Privacy Policy & PDPA

Last updated: 1 June 2026

This page sets out Cosmo System Pte Ltd’s Privacy Policy and Personal Data Protection Policy under Singapore’s Personal Data Protection Act 2012 (PDPA).

• Part A – Privacy Policy
• Part B – Personal Data Protection Policy (PDPA)

Part A – Privacy Policy

1. Introduction

Cosmo System Pte Ltd (“Cosmo”, “we”, “us” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose and protect personal data in accordance with Singapore’s Personal Data Protection Act 2012 (the “PDPA”).

This Privacy Policy applies to personal data we collect through our website (www.cosmo.com.sg), when you enquire about or use our services, and in the course of our business dealings with you. By providing your personal data to us, you agree to its collection, use and disclosure as described in this Privacy Policy.

2. Who We Are

Cosmo is a Singapore-based provider of managed web hosting, colocation and cloud infrastructure services, and is certified to ISO/IEC 27001 for information security management. Our customers are businesses and organisations.

3. Personal Data We Collect

We keep the personal data we collect to a minimum. We generally collect:

• Customer and business contact information: name of contact person, company name, company address, email address and contact number;
• Account and billing information: service subscriptions, invoices and payment records relating to your organisation’s account;
• Communications: records of enquiries, support requests and correspondence with us;
• Data centre access information: names and contact details of personnel authorised by colocation customers to access the data centre facility;
• Website information: information you submit through our website forms, and technical information collected automatically such as IP address, browser type, pages visited and cookies (see Section 8).

We do not ask for sensitive personal data such as health, religious or financial account information, and we do not maintain any social media pages that collect personal data.

4. Data You Host on Our Services

When our customers use our hosting, cloud or colocation services, they may store content, applications and data – which may include personal data of their own customers or users – on our infrastructure (“Customer Data”).

• Our customers own and control Customer Data, and are responsible for its content and for complying with applicable data protection laws, including providing their own privacy notices.
• We do not access, use or disclose Customer Data except as necessary to provide and support the services, as instructed by the customer, or as required by law.
• Where we process Customer Data on a customer’s behalf, we do so as a service provider (data intermediary) and protect it with the security measures described in Section 7.
• Security is a shared responsibility. We secure the infrastructure and the components we manage. Customers are responsible for securing the websites, applications (such as WordPress and its plugins) and any other software they install, operating systems, accounts and equipment that they manage, including keeping them patched and up to date.

If you are an end-user of one of our customers and have a question about your personal data, please contact that organisation directly. We will assist our customers where reasonably required.

5. How We Use Personal Data

We use personal data for the following purposes:

• providing, managing and supporting the services you or your organisation have subscribed to;
• processing orders, account administration, billing and collection of payments;
• responding to enquiries, quotations and technical support requests;
• sending service notices, such as maintenance, incident and security notifications;
• managing access to data centre facilities;
• informing business contacts about our services, promotions and events (you may opt out at any time);
• improving our website and services;
• managing our relationships with suppliers and partners;
• processing job applications; and
• complying with legal, regulatory and audit requirements, and protecting our legal rights.

6. Disclosure of Personal Data

We do not sell personal data. We may disclose personal data to the following parties, only to the extent necessary for the purposes above:

• data centre operators, to arrange facility access for your authorised personnel;
• service providers that support our business operations, such as cloud productivity, accounting and IT service providers, who are contractually required to protect the data;
• professional advisers and auditors, such as our lawyers, accountants and certification auditors;
• government or regulatory authorities, where required or authorised by law; and
• a successor entity, in connection with a merger, acquisition or restructuring of our business, subject to appropriate confidentiality safeguards.

7. How We Protect Personal Data

We maintain an Information Security Management System certified to ISO/IEC 27001. Our safeguards include role-based access controls, multi-factor authentication, firewalls, encryption of data in transit, malware protection, regular patching and vulnerability management, logging and monitoring, staff confidentiality obligations and training, and secure Singapore data centre facilities with 24×7 physical security.

