Privacy Policy

Privacy Policy

Last updated: 19 August 2026

Last updated: 19 August 2026

1. Introduction

1. Introduction

Hethena ("Hethena", "we", "us", "our") is operated by United Hero Investments Ltd, a company incorporated in the Republic of Seychelles. We are committed to protecting your personal data and handling it in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA") and its regulations and guidelines issued by the Personal Data Protection Commission ("PDPC").

This Privacy Policy applies to personal data we collect through:

  • our websites, including hethena.com and app.hethena.com;

  • our waitlist signup;

  • the Hethena Creator Program application form; and

  • any other channel through which you provide personal data to us.

Hethena's health services are not yet live. We currently collect personal data only for the purposes of our waitlist and our Creator Program, as described below. If and when our health-testing service launches, we will update this Privacy Policy and obtain your explicit consent before we collect any health-related personal data. We do not collect health information through any of our current forms, and we ask that you do not include any in free-text answers.

2. Personal Data We Collect

2. Personal Data We Collect

(a) If you join our waitlist. We collect only your email address. We use it to manage the waitlist and to send you updates about Hethena's launch and services. We do not ask for, and you should not submit, any other personal data when joining the waitlist.

(b) If you apply to the Hethena Creator Program. We collect the information you submit in the application form:

  • your name and email address;

  • your Instagram, TikTok and/or YouTube handles and a sample post URL;

  • your location (city and country);

  • how you discovered the Creator Program, including, where applicable, the advertising platform you saw us on or the handle of the creator who referred you;

  • your content niche and, if selected, a description of any other niche;

  • your answer on why Hethena's mission is personally relevant to you;

  • whether you have done brand collaborations before;

  • your quoted rate (in SGD), your preferred usage terms, and any rate card file you upload;

  • whether you are 18 years of age or older; and

  • any additional notes you choose to provide.

We may also keep your application in our creator talent pool and contact you about future campaigns or collaborations, unless you ask us not to.

If you provide the handle or identity of a creator who referred you, you confirm that they have agreed to be identified to us. We use this information only to verify the referral. Please do not include personal health information, or anyone else's personal data beyond what the form asks for, in your free-text answers or uploaded files.

If you apply, we may also collect publicly available information from the social media profiles you provide (such as follower counts, engagement metrics and public content) to assess your application.

(c) Technical data. When you use our websites, we collect limited technical data (such as IP address, device and browser information, and usage behaviour) through cookies and similar technologies. We use Google Tag Manager and Google Analytics 4 for website analytics; these providers process this data on our behalf as our data intermediaries. Except for cookies that are strictly necessary to operate our websites and keep you signed in, we set these technologies only where you have consented through our cookie banner. You can change or withdraw your choice at any time using the "Cookie preferences" link in our website footer. You may also control cookies through your browser settings; disabling them may affect parts of the site. We use analytics data strictly at an aggregate level — for example, to understand website traffic and to attribute waitlist sign-ups to the creator or campaign that referred you — and we do not use it to identify or profile you as an individual. We also automatically record limited technical data (such as IP address, approximate location derived from it, timestamps, request details, and account identifiers such as the email address you submit or sign in with) in server and audit logs when you use our services, for security, fraud prevention and system-integrity purposes.

(d) Minors. Our services are not directed at individuals under 18. The Creator Program application asks whether you are 18 or older; if you are under 18, we will follow up regarding parent or guardian consent before processing your application further.

(a) If you join our waitlist. We collect only your email address. We use it to manage the waitlist and to send you updates about Hethena's launch and services. We do not ask for, and you should not submit, any other personal data when joining the waitlist.

(b) If you apply to the Hethena Creator Program. We collect the information you submit in the application form:

  • your name and email address;

  • your Instagram, TikTok and/or YouTube handles and a sample post URL;

  • your location (city and country);

  • how you discovered the Creator Program, including, where applicable, the advertising platform you saw us on or the handle of the creator who referred you;

  • your content niche and, if selected, a description of any other niche;

  • your answer on why Hethena's mission is personally relevant to you;

  • whether you have done brand collaborations before;

  • your quoted rate (in SGD), your preferred usage terms, and any rate card file you upload;

  • whether you are 18 years of age or older; and

  • any additional notes you choose to provide.

We may also keep your application in our creator talent pool and contact you about future campaigns or collaborations, unless you ask us not to.

