling cookies may affect site functionality.

6. Disclosure of Personal Data

We may disclose your personal data to the following parties:

• Affiliates & Business Partners: For service delivery and collaboration
• Service Providers: IT vendors, payment processors, cloud providers
• Evident and Market Registries: For facilitating renewable energy certificate and carbon credit transactions
• Government or Regulatory Authorities: As required under Singapore or Vietnam law
• Professional Advisors: Legal, audit, and compliance professionals

All third-party recipients are contractually bound to protect your data and comply with PDPA and Decree 13.

7. Cross-Border Data Transfers

Your personal data may be stored or processed on servers located in Singapore or in jurisdictions where our service providers operate.

Where data relates to Vietnamese individuals, we implement appropriate safeguards, including access controls, encryption, and internal assessments. Where required, we maintain a Cross-Border Transfer Impact Assessment Dossier in compliance with Vietnam’s Decree 13.

8. Data Protection & Security Measures

We take appropriate technical and organizational measures to protect your personal data, including:

• Restricted data access
• Data encryption and secure transmission
• Secure cloud-based storage
• Delete/archive Vietnamese leads with no activity after 12–24 months
• Regular system monitoring and internal audits

If a data breach involving personal data of Vietnamese individuals occurs, we will notify both the affected individuals and the Ministry of Public Security within 72 hours, as required by Decree 13.

9. Retention & Accuracy of Data

We retain personal data only as long as necessary for the stated purposes or as required by law. You are responsible for providing accurate, up-to-date information.

To update or correct your information, please contact us (see Section 11).

10. Your Rights Under PDPA & Decree 13

You have the following rights with respect to your personal data:

• Right to Access: Request a copy of the personal data we hold
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Withdraw Consent: Opt out of specific uses, such as marketing
• Right to Deletion: Request deletion of your data, where permitted by law
• Right to Object: Object to processing for advertising or profiling purposes

To exercise these rights, please contact us using the details below. We may charge a reasonable fee for access requests where allowed by law.

11. Contact Information & Complaints

If you have questions or complaints about our handling of your personal data, please contact:

Monsoon Carbon Office
Monsoon Carbon Pte Ltd
[email protected]
100 Tras Street, #09-01, 100 AM, Singapore 079027

We will respond within 14 working days and aim to resolve complaints within 30 days. If you are not satisfied, you may escalate your complaint to:

• Personal Data Protection Commission (PDPC) – Singapore
• Ministry of Public Security – Vietnam (for Vietnamese data subjects)

12. Changes to This Policy

We reserve the right to update this Privacy Policy to reflect changes in our practices or legal obligations. The latest version will always be available on our website. Continued use of our services after changes indicates your acceptance.

13. International Engagement – GDPR Consideration

Monsoon Carbon is based in Singapore with operations in Vietnam and provides environmental commodity services—including Renewable Energy Certificates (RECs) and carbon credits—on a business-to-business (B2B) basis.

We do not offer services directly to individuals in the European Union (EU) and do not monitor the behavior of EU residents. As such, the General Data Protection Regulation (GDPR) does not apply to our processing activities.

We may collect limited business contact information (such as name, work email, company name, and phone number) when engaging with EU-based corporate clients for the purpose of delivering our services. This data is handled in accordance with our internal privacy safeguards and the requirements of Singapore’s PDPA and Vietnam’s Decree 13.

European clients who require further clarification on data handling are welcome to contact us.