While we take reasonable measures to protect personal data, no method of transmission over the internet or electronic storage is completely secure. If a data breach occurs that is likely to cause significant harm to you, we will notify you and the Personal Data Protection Commission as required by the PDPA.

8. Cookies

Our website uses cookies and similar technologies to make the website work, to remember your preferences and to understand how visitors use the site (for example, through web analytics). You can set your browser to refuse cookies or to alert you when cookies are sent; however, some parts of the website may not function properly as a result.

9. Retention of Personal Data

We retain personal data only for as long as needed to fulfil the purposes for which it was collected, or as required for legal, accounting or business purposes. For example, billing and contract records are generally kept for at least five (5) years after the end of the relevant financial year, as required by Singapore law. When personal data is no longer needed, we securely delete, destroy or anonymise it.

10. Where Your Personal Data Is Stored

Our data centres, backups and primary business systems are located in Singapore. If personal data is transferred outside Singapore (for example, where one of our service providers stores or supports data overseas), we will take reasonable steps to ensure it continues to receive a standard of protection comparable to that under the PDPA.

11. Your Choices and Rights

Subject to the PDPA, you may:

• request access to your personal data that we hold, and information about how it has been used or disclosed in the past year;
• request correction of any error or omission in your personal data;
• withdraw your consent to our collection, use or disclosure of your personal data; and
• unsubscribe from marketing emails at any time using the link provided in each email.

Please send your request to our Data Protection Officer (Section 12). We may need to verify your identity before acting on your request. We will respond as soon as reasonably possible, and generally within 30 days. A reasonable fee may be charged for access requests; we will inform you of the fee beforehand.

If you withdraw your consent, we may not be able to continue to provide certain services to you or your organisation, and we will inform you of the likely consequences before processing your request.

12. Contact Us

If you have any questions, requests or complaints about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer:

We will acknowledge your complaint within three (3) business days and aim to resolve it within 30 days. If you are not satisfied with our response, you may contact the Personal Data Protection Commission (www.pdpc.gov.sg).

13. Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law or our business practices. The updated version will be posted on our website with a revised “Last Updated” date. Please check this page periodically.

Part B – Personal Data Protection Policy (PDPA)

1. Purpose

Cosmo System Pte Ltd (“Cosmo”, “we”, “us” or “our”) is committed to protecting personal data in accordance with the Personal Data Protection Act 2012 of Singapore, as amended by the Personal Data Protection (Amendment) Act 2020 (the “PDPA”), and its subsidiary regulations and the advisory guidelines issued by the Personal Data Protection Commission (“PDPC”).

This Policy sets out how Cosmo complies with the data protection obligations under the PDPA, and the roles and responsibilities of Cosmo and its staff in handling personal data. It is supported by Cosmo’s Privacy Policy (Part A above) and the procedures listed in Section 14.

2. Scope

This Policy applies to:

• all personal data collected, used, disclosed or retained by Cosmo in the course of its business, in electronic or physical form;
• all Cosmo employees, contractors and temporary staff (“Staff”); and
• third parties that process personal data on Cosmo’s behalf.

3. About Our Business and Our Role under the PDPA

Cosmo is a Singapore-based provider of managed web hosting, colocation and cloud (Infrastructure-as-a-Service) services, and is certified to ISO/IEC 27001. Our services are delivered from data centre facilities in Singapore.

Cosmo handles personal data in two distinct capacities:

3.1 Shared Responsibility for Security

Security of hosted services is a shared responsibility between Cosmo and its customers. Unless otherwise agreed in the customer’s service agreement:

Cosmo is not responsible for data breaches that arise from components managed by the customer. Examples include an unpatched website, CMS, plugin or other software installed by the customer, weak or compromised customer credentials, or misconfiguration by the customer.

3.2 Business Contact Information

Most personal data that Cosmo collects relates to representatives of its corporate customers and suppliers. Under the PDPA, business contact information (an individual’s name, position, business telephone number, business address, business email and similar information provided for business purposes) is excluded from most of the PDPA’s data protection provisions. Notwithstanding this, Cosmo applies the safeguards in this Policy to such information as a matter of good practice.

