Privacy Notice and Cookie Policy

The entity responsible for the processing of personal data described in this Privacy Notice is:

Email: contact@aithoth.com

For purposes of the EU GDPR or UK GDPR, where applicable, Thoth generally acts as the data controller in respect of personal data collected through the Website.

If you have questions about our privacy practices or wish to exercise your privacy rights, please contact us using the contact details set out in Section 19.

The types of personal data we collect depend on how you interact with the Website.

We may use personal data for the following purposes.

Where the EU GDPR or UK GDPR applies, we rely on one or more lawful bases for processing personal data.

Where we rely on legitimate interests, we consider and balance our interests against the potential impact of the processing on your rights and freedoms.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Cookies are small text files that websites may place on your device when you visit them. Similar technologies may include local storage, scripts and other technologies that allow a website to recognize or store information on your device.

Current Website configuration

The Website currently uses one cookie.

The Website does not currently use:

• analytics cookies or analytics platforms;
• advertising or targeting cookies;
• marketing pixels;
• Google Tag Manager;
• Meta Pixel;
• LinkedIn Insight Tag;
• third-party advertising technologies; or
• other third-party behavioral tracking technologies.

The Website also does not currently have a third-party cookie-based analytics or advertising system.

The one cookie currently used by the Website is used for essential Website functionality and is not used for advertising or behavioral analytics.

Because the current Website configuration contains only an essential cookie, we do not currently use a cookie consent banner or cookie preference management tool.

Cookie Details

If the Website configuration changes and non-essential cookies or similar technologies are introduced, Thoth will update this Privacy Notice and, where required by applicable law, obtain consent before deploying those technologies.

Because the Website currently uses only an essential cookie, there is presently no cookie preference tool for managing different categories of cookies.

You may configure your browser to block or delete cookies. However, blocking or deleting essential cookies may affect the functionality or availability of certain Website features.

If Thoth introduces non-essential cookies or similar technologies in the future, we will implement appropriate mechanisms for obtaining and managing consent where required by applicable law.

We use certain third-party service providers to operate and maintain the Website and to support our business activities.

The principal technology and service providers currently relevant to personal data processed through the Website include:

We may disclose or make personal data available to third parties where reasonably necessary for the purposes described in this Privacy Notice.

These recipients may include:

• cloud hosting and infrastructure providers;
• email and communications service providers;
• information technology and security service providers;
• recruitment and employment-related service providers;
• professional advisers, including legal, accounting and consulting advisers;
• auditors and insurers; and
• governmental, regulatory, law-enforcement or other authorities where required or permitted by applicable law.

We may also disclose personal data:

• where required by applicable law, regulation or legal process;
• in response to lawful requests from governmental, regulatory or law-enforcement authorities;
• to establish, exercise or defend legal rights or claims;
• to detect, investigate or prevent fraud, security incidents or other unlawful activity;
• where necessary to protect the rights, property, safety or security of Thoth, our personnel, users or other persons; or
• in connection with a merger, acquisition, financing, restructuring, reorganization, sale of assets or other corporate transaction.

We do not currently disclose Website personal data to third-party advertising networks or data brokers.

Thoth may share personal data with companies within the Thoth corporate group where reasonably necessary for the purposes described in this Privacy Notice, including business operations, information technology, security, recruitment, compliance and administration.

Where required by applicable law, we will implement appropriate safeguards for such sharing.

Thoth is based in Singapore and operates globally. As a result, personal data may be transferred to, stored in or accessed from countries other than the country in which you are located.

For example, although the Website’s primary hosting environment is currently located in Singapore, certain third-party service providers used by Thoth may process personal data in other jurisdictions in accordance with their services and applicable contractual arrangements.

These countries may have data protection laws that differ from those in your jurisdiction.

Where applicable law requires safeguards for international transfers, we will implement appropriate safeguards. Depending on the circumstances, these may include:

• an adequacy decision or other recognized transfer mechanism;
• the European Commission’s Standard Contractual Clauses;
• the UK International Data Transfer Agreement or UK Addendum to the Standard Contractual Clauses;
• appropriate contractual protections;
• appropriate technical and organizational measures; or
• another legally recognized transfer mechanism.

Where required by applicable law, you may contact us using the details in Section 19 to obtain further information about the safeguards applicable to an international transfer of your personal data.

We retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, including where necessary to:

• respond to inquiries and requests;
• manage business communications and relationships;
• conduct recruitment activities;
• comply with legal, regulatory, accounting or reporting requirements;
• resolve disputes;
• establish, exercise or defend legal claims; or
• enforce our agreements and policies.

Retention periods vary depending on the nature of the personal data, the purpose for which it was collected, applicable legal requirements and our legitimate business needs.