If you provide the handle or identity of a creator who referred you, you confirm that they have agreed to be identified to us. We use this information only to verify the referral. Please do not include personal health information, or anyone else's personal data beyond what the form asks for, in your free-text answers or uploaded files.

If you apply, we may also collect publicly available information from the social media profiles you provide (such as follower counts, engagement metrics and public content) to assess your application.

(c) Technical data. When you use our websites, we collect limited technical data (such as IP address, device and browser information, and usage behaviour) through cookies and similar technologies. We use Google Tag Manager and Google Analytics 4 for website analytics; these providers process this data on our behalf as our data intermediaries. Except for cookies that are strictly necessary to operate our websites and keep you signed in, we set these technologies only where you have consented through our cookie banner. You can change or withdraw your choice at any time using the "Cookie preferences" link in our website footer. You may also control cookies through your browser settings; disabling them may affect parts of the site. We use analytics data strictly at an aggregate level — for example, to understand website traffic and to attribute waitlist sign-ups to the creator or campaign that referred you — and we do not use it to identify or profile you as an individual. We also automatically record limited technical data (such as IP address, approximate location derived from it, timestamps, request details, and account identifiers such as the email address you submit or sign in with) in server and audit logs when you use our services, for security, fraud prevention and system-integrity purposes.

(d) Minors. Our services are not directed at individuals under 18. The Creator Program application asks whether you are 18 or older; if you are under 18, we will follow up regarding parent or guardian consent before processing your application further.

3. How and Why We Use Your Personal Data

3. How and Why We Use Your Personal Data

We collect, use and disclose personal data for the following purposes:

  • Waitlist management: maintaining the waitlist, sending launch updates and service announcements to the email address you provide.

  • Creator Program: reviewing and assessing applications (including AI-assisted review of application text, with human oversight of decisions), contacting applicants, negotiating and administering collaborations, and making and keeping records of collaboration decisions.

  • Operating and improving our websites: analytics, security, troubleshooting and service improvement, using aggregated or de-identified data where possible.

  • Security, error monitoring and audit logging: maintaining server and audit logs (including IP addresses, account identifiers such as your email address, and related technical data), and collecting application error reports when something goes wrong in your browser or on our servers, to detect, investigate and prevent security incidents, faults, fraud and misuse, and to maintain the integrity and reliability of our systems.

We rely on the legitimate interests exception under the PDPA for security, error monitoring and audit logging, rather than on your consent. We have assessed that this is necessary to keep the service secure and working, and that it does not have an adverse effect on you that outweighs that benefit. These activities are not covered by the cookie banner, because they are not optional to the operation of the service.

  • Legal and regulatory compliance: meeting our obligations under Singapore law, and establishing, exercising or defending legal claims.

We only use your personal data for purposes that a reasonable person would consider appropriate in the circumstances and that we have notified to you. We will never sell or rent your personal data. Where data has been anonymised so that it no longer identifies any individual, it is no longer personal data, and we may use and retain it without restriction.

We collect, use and disclose personal data for the following purposes:

  • Waitlist management: maintaining the waitlist, sending launch updates and service announcements to the email address you provide.

  • Creator Program: reviewing and assessing applications (including AI-assisted review of application text, with human oversight of decisions), contacting applicants, negotiating and administering collaborations, and making and keeping records of collaboration decisions.

  • Operating and improving our websites: analytics, security, troubleshooting and service improvement, using aggregated or de-identified data where possible.

  • Security, error monitoring and audit logging: maintaining server and audit logs (including IP addresses, account identifiers such as your email address, and related technical data), and collecting application error reports when something goes wrong in your browser or on our servers, to detect, investigate and prevent security incidents, faults, fraud and misuse, and to maintain the integrity and reliability of our systems.

We rely on the legitimate interests exception under the PDPA for security, error monitoring and audit logging, rather than on your consent. We have assessed that this is necessary to keep the service secure and working, and that it does not have an adverse effect on you that outweighs that benefit. These activities are not covered by the cookie banner, because they are not optional to the operation of the service.

  • Legal and regulatory compliance: meeting our obligations under Singapore law, and establishing, exercising or defending legal claims.

We only use your personal data for purposes that a reasonable person would consider appropriate in the circumstances and that we have notified to you. We will never sell or rent your personal data. Where data has been anonymised so that it no longer identifies any individual, it is no longer personal data, and we may use and retain it without restriction.

By submitting the waitlist form, you consent to our collection and use of your email address for the waitlist purposes stated above.