4. Governance and Data Protection Officer

Cosmo has appointed a Data Protection Officer (“DPO”) who is responsible for ensuring Cosmo’s compliance with the PDPA. The DPO’s business contact information is published in our Privacy Policy and on our website.

The DPO’s responsibilities include:

• developing, maintaining and communicating data protection policies and procedures;
• handling access, correction and withdrawal-of-consent requests, queries and complaints;
• coordinating data breach response and notification to the PDPC and affected parties;
• conducting periodic reviews of data protection practices, aligned with Cosmo’s ISO/IEC 27001 internal audit and management review cycle;
• arranging data protection awareness training for Staff; and
• acting as the point of contact with the PDPC.

Management is accountable for providing the resources necessary for this Policy to be implemented.

5. Consent, Notification and Purpose Limitation

5.1 Types of personal data we collect

Cosmo collects only personal data that is reasonably necessary for its business. In practice, this is limited to:

• Customers and prospects: name of contact person, company name, company address, business email address and business contact number; billing and account details; records of correspondence and support requests.
• Authorised personnel for data centre access (colocation customers): name, company and contact number of personnel authorised by the customer to access the facility. Identity verification at the facility is performed by the data centre operator in accordance with its own procedures.
• Website visitors: information submitted via enquiry forms and basic technical data (such as IP address, browser type and cookies) collected automatically.
• Suppliers and partners: business contact information of representatives.
• Job applicants and employees: information provided for recruitment and employment purposes.

Cosmo does not intentionally collect sensitive personal data (such as health, religious or financial account information) about customer representatives, and does not collect full NRIC numbers or copies of NRIC unless required by law or necessary to establish identity to a high degree of fidelity, in line with the PDPC’s Advisory Guidelines on the PDPA for NRIC and other National Identification Numbers.

5.2 Purposes

Personal data is collected, used and disclosed only for purposes that a reasonable person would consider appropriate in the circumstances, including:

• providing, managing and supporting the services that customers have subscribed to;
• account administration, billing, invoicing and collection of payments;
• responding to enquiries, quotations and support requests;
• service notifications, including maintenance, incident and security notices;
• managing physical access to data centre facilities;
• sending information about Cosmo’s services to business contacts (with an easy way to opt out);
• vendor management and procurement;
• recruitment and employment administration; and
• complying with legal, regulatory and audit requirements.

5.3 Consent

Cosmo relies on the following, as permitted under the PDPA:

• Express consent given by the individual, for example when submitting an enquiry form.
• Deemed consent by conduct, where an individual voluntarily provides personal data for a purpose (for example, a customer naming a technical contact for its account).
• Deemed consent by contractual necessity, where disclosure to a third party is reasonably necessary to perform a contract with the individual or the organisation they represent.
• Exceptions to consent, such as legitimate interests, business improvement purposes or where required by law, after assessing that the exception applies.

Individuals are informed of the purposes on or before collection, primarily through our Privacy Policy, website forms and service agreements.

5.4 Withdrawal of consent

Individuals may withdraw consent by contacting the DPO. Cosmo will inform the individual of the likely consequences of withdrawal (for example, that we may be unable to continue providing services that require their contact details) and will give effect to the withdrawal within a reasonable time, generally within ten (10) business days. Withdrawal of consent does not affect Cosmo’s right to retain or use personal data where permitted or required by law.

5.5 Marketing and the Do Not Call (DNC) provisions

Marketing communications are sent to business contacts only, and every marketing email contains an unsubscribe option. Cosmo does not send marketing messages to Singapore telephone numbers registered with the DNC Registry unless clear and unambiguous consent has been obtained or an exclusion applies (for example, business-to-business marketing).

6. Access and Correction

Individuals may request access to their personal data held by Cosmo, and information about how it has been used or disclosed in the past year, or request correction of an error or omission.

• Requests are handled under the Personal Data Request and Complaint Handling Procedure (COSMO-PDP-04).
• Cosmo will respond as soon as reasonably possible and in any case within 30 days. If more time is needed, the individual will be informed in writing within 30 days of when a response can be expected.
• A reasonable fee may be charged for access requests that require significant effort; the individual will be told of the estimated fee beforehand. No fee is charged for corrections.
• Requests relating to Customer Data stored on Cosmo’s infrastructure will be referred to the relevant customer, who is the owner of that data.