For example, personal data submitted through a contact or demonstration form may be retained for as long as reasonably necessary to respond to the request and manage the resulting business relationship, subject to applicable retention requirements.

Recruitment information may be retained for the period reasonably necessary to complete the recruitment process and, where appropriate and permitted by law, to consider the individual for future opportunities.

Where we no longer need personal data, we will delete, anonymize or otherwise securely dispose of it in accordance with our applicable policies and legal obligations.

Information contained in internal email notifications may remain in relevant email systems for as long as reasonably necessary for ordinary business, security, legal or compliance purposes.

The retention period for the Website’s essential cookie is described in Section 5.

We implement reasonable and appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse or destruction.

Depending on the nature and risks of the processing, these measures may include:

• access controls and authentication mechanisms;
• encryption and secure communications;
• application and network security measures;
• server and infrastructure security;
• security monitoring and logging;
• data backup and recovery measures;
• vulnerability management; and
• measures designed to prevent unauthorized access to personal data.

However, no method of transmission or storage is completely secure. Accordingly, we cannot guarantee the absolute security of personal data.

Depending on your location and applicable law, you may have certain rights regarding your personal data.

These may include the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of certain processing;
• object to certain processing, including processing based on legitimate interests;
• request portability of certain personal data;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a relevant privacy or data protection regulator.

These rights are subject to applicable legal conditions and exceptions. For example, we may be permitted or required to retain certain information to comply with legal obligations or to establish, exercise or defend legal claims.

To exercise your rights, please contact us using the details in Section 19.

If the Singapore PDPA applies to our processing of your personal data, you may have rights under the PDPA, including the right to:

• request access to personal data held by us and information about how we have used or disclosed that personal data, subject to applicable exceptions;
• request correction of inaccurate or incomplete personal data; and
• withdraw consent to the collection, use or disclosure of personal data, subject to legal or contractual restrictions and reasonable notice.

Where you withdraw consent, we may no longer be able to provide certain services or respond to certain requests.

We will handle requests in accordance with the requirements and applicable exceptions under the PDPA.

If the EU GDPR or UK GDPR applies to you, you may have additional rights, including:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing based on legitimate interests;
• the right to object to certain direct marketing;
• the right to withdraw consent where processing is based on consent; and
• the right to lodge a complaint with a competent supervisory authority.

You may exercise these rights by contacting us using the details in Section 19.

Where applicable, you may lodge a complaint with a supervisory authority in the EU/EEA or the United Kingdom, including the authority in the country where you reside, work or where you believe an infringement occurred.

Privacy rights available to residents of U.S. states vary depending on applicable state law and whether Thoth is subject to that law.

Where applicable, residents may have rights relating to:

• access to personal information;
• correction of personal information;
• deletion of personal information;
• portability of personal information;
• opting out of certain forms of targeted advertising;
• opting out of the sale or sharing of personal information; and
• other rights provided by applicable U.S. state privacy laws.

Thoth does not sell personal information for monetary consideration.

The Website also does not currently use advertising pixels, targeted advertising technologies or third-party advertising networks.

Where required by applicable law, Thoth will provide additional disclosures and mechanisms for exercising applicable U.S. privacy rights.

The Website is intended for a general audience and is not directed to children.

We do not knowingly collect personal data from children through the Website where prohibited by applicable law.

If you believe that a child has provided personal data to us in circumstances where such collection was not permitted, please contact us using the details in Section 19.

If we determine that we have collected personal data from a child in circumstances where collection was not permitted, we will take appropriate steps to delete or otherwise address that information in accordance with applicable law.

The Website may contain links to websites, applications or services operated by third parties.

For example, the Website may contain links to Thoth’s social media profiles, including LinkedIn and X. These are ordinary outbound links and are not embedded social media widgets or tracking technologies.

When you click an outbound link, you may be directed to a third-party website or service that is governed by that third party’s own privacy policy and terms.

Thoth does not control and is not responsible for the privacy practices, content or security of third-party websites or services.

We encourage you to review the applicable privacy notices of third parties before providing them with personal data.

If you have questions about this Privacy Notice, our privacy practices, or wish to exercise a privacy right, please contact us at:

Email: contact@aithoth.com

We may need to verify your identity before processing certain requests in order to protect your personal data and prevent unauthorized disclosure.

We will respond to valid requests within the time period required by applicable law.

We may update this Privacy Notice from time to time to reflect changes in:

• our business practices;
• Website functionality;
• technology and service providers;
• applicable laws or regulatory requirements; or
• other circumstances affecting our processing of personal data.

When we make changes, we will update the “Last Updated” date at the top of this Privacy Notice.

Where required by applicable law, we will provide additional notice or obtain consent before implementing material changes.