  • By submitting the Creator Program application form, you consent to our collection, use and disclosure of your application data for the Creator Program purposes stated above, including consideration for and contact about future campaigns and collaborations.

  • By selecting your preferences in our cookie banner, you consent to our use of the non-essential cookies and similar technologies described in Section 2(c). Strictly necessary cookies are used without consent, as they are required to operate our websites.

Withdrawing consent. You may withdraw your consent at any time by contacting us using the details in Section 14. We will explain the likely consequences of withdrawal (for example, that we can no longer keep you on the waitlist or consider your application), stop collecting, using or disclosing your personal data for the relevant purposes within a reasonable time, and cease to retain it in accordance with Section 10. For cookies and similar technologies, you can withdraw or change your consent at any time using the "Cookie preferences" link in our website footer, without contacting us.

5. Marketing Messages

5. Marketing Messages

Emails we send about Hethena's launch and services are commercial messages under the Spam Control Act 2007. Every such message will accurately identify us as the sender, include accurate header and subject information, and contain a working unsubscribe facility. We will honour unsubscribe requests within 10 business days.

We do not currently collect telephone numbers. If we ever conduct telemarketing to Singapore telephone numbers, we will first check the Do Not Call Registry as required by the PDPA, unless we have your clear and unambiguous consent to be contacted.

Emails we send about Hethena's launch and services are commercial messages under the Spam Control Act 2007. Every such message will accurately identify us as the sender, include accurate header and subject information, and contain a working unsubscribe facility. We will honour unsubscribe requests within 10 business days.

We do not currently collect telephone numbers. If we ever conduct telemarketing to Singapore telephone numbers, we will first check the Do Not Call Registry as required by the PDPA, unless we have your clear and unambiguous consent to be contacted.

6. Disclosure of Personal Data

6. Disclosure of Personal Data

We disclose personal data only where necessary for the purposes above, to:

  • our staff and contractors who need access to perform their roles, under confidentiality obligations;

  • service providers acting as our data intermediaries, who process personal data only on our instructions and under written contracts, except where a provider processes certain data for its own purposes (such as fraud prevention, security or legal compliance) as described in its own privacy policy, in which case it acts as a separate organisation rather than our data intermediary, including providers of cloud hosting, storage and AI-assisted processing (Microsoft Azure including Azure OpenAI, Australia), payment processing (Stripe, USA; not yet in use), email delivery (Resend, USA; and Brevo, primarily France/EU, with additional processing by Brevo Group affiliates in Germany, India, USA and Austria), workspace and application management tools used to operate the waitlist and Creator Program (Notion, USA), website analytics (Google Tag Manager and Google Analytics 4, USA), public social-media profile enrichment for Creator Program review (Apify, Czech Republic/EU), and website hosting and content delivery for hethena.com, including built-in site analytics that use no cookies and no persistent identifiers (Framer, Netherlands/EU), and application error monitoring and performance diagnostics (Sentry, Germany/EU). These providers may engage their own sub-processors under contractual protections consistent with this Policy; up-to-date sub-processor lists are available on each provider's website;

  • professional advisers (such as lawyers and accountants) where reasonably required; and

  • regulators, law enforcement or other parties where required or authorised by law;

  • a buyer or other successor if we are involved in a merger, acquisition or sale of assets, in which case your personal data may be transferred as part of that transaction, subject to the protections in this Policy.

We remain responsible under the PDPA for personal data processed on our behalf by our data intermediaries.

7. Transfers of Personal Data Outside Singapore

7. Transfers of Personal Data Outside Singapore

Some of our service providers store or process personal data outside Singapore, including in the United States, the European Union, India and Australia. Our own personnel and contractors may also access personal data from outside Singapore, including Sri Lanka, under confidentiality and data-protection obligations consistent with the PDPA. We will only transfer personal data outside Singapore in accordance with the PDPA, by ensuring through legally enforceable obligations (such as contractual clauses) that the recipient provides a standard of protection comparable to that under the PDPA.

Some of our service providers store or process personal data outside Singapore, including in the United States, the European Union, India and Australia. Our own personnel and contractors may also access personal data from outside Singapore, including Sri Lanka, under confidentiality and data-protection obligations consistent with the PDPA. We will only transfer personal data outside Singapore in accordance with the PDPA, by ensuring through legally enforceable obligations (such as contractual clauses) that the recipient provides a standard of protection comparable to that under the PDPA.