7. Accuracy

Cosmo makes reasonable efforts to ensure that personal data it collects is accurate and complete, particularly where it is used to make decisions affecting the individual or is disclosed to another organisation. Customers are asked to keep their account contacts up to date through their account manager or the support desk.

8. Protection

Cosmo protects personal data in its possession or under its control by making reasonable security arrangements, implemented through its ISO/IEC 27001-certified Information Security Management System (ISMS). Key safeguards include:

9. Retention Limitation

Cosmo retains personal data only for as long as it is needed for the purpose for which it was collected, or as required for legal or business purposes. Retention periods and disposal methods are set out in the Data Retention and Disposal Schedule (COSMO-PDP-05). When personal data is no longer required, it is securely deleted, destroyed or anonymised.

Customer Data is retained in accordance with the customer’s service agreement and instructions. On termination of service, Customer Data is deleted, and storage media is securely wiped or destroyed, as described in COSMO-PDP-05.

10. Transfer Limitation

Cosmo’s data centres, customer backups and primary business systems are located in Singapore. Where personal data is transferred outside Singapore (for example, where a cloud service provider stores or supports data overseas), Cosmo will take appropriate steps to ensure that the recipient is bound by legally enforceable obligations (such as contractual clauses or binding corporate rules) or holds a recognised certification, so that the data receives a standard of protection comparable to that under the PDPA.

Cosmo does not transfer Customer Data outside Singapore unless instructed by the customer.

11. Data Breach Management and Notification

Cosmo maintains a Data Breach Management and Notification Procedure (COSMO-PDP-03), integrated with its ISO/IEC 27001 incident management process. In summary:

• Staff must report any suspected data breach to the DPO and the IT/Security team immediately.
• Cosmo will contain the breach and complete an assessment of whether it is notifiable within 30 calendar days of becoming aware of it (we aim to do so much sooner).
• Where a breach is notifiable (likely to result in significant harm to affected individuals, or affects 500 or more individuals), Cosmo will notify the PDPC within 3 calendar days of determining it is notifiable, and notify affected individuals as soon as practicable where required.
• Breaches within Cosmo’s scope of responsibility: where Cosmo acts as a data intermediary and has credible grounds to believe that a breach affecting Customer Data has occurred in infrastructure or components managed by Cosmo (see Section 3.1), Cosmo will notify the affected customer without undue delay, and in any event within 48 hours. Cosmo will also cooperate with the customer’s own assessment and notification.
• Breaches arising from customer-managed components: customers are responsible for detecting, assessing and responding to breaches in their own applications, websites, operating systems and equipment. This includes breaches caused by unpatched software such as WordPress, its plugins or any other software installed by the customer, or by compromised customer credentials. Customers are also responsible for any notification to the PDPC and affected individuals. If Cosmo becomes aware of such an incident (for example, through abuse reports or abnormal network activity), Cosmo will inform the customer as soon as practicable. Cosmo may take reasonable steps to contain the incident and protect its infrastructure and other customers, such as suspending the affected service. On request, Cosmo will provide reasonable assistance, such as available logs, and this assistance may be chargeable.

12. Accountability

Cosmo demonstrates accountability by:

• appointing a DPO and making their contact information publicly available;
• documenting and communicating this Policy, the Privacy Policy and supporting procedures to Staff;
• maintaining a personal data inventory;
• providing training to Staff; and
• reviewing compliance periodically as part of the ISMS internal audit.

Staff who breach this Policy may be subject to disciplinary action.

13. Third-Party Service Providers

Where Cosmo engages third parties that process personal data on its behalf (such as cloud, accounting or IT service providers), Cosmo will conduct appropriate due diligence and ensure that contracts include obligations to protect personal data, use it only for Cosmo’s purposes, and notify Cosmo of data breaches.

14. Review

This Policy is reviewed at least annually by the DPO, or earlier if there are material changes to the PDPA, PDPC guidance or Cosmo’s business operations.