私隱政策

1. 集團實體與數據控制者

This Privacy Policy governs the collection, storage, processing, and transfer of personal information by the AION group of entities, operating under the ultimate ownership and governance of Tremendous Holding Ltd, domiciled in Singapore.

根據您的業務互動性質與所在地理區域，負責您個人資料的相關數據控制者包括：

• Tremendous Holding Ltd - Incorporated in Singapore (Company Registration No. 202318492K), serving as the parent group entity and commercial contract principal for international carbon transactions.
• PT AION Carbon Asset (AION PT PMA) - Incorporated in Indonesia (NIB 1204000392819), operating out of the Bali Hub and leading Indonesian project origination, community engagements, and SRN-PPI registry alignment.
• Tremendous Pty Ltd - Incorporated in Australia (ACN 668 192 481), managing Australian landholder partnerships, savanna fire management projects, and Clean Energy Regulator (ACCU Scheme) engagements.

在本政策中，“AION”或“我們”統指上述法人實體。

2. 適用範圍與適用法律框架

AION 在多個司法管轄區開展業務，其數據保護管治體系旨在符合嚴格的國際合規標準。本政策遵循：

• 新加坡： Personal Data Protection Act 2012 (PDPA) and Advisory Guidelines issued by the Personal Data Protection Commission (PDPC).
• 印度尼西亞： Law No. 27 of 2022 on Personal Data Protection (UU PDP) and associated implementing regulations.
• 澳洲： Privacy Act 1988 (Cth), including the 13 Australian Privacy Principles (APPs).
• 歐盟與英國： Regulation (EU) 2016/679 (GDPR) and UK GDPR where we interact with European entities or process European resident data.

This policy applies to data collected through our websites (aionclimate.com and associated subdomains), client onboarding portals, consultation forms, carbon credit procurement contracts, and supplier emissions surveys.

3. 收集的個人資料類別

我們僅收集與專業諮詢及碳資產營運業務直接相關、充分且嚴格必要的個人資料：

A. 您主動提供的資料

• 聯絡資訊： Full name, corporate email address, telephone number, job title, and company name.
• 諮詢問詢內容： Project locations, estimated corporate emissions, sustainability target dates, and technical consultation briefs submitted via forms.
• 合約履約與准入合規資訊： Identification credentials required for corporate Know Your Customer (KYC) and Anti-Money Laundering (AML) due diligence, authorized signers, and corporate registry numbers.
• 供應鏈供應商數據： Facility addresses, operational activity data, and primary liaison details collected during Scope 3 emissions engagement programs.

B. 系統自動收集的資料

• 技術運行參數： IP address, device type, browser specifications, operating system, and geographical country-level location.
• 訪問行為數據： Pages visited, duration of session, click paths through project portfolios, and referral URLs.

4. 數據處理目的

AION 出於以下明確且合法的企業經營目的處理您的個人資料：

• 提供氣候諮詢專業服務： Conducting greenhouse gas (GHG) footprint assessments, net zero transition roadmaps, and Scope 3 supplier data aggregation.
• 碳資產開發與合約簽署： Facilitating project feasibility analyses, emission reduction purchase agreements (ERPAs), and registry retirements.
• 遵守法定法規與監管要求： Performing mandatory sanctions checks, AML verification, and corporate tax reporting in Singapore, Indonesia, and Australia.
• 客戶溝通與業務聯絡： Responding to contact requests, scheduling technical consultations, and distributing our quarterly Asia Pacific carbon market intelligence briefings.
• 網站安全與系統效能優化： Monitoring infrastructure reliability, preventing cyber threats, and optimizing platform performance.

5. 數據處理的合法性基礎

依據國際私隱與數據保護法規框架，我們依賴以下合法性依據開展數據處理：

6. 碳登記機構與第三方披露

AION 絕不出售、出租或交易您的個人資料。我們僅在業務履約嚴格必要的範圍內，向值得信賴的第三方披露相關數據：

• 碳登記系統與權威認證機構： To execute public carbon credit issuances or irrevocable retirements, designated corporate officer names and entity details may be submitted to registries such as Verra (VCS), The Gold Standard, the Indonesian Ministry of Environment and Forestry (SRN-PPI), and the Australian Clean Energy Regulator.
• 審定與核證機構（VVB）： Independent Validation and Verification Bodies (VVBs) accredited by UNFCCC or international standards.
• 技術基礎設施服務商： Secure enterprise cloud hosting, encrypted document transmission services, and client relationship management systems subject to strict data confidentiality agreements.
• 法定監管與司法執法機關： Where compelled by valid subpoena, court order, or applicable law in Singapore, Indonesia, or Australia.

7. 跨境數據傳輸機制

鑑於 AION 在新加坡、印度尼西亞及澳洲設立了區域營運中心，您的個人資料可能會發生跨國傳輸、查閱與集中處理。

為確保嚴密的數據保護水平，所有集團內部實體間及第三方的跨國數據傳輸均受標準合約條款（SCC）及數據傳輸協議約束，要求數據接收方提供不低於新加坡 PDPA、印尼 UU PDP、澳洲 APPs 及歐盟 GDPR 所規定的法定保護標準。

8. 數據保留與安全保障機制

我們採取全面的技術防範與組織管治措施，保護個人資料免遭未經授權的訪問、洩漏、篡改或毀損：

• 數據加密標準： All data in transit is encrypted using TLS 1.3 protocol; data at rest is stored using AES-256 standard encryption.
• 權限管控機制： Role-based access controls (RBAC) ensuring only personnel with verified business need can view personal records.
• 數據保留週期： Contractual and transactional data is retained for 7 years following contract completion in accordance with corporate audit and tax regulations. General inquiry data is deleted after 24 months of inactivity unless active dialogue continues.

9. 您的法定資料主體權利

根據新加坡、印度尼西亞、澳洲及歐盟適用的個人資料保護法律，您享有以下法定權利：

• 查閱知情權： Request confirmation of whether we hold personal information regarding you and receive a readable copy.
• 更正補充權： Request correction of inaccurate, incomplete, or out-of-date personal data.
• 刪除權（「被遺忘權」）： Request deletion of your personal data where retention is no longer necessary for legal or contractual purposes.
• 撤回同意權： Unsubscribe from marketing or newsletter communications at any time via the one-click link or direct email request.
• 異議與限制處理權： Object to processing based on legitimate interests on grounds relating to your particular situation.

To exercise any of these rights, contact our Data Protection Officer at privacy@aionclimate.com. We respond to all verified requests within 30 days without charge.

10. Cookie 與網絡追蹤技術

我們的網站使用 Cookie 及本地會話儲存技術，旨在維護平台安全防護、記錄用戶界面偏好並分析匿名化站點流量。

You can manage, review, or modify your cookie consent at any time using the “Cookie Settings” button located in the footer at the bottom of any page, or by reviewing our dedicated Cookie 政策.

11. 聯絡渠道與投訴申訴機制

若您對本私隱政策或我們的數據處理實踐有任何疑問、意見或關切，請隨時聯絡數據治理團隊：

如果您認為我們的數據處理行為侵犯了您的法定權益，您亦有權向所屬常駐管轄區的監管機構進行申訴：新加坡個人資料保護委員會（PDPC）、印度尼西亞通信與資訊科技部 / 個人資料保護主管機構，或澳洲資訊專員公署（OAIC）。