8. Protection of Personal Data

8. Protection of Personal Data

We make reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, including:

  • encryption of data at rest and in transit;

  • role-based access controls and multi-factor authentication;

  • monitoring, logging and periodic security reviews; and

  • privacy by design, including data protection impact assessments for new initiatives.

No system is completely secure, and transmission of data over the internet carries inherent risk.

We make reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, including:

  • encryption of data at rest and in transit;

  • role-based access controls and multi-factor authentication;

  • monitoring, logging and periodic security reviews; and

  • privacy by design, including data protection impact assessments for new initiatives.

No system is completely secure, and transmission of data over the internet carries inherent risk.

9. Accuracy

9. Accuracy

We make reasonable efforts to ensure that personal data we collect is accurate and complete, especially where it is likely to be used to make a decision affecting you (such as assessing a Creator Program application) or disclosed to another organisation. Please keep your details up to date by contacting us using the details in Section 14.

We make reasonable efforts to ensure that personal data we collect is accurate and complete, especially where it is likely to be used to make a decision affecting you (such as assessing a Creator Program application) or disclosed to another organisation. Please keep your details up to date by contacting us using the details in Section 14.

10. Retention of Personal Data

10. Retention of Personal Data

We retain personal data only for as long as it is needed for the purpose for which it was collected, or as required for legal or business purposes, after which we securely delete or anonymise it. In particular:

  • Waitlist emails: retained while the waitlist is active and you remain interested; deleted or anonymised once no longer needed for the waitlist purpose (for example, after launch invitations conclude or following prolonged inactivity), unless you have become a member or consented to further contact.

  • Creator Program applications: retained for up to 24 months after our last interaction with you, to administer collaborations and keep records of decisions, or longer where you remain in our creator talent pool for consideration for future campaigns, after which they are deleted or anonymised. You may ask us to remove your application from the talent pool at any time using the contact details in Section 14.

  • Server and audit logs: retained for a limited period consistent with our security and audit needs, after which they are deleted or anonymised.

  • Consent records: records of the consents you give, including the version of the privacy policy shown and the date, are retained for as long as we rely on that consent and for a reasonable period afterwards so that we can demonstrate compliance — including where the underlying personal data has already been deleted.

Residual encrypted copies may persist temporarily in system backups before being overwritten in the ordinary course.

We retain personal data only for as long as it is needed for the purpose for which it was collected, or as required for legal or business purposes, after which we securely delete or anonymise it. In particular:

  • Waitlist emails: retained while the waitlist is active and you remain interested; deleted or anonymised once no longer needed for the waitlist purpose (for example, after launch invitations conclude or following prolonged inactivity), unless you have become a member or consented to further contact.

  • Creator Program applications: retained for up to 24 months after our last interaction with you, to administer collaborations and keep records of decisions, or longer where you remain in our creator talent pool for consideration for future campaigns, after which they are deleted or anonymised. You may ask us to remove your application from the talent pool at any time using the contact details in Section 14.

  • Server and audit logs: retained for a limited period consistent with our security and audit needs, after which they are deleted or anonymised.

  • Consent records: records of the consents you give, including the version of the privacy policy shown and the date, are retained for as long as we rely on that consent and for a reasonable period afterwards so that we can demonstrate compliance — including where the underlying personal data has already been deleted.

Residual encrypted copies may persist temporarily in system backups before being overwritten in the ordinary course.

11. Data Breach Notification

11. Data Breach Notification

We assess suspected data breaches promptly. Where a breach is notifiable under the PDPA (that is, it is likely to result in significant harm to affected individuals, or is of a significant scale), we will notify the PDPC as soon as practicable and in any case within 3 calendar days of assessing the breach to be notifiable, and we will notify affected individuals where the breach is likely to result in significant harm to them.

We assess suspected data breaches promptly. Where a breach is notifiable under the PDPA (that is, it is likely to result in significant harm to affected individuals, or is of a significant scale), we will notify the PDPC as soon as practicable and in any case within 3 calendar days of assessing the breach to be notifiable, and we will notify affected individuals where the breach is likely to result in significant harm to them.

12. Your Rights: Access, Correction and Complaints

12. Your Rights: Access, Correction and Complaints

  • Access: You may request access to personal data we hold about you and information about how it has been used or disclosed in the past year. We will respond as soon as reasonably possible; if we cannot respond within 30 days, we will inform you in writing of the time by which we will respond. We may charge a reasonable fee for access requests; if so, we will inform you of the estimated fee before processing your request.

