Privacy Policy
Effective 15 April 2026
This Privacy Policy explains how Innolabs collects, uses, and protects personal data. “Innolabs” means Innolabs KH Co., Ltd. and Innolabs Pte. Ltd., whichever is the responsible entity. See our Terms of Service for full entity details and contracting rules.
1. Who is responsible for your data
- Innolabs KH Co., Ltd. — for clients and visitors based in Cambodia, and for internal Cambodia operations.
- Innolabs Pte. Ltd. — for clients and visitors based outside Cambodia, and for international service delivery.
Full registered office details are in our Terms of Service, §1. Questions or to exercise your rights: [email protected].
2. What personal data we collect
- Contact and account data: name, job title, company, email, phone, postal address, communication preferences.
- Commercial data: quotations, contracts, invoices, payment records, project correspondence.
- Service data: data you upload to or process through our hosted systems (Odoo databases, POS transactions, etc.). We process this as a data processor on your instructions.
- Website analytics: we use Plausible Analytics, a privacy-focused, cookieless analytics tool. Plausible does not use cookies, does not track visitors across sites, and does not collect personal data. It captures anonymous, aggregated statistics only. See plausible.io/data-policy.
- Support and communication: emails, chat messages, meeting notes, and any information you share while receiving support.
We do not use Google Analytics, Meta Pixel, or other third-party tracking cookies.
3. How we use your data and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Delivering services under your contract | Performance of a contract |
| Invoicing, accounting, tax filings | Legal obligation |
| Responding to inquiries and support | Legitimate interest / pre-contractual steps |
| Operational notifications (service updates, maintenance) | Legitimate interest |
| Marketing to existing clients | Legitimate interest (with opt-out) |
| Marketing to prospects | Consent |
| Website analytics (Plausible, anonymous) | Legitimate interest — no personal data |
| Security, fraud prevention, legal claims | Legitimate interest / legal obligation |
4. How long we keep your data
- Client records: for the duration of the engagement plus 10 years (to comply with Cambodian and Singaporean accounting, tax, and commercial retention requirements).
- Hosted service data: for the duration of the subscription, plus a reasonable post-termination retention period to allow export. Specific retention is set in your service order or DPA.
- Marketing contacts: until you unsubscribe or object.
- Website analytics: aggregated and anonymised — not tied to individuals.
5. Who we share data with
We do not sell personal data. We share it only with:
- Our affiliates — Innolabs KH and Innolabs SG share data between them to deliver services and run joint operations, under an intra-group agreement.
- Service providers (data processors) acting on our instructions, including cloud hosting, email providers, payment processors, and accounting systems. Each is bound by a data processing agreement.
- Professional advisors — accountants, lawyers, auditors, under confidentiality obligations.
- Authorities — when required by law, court order, or regulator request.
- Acquirers — in the context of a merger, acquisition, or sale of assets, subject to continued protection of your data.
6. International transfers
Because we operate in Cambodia and Singapore and rely on cloud infrastructure that may be located outside your country, personal data may be transferred internationally. For transfers from the European Economic Area to countries without an adequacy decision (including Cambodia), we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, together with additional technical and organisational safeguards. For transfers between Cambodia and Singapore, we rely on our intra-group agreement and PDPA cross-border transfer requirements.
7. Your rights
Depending on your location, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your data (“right to erasure”)
- Restrict or object to our processing
- Port your data to another provider
- Withdraw consent at any time, where consent is the legal basis
- Lodge a complaint with a supervisory authority — in the EU, your local data protection authority; in Singapore, the Personal Data Protection Commission (pdpc.gov.sg)
To exercise any of these rights, email [email protected]. We will respond within 30 days. We may ask for proof of identity before acting on a request.
8. Security
We use reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and loss. Measures include encryption in transit, access controls, regular backups, and staff confidentiality obligations. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify affected clients and relevant authorities as required by law.
9. Cookies and tracking
innolabs.dev does not use tracking cookies. We use Plausible Analytics (cookieless, GDPR-compliant, no personal data collected). Some essential technical cookies may be set by our website platform (Odoo) to maintain sessions or remember preferences. These are required for the site to function and do not track you across other websites.
10. Children
Our services are directed at businesses and are not intended for individuals under 16. We do not knowingly collect personal data from children.
11. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always at innolabs.dev/privacy. Material changes affecting existing clients will be notified by email at least 30 days before taking effect.
12. Contact
[email protected] · [email protected]
Innolabs KH Co., Ltd. — Cambodia · Innolabs Pte. Ltd. — Singapore