TavaSIS — tavasis.com · Operated by ZYT Pte. Ltd.
Last updated: September 2026 · Singapore PDPA compliant · GDPR applicable where relevant
ZYT Pte. Ltd. (“ZYT,” “we,” “us,” or “our”) operates the TavaSIS platform at tavasis.com. We are committed to protecting the personal data of everyone who uses our Platform.
This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights in relation to it.
This Policy applies to all users of TavaSIS, including tourism businesses (“Clients”), sustainability consultants and consulting firms (“Consultants”), and visitors to our website.
We comply with the Singapore Personal Data Protection Act 2012 (“PDPA”). Where we process personal data of individuals in the European Economic Area, we also comply with the General Data Protection Regulation (“GDPR”) as applicable.
When you create an account, we collect: full name, email address, organisation name and role, country.
When you use TavaSIS, we collect: certification project data you create or upload (documents, evidence files, checklist responses, notes); actions taken within the Platform (audit trail data, stage progressions, sign-offs); communications between Consultants and Clients within the Platform.
If you subscribe to a paid plan, payment is processed by our payment processing provider. ZYT does not store your full credit card or payment card details. We receive only transaction confirmation data (amount, date, masked payment method identifier).
We automatically collect: IP address and approximate location (country/city level); browser type and version; device type; pages visited, features used, and time spent on the Platform; error logs and performance data.
If you contact us by email or through the Platform, we retain those communications.
We use your personal data for the following purposes:
| Purpose | PDPA basis | GDPR basis |
|---|---|---|
| Providing and operating the Platform | Contractual necessity | Performance of contract |
| Processing your account registration | Contractual necessity | Performance of contract |
| Managing subscription billing | Contractual necessity | Performance of contract |
| AI-assisted guidance features | Legitimate interest / Contractual necessity | Legitimate interests |
| Improving and developing the Platform | Legitimate interest | Legitimate interests |
| Sending service and account notifications | Contractual necessity | Performance of contract |
| Responding to your enquiries | Legitimate interest | Legitimate interests |
| Complying with legal obligations | Legal obligation | Legal obligation |
| Security and fraud prevention | Legitimate interest | Legitimate interests |
We do not use your personal data for advertising or sell it to third parties.
TavaSIS includes AI-assisted features that generate guidance notes and draft content at the performance indicator level. When you use these features:
AI-generated content is a drafting aid only and must be reviewed by your Consultant. See Terms of Use Section 6.3.
We share personal data with third-party service providers who help us operate the Platform. All providers are engaged under data processing agreements and are required to process personal data only on our instructions.
| Category | Purpose |
|---|---|
| Cloud infrastructure and database provider | Platform hosting, data storage, authentication |
| Email delivery provider | Transactional emails (account notifications, password resets) |
| AI language model provider | AI-assisted performance indicator guidance and drafting features |
| Payment processing provider | Subscription billing |
| Error monitoring and performance provider | Platform stability, bug detection |
| Deployment and hosting provider | Website and application delivery |
| Web analytics provider | Aggregate visit counts. Cookieless; collects no personal data |
We do not publicly disclose the names of individual service providers. If you wish to know which specific provider processes a particular category of your data, contact us at service@tavasis.com.
We do not sell, rent, or trade your personal data. We share personal data only in the following circumstances:
Between Consultants and Clients
When a Consultant invites a Client to a project on TavaSIS, both parties have access to the shared project data within that project's scope. Consultants can view all Client-submitted evidence and notes within their projects. Clients cannot view other Clients' projects.
Legal requirements
Where we are required to disclose data by law, court order, or regulatory authority.
Business transfers
If ZYT is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users in advance.
TavaSIS is operated from Singapore. Our cloud infrastructure is hosted in the Asia-Pacific region. Some of our third-party providers process data in other countries, including the United States and the European Union.
Where personal data is transferred outside Singapore, we take steps to ensure it is protected by appropriate safeguards in accordance with the PDPA. Where we transfer data of EEA individuals outside the EEA, we rely on appropriate transfer mechanisms as required by GDPR.
Account data
Duration of account, plus 3 years after closure
Project and certification data
5 years from subscription end. Certification records may have longer requirements under applicable standards
Payment records
7 years (Singapore financial record-keeping requirements)
Error logs and technical data
Up to 12 months
Communications
3 years from date of communication
On account termination, you may request export of your project data before closure. After the retention period, data is securely deleted or anonymised.
We implement appropriate technical and organisational measures to protect your personal data, including:
No method of transmission over the internet is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.
TavaSIS uses essential cookies and session tokens required for Platform functionality (login sessions, security). We do not use third-party advertising or tracking cookies. You may manage cookie settings through your browser; however, disabling essential cookies may prevent the Platform from functioning correctly.
We do count visits to our pages. The analytics service was chosen specifically because it sets no cookies and does not fingerprint visitors: it records the page, the country, the kind of device and where the visit came from, in aggregate only. It does not follow you across other websites and collects nothing that identifies you.
To exercise any of these rights, contact us at service@tavasis.com. We will respond within 30 days (or 10 business days under PDPA). We may require verification of your identity before processing your request.
TavaSIS is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice on the Platform at least 14 days before the changes take effect.
ZYT Pte. Ltd.
Data Protection contact: dpo@zyt.one
General enquiries: service@tavasis.com
For complaints under the PDPA, you may also contact the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.
This Privacy Policy was last updated in September 2026. It is founder-drafted and pending formal legal review. ZYT recommends obtaining independent legal advice, particularly in relation to cross-border data transfers and GDPR compliance if serving EEA users at scale.