  • Correction: You may ask us to correct an error or omission in your personal data. We will make the correction as soon as practicable unless a legal exception applies.

Access and correction rights are subject to the exceptions set out in the PDPA, and we may decline a request where an exception applies.

  • Complaints: If you have a concern about our handling of your personal data, please contact our Data Protection Officer using the details in Section 14. We will acknowledge and investigate your complaint promptly. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission via its website at www.pdpc.gov.sg.

13. Updates to This Policy

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. The "last updated" date will always be shown at the top. We will notify you of significant changes by email or a notice on our website, and we will seek fresh consent where a change involves using your personal data for a materially different purpose.

We may update this Privacy Policy from time to time to reflect changes in law or our practices. The "last updated" date will always be shown at the top. We will notify you of significant changes by email or a notice on our website, and we will seek fresh consent where a change involves using your personal data for a materially different purpose.

14. Contact us/Data Protection Officer

14. Contact us/Data Protection Officer

For questions, access or correction requests, consent withdrawal, or complaints, please contact our Data Protection Officer:

  • Email: privacy@hethena.com

  • Post: United Hero Investments Ltd, Suite 23, 1st Floor, Eden Plaza, Eden Island, Mahé, Republic of Seychelles

For questions, access or correction requests, consent withdrawal, or complaints, please contact our Data Protection Officer:

  • Email: privacy@hethena.com

  • Post: United Hero Investments Ltd, Suite 23, 1st Floor, Eden Plaza, Eden Island, Mahé, Republic of Seychelles

Privacy Policy

Last updated: 19 August 2026

1. Introduction

Hethena ("Hethena", "we", "us", "our") is operated by United Hero Investments Ltd, a company incorporated in the Republic of Seychelles. We are committed to protecting your personal data and handling it in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA") and its regulations and guidelines issued by the Personal Data Protection Commission ("PDPC").

This Privacy Policy applies to personal data we collect through:

  • our websites, including hethena.com and app.hethena.com;

  • our waitlist signup;

  • the Hethena Creator Program application form; and

  • any other channel through which you provide personal data to us.

Hethena's health services are not yet live. We currently collect personal data only for the purposes of our waitlist and our Creator Program, as described below. If and when our health-testing service launches, we will update this Privacy Policy and obtain your explicit consent before we collect any health-related personal data. We do not collect health information through any of our current forms, and we ask that you do not include any in free-text answers.

2. Personal Data We Collect

(a) If you join our waitlist. We collect only your email address. We use it to manage the waitlist and to send you updates about Hethena's launch and services. We do not ask for, and you should not submit, any other personal data when joining the waitlist.

(b) If you apply to the Hethena Creator Program. We collect the information you submit in the application form:

  • your name and email address;

  • your Instagram, TikTok and/or YouTube handles and a sample post URL;

  • your location (city and country);

  • how you discovered the Creator Program, including, where applicable, the advertising platform you saw us on or the handle of the creator who referred you;

  • your content niche and, if selected, a description of any other niche;

  • your answer on why Hethena's mission is personally relevant to you;

  • whether you have done brand collaborations before;

  • your quoted rate (in SGD), your preferred usage terms, and any rate card file you upload;

  • whether you are 18 years of age or older; and

  • any additional notes you choose to provide.

We may also keep your application in our creator talent pool and contact you about future campaigns or collaborations, unless you ask us not to.

If you provide the handle or identity of a creator who referred you, you confirm that they have agreed to be identified to us. We use this information only to verify the referral. Please do not include personal health information, or anyone else's personal data beyond what the form asks for, in your free-text answers or uploaded files.

If you apply, we may also collect publicly available information from the social media profiles you provide (such as follower counts, engagement metrics and public content) to assess your application.

(c) Technical data. When you use our websites, we collect limited technical data (such as IP address, device and browser information, and usage behaviour) through cookies and similar technologies. We use Google Tag Manager and Google Analytics 4 for website analytics; these providers process this data on our behalf as our data intermediaries. Except for cookies that are strictly necessary to operate our websites and keep you signed in, we set these technologies only where you have consented through our cookie banner. You can change or withdraw your choice at any time using the "Cookie preferences" link in our website footer. You may also control cookies through your browser settings; disabling them may affect parts of the site. We use analytics data strictly at an aggregate level — for example, to understand website traffic and to attribute waitlist sign-ups to the creator or campaign that referred you — and we do not use it to identify or profile you as an individual. We also automatically record limited technical data (such as IP address, approximate location derived from it, timestamps, request details, and account identifiers such as the email address you submit or sign in with) in server and audit logs when you use our services, for security, fraud prevention and system-integrity purposes.

