隐私政策

1. 集团实体与数据控制者

This Privacy Policy governs the collection, storage, processing, and transfer of personal information by the AION group of entities, operating under the ultimate ownership and governance of Tremendous Holding Ltd, domiciled in Singapore.

根据您的业务互动性质与所在地理区域，负责您个人数据的相关数据控制者包括：

• Tremendous Holding Ltd - Incorporated in Singapore (Company Registration No. 202318492K), serving as the parent group entity and commercial contract principal for international carbon transactions.
• PT AION Carbon Asset (AION PT PMA) - Incorporated in Indonesia (NIB 1204000392819), operating out of the Bali Hub and leading Indonesian project origination, community engagements, and SRN-PPI registry alignment.
• Tremendous Pty Ltd - Incorporated in Australia (ACN 668 192 481), managing Australian landholder partnerships, savanna fire management projects, and Clean Energy Regulator (ACCU Scheme) engagements.

在本政策中，“AION”或“我们”统指上述法人实体。

2. 适用范围与适用法律框架

AION 在多个司法管辖区开展业务，其数据保护治理体系旨在符合严格的国际合规标准。本政策遵循：

• 新加坡： Personal Data Protection Act 2012 (PDPA) and Advisory Guidelines issued by the Personal Data Protection Commission (PDPC).
• 印度尼西亚： Law No. 27 of 2022 on Personal Data Protection (UU PDP) and associated implementing regulations.
• 澳大利亚： Privacy Act 1988 (Cth), including the 13 Australian Privacy Principles (APPs).
• 欧盟与英国： Regulation (EU) 2016/679 (GDPR) and UK GDPR where we interact with European entities or process European resident data.

This policy applies to data collected through our websites (aionclimate.com and associated subdomains), client onboarding portals, consultation forms, carbon credit procurement contracts, and supplier emissions surveys.

3. 收集的个人数据类别

我们仅收集与专业咨询及碳资产运营业务直接相关、充分且严格必要的个人信息：

A. 您主动提供的信息

• 联络信息： Full name, corporate email address, telephone number, job title, and company name.
• 咨询问询内容： Project locations, estimated corporate emissions, sustainability target dates, and technical consultation briefs submitted via forms.
• 合同履约与准入合规信息： Identification credentials required for corporate Know Your Customer (KYC) and Anti-Money Laundering (AML) due diligence, authorized signers, and corporate registry numbers.
• 供应链供应商数据： Facility addresses, operational activity data, and primary liaison details collected during Scope 3 emissions engagement programs.

B. 系统自动收集的信息

• 技术运行参数： IP address, device type, browser specifications, operating system, and geographical country-level location.
• 访问行为数据： Pages visited, duration of session, click paths through project portfolios, and referral URLs.

4. 数据处理目的

AION 出于以下明确且合法的企业经营目的处理您的个人信息：

• 提供气候咨询专业服务： Conducting greenhouse gas (GHG) footprint assessments, net zero transition roadmaps, and Scope 3 supplier data aggregation.
• 碳资产开发与合同签署： Facilitating project feasibility analyses, emission reduction purchase agreements (ERPAs), and registry retirements.
• 遵守法定法规与监管要求： Performing mandatory sanctions checks, AML verification, and corporate tax reporting in Singapore, Indonesia, and Australia.
• 客户沟通与业务联络： Responding to contact requests, scheduling technical consultations, and distributing our quarterly Asia Pacific carbon market intelligence briefings.
• 网站安全与系统性能优化： Monitoring infrastructure reliability, preventing cyber threats, and optimizing platform performance.

5. 数据处理的合法性基础

依据国际隐私与数据保护法规框架，我们依赖以下合法性依据开展数据处理：

6. 碳登记机构与第三方披露

AION 绝不出售、出租或交易您的个人信息。我们仅在业务履约严格必要的范围内，向值得信赖的第三方披露相关数据：

• 碳登记系统与权威认证机构： To execute public carbon credit issuances or irrevocable retirements, designated corporate officer names and entity details may be submitted to registries such as Verra (VCS), The Gold Standard, the Indonesian Ministry of Environment and Forestry (SRN-PPI), and the Australian Clean Energy Regulator.
• 审定与核证机构（VVB）： Independent Validation and Verification Bodies (VVBs) accredited by UNFCCC or international standards.
• 技术基础设施服务商： Secure enterprise cloud hosting, encrypted document transmission services, and client relationship management systems subject to strict data confidentiality agreements.
• 法定监管与司法执法机关： Where compelled by valid subpoena, court order, or applicable law in Singapore, Indonesia, or Australia.

7. 跨境数据传输机制

鉴于 AION 在新加坡、印度尼西亚及澳大利亚设立了区域运营中心，您的个人数据可能会发生跨国传输、查阅与集中处理。

为确保严密的数据保护水平，所有集团内部实体间及第三方的跨国数据传输均受标准合同条款（SCC）及数据传输协议约束，要求数据接收方提供不低于新加坡 PDPA、印尼 UU PDP、澳大利亚 APPs 及欧盟 GDPR 所规定的法定保护标准。

8. 数据留存与安全保障机制

我们采取全面的技术防范与组织治理措施，保护个人数据免遭未经授权的访问、泄露、篡改或毁损：

• 数据加密标准： All data in transit is encrypted using TLS 1.3 protocol; data at rest is stored using AES-256 standard encryption.
• 权限管控机制： Role-based access controls (RBAC) ensuring only personnel with verified business need can view personal records.
• 数据留存周期： Contractual and transactional data is retained for 7 years following contract completion in accordance with corporate audit and tax regulations. General inquiry data is deleted after 24 months of inactivity unless active dialogue continues.

9. 您的法定数据主体权利

根据新加坡、印度尼西亚、澳大利亚及欧盟适用的个人数据保护法律，您享有以下法定权利：

• 查阅知情权： Request confirmation of whether we hold personal information regarding you and receive a readable copy.
• 更正补充权： Request correction of inaccurate, incomplete, or out-of-date personal data.
• 删除权（“被遗忘权”）： Request deletion of your personal data where retention is no longer necessary for legal or contractual purposes.
• 撤回同意权： Unsubscribe from marketing or newsletter communications at any time via the one-click link or direct email request.
• 异议与限制处理权： Object to processing based on legitimate interests on grounds relating to your particular situation.

To exercise any of these rights, contact our Data Protection Officer at privacy@aionclimate.com. We respond to all verified requests within 30 days without charge.

10. Cookie 与网络追踪技术

我们的网站使用 Cookie 及本地会话存储技术，旨在维护平台安全防护、记录用户界面偏好并分析匿名化站点流量。

You can manage, review, or modify your cookie consent at any time using the “Cookie Settings” button located in the footer at the bottom of any page, or by reviewing our dedicated Cookie 政策.

11. 联络渠道与投诉申诉机制

若您对本隐私政策或我们的数据处理实践有任何疑问、意见或关切，请随时联络数据治理团队：

如果您认为我们的数据处理行为侵犯了您的法定权益，您亦有权向所属常驻管辖区的监管机构进行申诉：新加坡个人数据保护委员会（PDPC）、印度尼西亚通信与信息技术部 / 个人数据保护主管机构，或澳大利亚信息专员公署（OAIC）。