Privacy Policy
Leany Pte. Ltd., Singapore ("we", "us", "the Company").
Last updated: 11/09/2026 | Effective: 11/09/2026
1. Scope, definitions and our role
This Policy explains how we handle personal data in connection with the Leany ERP platform (the "Service").
1.1 Definitions.
- "Customer" - an organisation that subscribes to the Service.
- "Entity" - a legal entity within a Customer's organisation.
- "User" - an individual authorised by a Customer to access the Service under a seat.
- "Customer Data" - data a Customer or its Users submit to, or generate through, the Service.
- "Contact" - an individual whose personal data appears in Customer Data, including a Customer's own customers, counterparties, prospects and correspondents.
1.2 As controller. We determine the purposes and means of processing for data about:
- Users, administrators and billing contacts of a Customer account;
- individuals who contact us directly, apply for a role, or subscribe to our communications;
- visitors to our own marketing website.
This Policy governs that processing.
1.3 As processor (data intermediary). Where a Customer uses the Service to manage its own records, the Customer is the controller of Customer Data and we process it solely on the Customer's instructions. We do not use Customer Data for our own purposes. That processing is governed by our Data Processing Addendum at [DPA URL] and by the Customer's own privacy notice, not by this Policy.
Customer Data, including all data relating to Contacts, is at all times the responsibility of the Customer. The Customer alone is responsible for the lawfulness of that data, for providing any required notice, for obtaining and recording any required consent, for the accuracy and retention of the data, and for responding to any request, complaint or enquiry from a Contact concerning it. We have no direct relationship with Contacts and do not respond substantively to requests from them.
1.4 Applicable law. We are established in Singapore and our processing is governed principally by the Personal Data Protection Act 2012 ("PDPA").
Where you are located outside Singapore, we additionally observe the requirements of the data protection law applicable in your own jurisdiction to the extent it applies to our processing. This includes, where relevant, the General Data Protection Regulation (EU) 2016/679 in the European Union and European Economic Area, the UK GDPR and Data Protection Act 2018 in the United Kingdom, and the national data protection laws of the Association of Southeast Asian Nations (ASEAN) member states and other jurisdictions in which our Customers operate.
2. Personal data we collect
2.1 Account and identity data. Name, business email address, business telephone number, job title, organisation, account credentials, profile image where provided, and the Customer and Entity to which the account belongs.
2.2 Billing data. Billing name and address, tax identification and registration numbers, invoices issued, payment status, and the last four digits and expiry of a payment method. We do not collect or store full payment card numbers. Payment credentials are collected directly by our payment provider (see clause 4).
2.3 Usage and technical data. IP address, device and browser type, operating system, language and locale, features and pages accessed, timestamps, referring pages, and identifiers set by cookies and similar technologies.
2.4 Communications. Correspondence with our support and sales teams, including attachments, and records of notifications sent to you.
2.5 Content submitted in a controller capacity. Where you submit content that concerns you rather than a Contact - for example your own signature block, or a document uploaded for your own account - we treat it under this Policy.
2.6 We do not knowingly collect special categories of data (health, race, religion, biometric data, political opinions) in our controller capacity, and ask that you do not submit such data to us outside the Service's intended use.
3. Why we process it
Purpose | Legal basis (PDPA) | Legal basis (GDPR/UK GDPR, where applicable) |
|---|---|---|
Creating and administering accounts | Consent / necessary for a contract | Contract (Art. 6(1)(b)) |
Providing, maintaining and supporting the Service | Consent / legitimate interests | Contract; legitimate interests (Art. 6(1)(f)) |
Billing, invoicing, collection and tax compliance | Legitimate interests; legal obligation | Contract; legal obligation (Art. 6(1)(c)) |
Security, fraud prevention, abuse detection, logging | Legitimate interests | Legitimate interests (Art. 6(1)(f)) |
Service notices, security alerts, billing notices | Legitimate interests | Contract; legitimate interests |
Product analytics and improvement | Legitimate interests | Legitimate interests (Art. 6(1)(f)) |
Marketing communications | Consent | Consent (Art. 6(1)(a)) |
Meeting statutory record-keeping and audit obligations | Legal obligation | Legal obligation (Art. 6(1)(c)) |
We do not sell personal data, and we do not use it for automated decision-making producing legal or similarly significant effects.
4. Service providers and sub-processors
We rely on third-party providers to host and operate the Service. Each is engaged under written terms requiring appropriate protection of personal data.
We maintain a current list of these providers at [SUBPROCESSOR LIST URL]. Where we act as processor, the contractual arrangements governing these providers - including notice of changes, security commitments and transfer mechanisms - are set out in our Data Processing Addendum at [DPA URL].