(d) Minors. Our services are not directed at individuals under 18. The Creator Program application asks whether you are 18 or older; if you are under 18, we will follow up regarding parent or guardian consent before processing your application further.

3. How and Why We Use Your Personal Data

We collect, use and disclose personal data for the following purposes:

  • Waitlist management: maintaining the waitlist, sending launch updates and service announcements to the email address you provide.

  • Creator Program: reviewing and assessing applications (including AI-assisted review of application text, with human oversight of decisions), contacting applicants, negotiating and administering collaborations, and making and keeping records of collaboration decisions.

  • Operating and improving our websites: analytics, security, troubleshooting and service improvement, using aggregated or de-identified data where possible.

  • Security, error monitoring and audit logging: maintaining server and audit logs (including IP addresses, account identifiers such as your email address, and related technical data), and collecting application error reports when something goes wrong in your browser or on our servers, to detect, investigate and prevent security incidents, faults, fraud and misuse, and to maintain the integrity and reliability of our systems.

We rely on the legitimate interests exception under the PDPA for security, error monitoring and audit logging, rather than on your consent. We have assessed that this is necessary to keep the service secure and working, and that it does not have an adverse effect on you that outweighs that benefit. These activities are not covered by the cookie banner, because they are not optional to the operation of the service.

  • Legal and regulatory compliance: meeting our obligations under Singapore law, and establishing, exercising or defending legal claims.

We only use your personal data for purposes that a reasonable person would consider appropriate in the circumstances and that we have notified to you. We will never sell or rent your personal data. Where data has been anonymised so that it no longer identifies any individual, it is no longer personal data, and we may use and retain it without restriction.

By submitting the waitlist form, you consent to our collection and use of your email address for the waitlist purposes stated above.

  • By submitting the Creator Program application form, you consent to our collection, use and disclosure of your application data for the Creator Program purposes stated above, including consideration for and contact about future campaigns and collaborations.

  • By selecting your preferences in our cookie banner, you consent to our use of the non-essential cookies and similar technologies described in Section 2(c). Strictly necessary cookies are used without consent, as they are required to operate our websites.

Withdrawing consent. You may withdraw your consent at any time by contacting us using the details in Section 14. We will explain the likely consequences of withdrawal (for example, that we can no longer keep you on the waitlist or consider your application), stop collecting, using or disclosing your personal data for the relevant purposes within a reasonable time, and cease to retain it in accordance with Section 10. For cookies and similar technologies, you can withdraw or change your consent at any time using the "Cookie preferences" link in our website footer, without contacting us.

5. Marketing Messages

Emails we send about Hethena's launch and services are commercial messages under the Spam Control Act 2007. Every such message will accurately identify us as the sender, include accurate header and subject information, and contain a working unsubscribe facility. We will honour unsubscribe requests within 10 business days.

We do not currently collect telephone numbers. If we ever conduct telemarketing to Singapore telephone numbers, we will first check the Do Not Call Registry as required by the PDPA, unless we have your clear and unambiguous consent to be contacted.

6. Disclosure of Personal Data

We disclose personal data only where necessary for the purposes above, to:

  • our staff and contractors who need access to perform their roles, under confidentiality obligations;

  • service providers acting as our data intermediaries, who process personal data only on our instructions and under written contracts, except where a provider processes certain data for its own purposes (such as fraud prevention, security or legal compliance) as described in its own privacy policy, in which case it acts as a separate organisation rather than our data intermediary, including providers of cloud hosting, storage and AI-assisted processing (Microsoft Azure including Azure OpenAI, Australia), payment processing (Stripe, USA; not yet in use), email delivery (Resend, USA; and Brevo, primarily France/EU, with additional processing by Brevo Group affiliates in Germany, India, USA and Austria), workspace and application management tools used to operate the waitlist and Creator Program (Notion, USA), website analytics (Google Tag Manager and Google Analytics 4, USA), public social-media profile enrichment for Creator Program review (Apify, Czech Republic/EU), and website hosting and content delivery for hethena.com, including built-in site analytics that use no cookies and no persistent identifiers (Framer, Netherlands/EU), and application error monitoring and performance diagnostics (Sentry, Germany/EU). These providers may engage their own sub-processors under contractual protections consistent with this Policy; up-to-date sub-processor lists are available on each provider's website;

  • professional advisers (such as lawyers and accountants) where reasonably required; and

  • regulators, law enforcement or other parties where required or authorised by law;

  • a buyer or other successor if we are involved in a merger, acquisition or sale of assets, in which case your personal data may be transferred as part of that transaction, subject to the protections in this Policy.

