Privacy Policy

1. Group Entities & Data Controllers

This Privacy Policy governs the collection, storage, processing, and transfer of personal information by the AION group of entities, operating under the ultimate ownership and governance of Tremendous Holding Ltd, domiciled in Singapore.

Depending on the nature of your interaction and geographical engagement, the relevant data controller responsible for your personal data is:

• Tremendous Holding Ltd - Incorporated in Singapore (Company Registration No. 202318492K), serving as the parent group entity and commercial contract principal for international carbon transactions.
• PT AION Carbon Asset (AION PT PMA) - Incorporated in Indonesia (NIB 1204000392819), operating out of the Bali Hub and leading Indonesian project origination, community engagements, and SRN-PPI registry alignment.
• Tremendous Pty Ltd - Incorporated in Australia (ACN 668 192 481), managing Australian landholder partnerships, savanna fire management projects, and Clean Energy Regulator (ACCU Scheme) engagements.

In this policy, “AION”, “we”, “us”, or “our” refers collectively to these entities.

2. Scope & Applicable Legal Frameworks

AION operates across multiple legal jurisdictions and designs its data protection governance to satisfy the most stringent international standards. This policy complies with:

• Singapore: Personal Data Protection Act 2012 (PDPA) and Advisory Guidelines issued by the Personal Data Protection Commission (PDPC).
• Indonesia: Law No. 27 of 2022 on Personal Data Protection (UU PDP) and associated implementing regulations.
• Australia: Privacy Act 1988 (Cth), including the 13 Australian Privacy Principles (APPs).
• European Union & United Kingdom: Regulation (EU) 2016/679 (GDPR) and UK GDPR where we interact with European entities or process European resident data.

This policy applies to data collected through our websites (aion.earth and associated subdomains), client onboarding portals, consultation forms, carbon credit procurement contracts, and supplier emissions surveys.

3. Personal Data Collected

We only collect personal information that is relevant, adequate, and strictly necessary for our professional advisory and carbon asset operations:

A. Information You Provide Voluntarily

• Contact details: Full name, corporate email address, telephone number, job title, and company name.
• Advisory inquiries: Project locations, estimated corporate emissions, sustainability target dates, and technical consultation briefs submitted via forms.
• Contractual & Onboarding information: Identification credentials required for corporate Know Your Customer (KYC) and Anti-Money Laundering (AML) due diligence, authorized signers, and corporate registry numbers.
• Supplier data: Facility addresses, operational activity data, and primary liaison details collected during Scope 3 emissions engagement programs.

B. Information Collected Automatically

• Technical telemetry: IP address, device type, browser specifications, operating system, and geographical country-level location.
• Usage telemetry: Pages visited, duration of session, click paths through project portfolios, and referral URLs.

4. Purposes of Processing

AION processes your information for the following specific and legitimate corporate purposes:

• Delivering Climate Advisory Services: Conducting greenhouse gas (GHG) footprint assessments, net zero transition roadmaps, and Scope 3 supplier data aggregation.
• Carbon Asset Origination & Contracting: Facilitating project feasibility analyses, emission reduction purchase agreements (ERPAs), and registry retirements.
• Statutory & Regulatory Compliance: Performing mandatory sanctions checks, AML verification, and corporate tax reporting in Singapore, Indonesia, and Australia.
• Client Communications: Responding to contact requests, scheduling technical consultations, and distributing our quarterly Asia Pacific carbon market intelligence briefings.
• Website Security & Optimization: Monitoring infrastructure reliability, preventing cyber threats, and optimizing platform performance.

5. Legal Bases for Processing

Under international privacy frameworks, we rely on the following lawful grounds:

6. Registries & Third-Party Disclosures

AION does not sell, rent, or trade your personal information. We disclose data only to trusted third parties strictly necessary for operational delivery:

• Carbon Registries & Standard Bodies: To execute public carbon credit issuances or irrevocable retirements, designated corporate officer names and entity details may be submitted to registries such as Verra (VCS), The Gold Standard, the Indonesian Ministry of Environment and Forestry (SRN-PPI), and the Australian Clean Energy Regulator.
• Auditors & Validation Bodies: Independent Validation and Verification Bodies (VVBs) accredited by UNFCCC or international standards.
• Technology Infrastructure Providers: Secure enterprise cloud hosting, encrypted document transmission services, and client relationship management systems subject to strict data confidentiality agreements.
• Legal Authorities: Where compelled by valid subpoena, court order, or applicable law in Singapore, Indonesia, or Australia.

7. Cross-Border Data Transfers

Because AION operates regional hubs across Singapore, Indonesia, and Australia, personal data may be transferred, accessed, and processed across national borders.

To ensure robust protection, all inter-company and vendor cross-border transfers are governed by formal Standard Contractual Clauses (SCCs) and data transfer agreements that require recipients to maintain safeguards equivalent to those mandated by the Singapore PDPA, Indonesian UU PDP, Australian APPs, and EU GDPR.

8. Retention & Security Safeguards

We apply technical and organisational measures designed to safeguard personal data against unauthorized access, loss, destruction, or alteration:

• Encryption: All data in transit is encrypted using TLS 1.3 protocol; data at rest is stored using AES-256 standard encryption.
• Access Governance: Role-based access controls (RBAC) ensuring only personnel with verified business need can view personal records.
• Retention Schedules: Contractual and transactional data is retained for 7 years following contract completion in accordance with corporate audit and tax regulations. General inquiry data is deleted after 24 months of inactivity unless active dialogue continues.

9. Your Statutory Rights

Under applicable privacy legislation in Singapore, Indonesia, Australia, and the European Union, you are entitled to exercise the following rights:

• Right of Access: Request confirmation of whether we hold personal information regarding you and receive a readable copy.
• Right to Rectification: Request correction of inaccurate, incomplete, or out-of-date personal data.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where retention is no longer necessary for legal or contractual purposes.
• Right to Withdraw Consent: Unsubscribe from marketing or newsletter communications at any time via the one-click link or direct email request.
• Right to Object or Restrict Processing: Object to processing based on legitimate interests on grounds relating to your particular situation.

To exercise any of these rights, contact our Data Protection Officer at privacy@aionclimate.com. We respond to all verified requests within 30 days without charge.

10. Cookies & Tracking Technologies

Our websites employ cookies and similar session storage technologies to maintain platform security, preserve user preferences, and analyze anonymized site traffic.

You can manage, review, or modify your cookie consent at any time using the “Cookie Settings” button located in the footer at the bottom of any page, or by reviewing our dedicated Cookie Policy.

11. Contact & Grievance Redressal

If you have questions, feedback, or concerns regarding this Privacy Policy or our data handling practices, please contact our Data Governance team:

If you believe our processing violates your statutory rights, you may also lodge a complaint with your local data protection regulator: the Personal Data Protection Commission (Singapore), the Ministry of Communication and Informatics / PDP Authority (Indonesia), or the Office of the Australian Information Commissioner (OAIC).