Payment provider - independent controller. Our payment provider acts as merchant of record for certain transactions. In that capacity it is an independent controller of the payment data it collects, not our processor, and its own privacy notice governs that processing. We receive from it only the transaction and billing information needed to maintain our records.
5. Other disclosures
We may also disclose personal data:
- to professional advisers (legal, accounting, audit, insurance) under duties of confidentiality;
- to a tax, regulatory, law enforcement or judicial authority where compelled by applicable law, court order, subpoena or other binding legal process;
- to a successor entity in connection with a merger, acquisition, financing or sale of assets, subject to this Policy continuing to apply;
- with your consent or at your direction.
6. International transfers
Our primary hosting region is Singapore. We may add new hosting regions in the future. Personal data is nonetheless accessed from, stored in, or transferred to other jurisdictions as set out in the sub-processor list referred to in clause 4. In particular:
6.1 File storage. Files classified as critical within the Service are stored in Singapore. Other files are stored in globally distributed object storage. Copies may be held in data centres across multiple regions worldwide, with placement and replication determined automatically to deliver low-latency edge access from the requesting region, to preserve object durability through cross-region redundancy and zone isolation, and to maintain continuous availability through automatic failover in the event of a zone or region outage.
6.2 Transfer safeguards. We transfer personal data out of Singapore only where the recipient is bound to provide a standard of protection comparable to that required under section 26 of the PDPA, and where the transfer requirements of any other applicable law are satisfied.
The specific transfer mechanisms we rely on, including Standard Contractual Clauses where applicable, are set out in our Data Processing Addendum at [DPA URL]. A copy is available on request to our Data Protection Officer.
7. Retention
Data | Retention period |
|---|---|
Account and profile data | Duration of the account, then 12 months after deletion |
Billing records, invoices, tax documentation | 5 years from the end of the relevant financial year (Companies Act 1967; Income Tax Act 1947) |
Support correspondence | 12 months from last contact |
Security and access logs | 12 months |
Marketing contact data | Until consent is withdrawn, after which the marketing profile is deleted and only a pseudonymised identifier is retained, for the sole purpose of honouring your opt-out |
Customer Data processed as processor | As set out in the Data Processing Addendum |
We cease to retain personal data, or remove the means by which it can be associated with an individual, as soon as it is reasonable to assume that retention no longer serves the purpose for which it was collected and is no longer necessary for legal or business purposes.
8. Security
We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, network isolation of production systems, audit logging and a documented incident response process. These measures are described in full in Annex 2 of our Data Processing Addendum at [DPA URL].
No system is entirely secure. In the event of a data breach likely to result in significant harm, we will notify the Personal Data Protection Commission and affected individuals in accordance with Part VIA of the PDPA, and notify affected Customers without undue delay.
9. Your rights
Subject to applicable law and to any exceptions permitted under it, you may:
- request access to the personal data we hold about you and information about how it has been used or disclosed in the past year;
- request correction of inaccurate or incomplete data;
- withdraw consent for any processing based on consent, on reasonable notice - noting that we may then be unable to continue providing the Service;
- object to or restrict processing based on legitimate interests;
- request erasure or portability, where the applicable law provides those rights;
- opt out of marketing at any time, using the unsubscribe link or by contacting us.
Requests should be made to our Data Protection Officer (clause 12). We will respond within 30 days, or notify you of the time required where we cannot. Any fee will be notified to you in advance, and some requests are free of charge where applicable law requires.
If you are dissatisfied with our response, you may complain to the Personal Data Protection Commission of Singapore (pdpc.gov.sg), or to the competent data protection or supervisory authority in your own jurisdiction - including, in the European Union and European Economic Area, the supervisory authority of your Member State, and in the United Kingdom, the Information Commissioner's Office.
10. Cookies and similar technologies
We use strictly necessary cookies for authentication, session management and security, and, where you consent, analytics cookies to understand feature usage. You can manage preferences through our cookie banner or your browser settings. Disabling strictly necessary cookies will prevent the Service from functioning.
11. Children
The Service is intended for business use by adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact our Data Protection Officer and we will delete it.
12. Data Protection Officer
contact: dpo@leany.io
This address is for data protection matters only. Support, billing, sales and other enquiries should go to the relevant customer channels
13. Changes
We may update this Policy from time to time. Where a change is material, we will give at least 30 days' notice by email or in-product notification before it takes effect. The "Last updated" date above always reflects the current version, and prior versions are available on request.