We remain responsible under the PDPA for personal data processed on our behalf by our data intermediaries.

7. Transfers of Personal Data Outside Singapore

Some of our service providers store or process personal data outside Singapore, including in the United States, the European Union, India and Australia. Our own personnel and contractors may also access personal data from outside Singapore, including Sri Lanka, under confidentiality and data-protection obligations consistent with the PDPA. We will only transfer personal data outside Singapore in accordance with the PDPA, by ensuring through legally enforceable obligations (such as contractual clauses) that the recipient provides a standard of protection comparable to that under the PDPA.

8. Protection of Personal Data

We make reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, including:

  • encryption of data at rest and in transit;

  • role-based access controls and multi-factor authentication;

  • monitoring, logging and periodic security reviews; and

  • privacy by design, including data protection impact assessments for new initiatives.

No system is completely secure, and transmission of data over the internet carries inherent risk.

9. Accuracy

We make reasonable efforts to ensure that personal data we collect is accurate and complete, especially where it is likely to be used to make a decision affecting you (such as assessing a Creator Program application) or disclosed to another organisation. Please keep your details up to date by contacting us using the details in Section 14.

10. Retention of Personal Data

We retain personal data only for as long as it is needed for the purpose for which it was collected, or as required for legal or business purposes, after which we securely delete or anonymise it. In particular:

  • Waitlist emails: retained while the waitlist is active and you remain interested; deleted or anonymised once no longer needed for the waitlist purpose (for example, after launch invitations conclude or following prolonged inactivity), unless you have become a member or consented to further contact.

  • Creator Program applications: retained for up to 24 months after our last interaction with you, to administer collaborations and keep records of decisions, or longer where you remain in our creator talent pool for consideration for future campaigns, after which they are deleted or anonymised. You may ask us to remove your application from the talent pool at any time using the contact details in Section 14.

  • Server and audit logs: retained for a limited period consistent with our security and audit needs, after which they are deleted or anonymised.

  • Consent records: records of the consents you give, including the version of the privacy policy shown and the date, are retained for as long as we rely on that consent and for a reasonable period afterwards so that we can demonstrate compliance — including where the underlying personal data has already been deleted.

Residual encrypted copies may persist temporarily in system backups before being overwritten in the ordinary course.

11. Data Breach Notification

We assess suspected data breaches promptly. Where a breach is notifiable under the PDPA (that is, it is likely to result in significant harm to affected individuals, or is of a significant scale), we will notify the PDPC as soon as practicable and in any case within 3 calendar days of assessing the breach to be notifiable, and we will notify affected individuals where the breach is likely to result in significant harm to them.

12. Your Rights: Access, Correction and Complaints

  • Access: You may request access to personal data we hold about you and information about how it has been used or disclosed in the past year. We will respond as soon as reasonably possible; if we cannot respond within 30 days, we will inform you in writing of the time by which we will respond. We may charge a reasonable fee for access requests; if so, we will inform you of the estimated fee before processing your request.

  • Correction: You may ask us to correct an error or omission in your personal data. We will make the correction as soon as practicable unless a legal exception applies.

Access and correction rights are subject to the exceptions set out in the PDPA, and we may decline a request where an exception applies.

  • Complaints: If you have a concern about our handling of your personal data, please contact our Data Protection Officer using the details in Section 14. We will acknowledge and investigate your complaint promptly. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission via its website at www.pdpc.gov.sg.

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. The "last updated" date will always be shown at the top. We will notify you of significant changes by email or a notice on our website, and we will seek fresh consent where a change involves using your personal data for a materially different purpose.

14. Contact us/Data Protection Officer

For questions, access or correction requests, consent withdrawal, or complaints, please contact our Data Protection Officer:

  • Email: privacy@hethena.com

  • Post: United Hero Investments Ltd, Suite 23, 1st Floor, Eden Plaza, Eden Island, Mahé, Republic of Seychelles