Privacy Policy

This Privacy Policy describes how Voya Global Pte. Ltd. collects, uses, discloses, stores and otherwise processes Personal Data in connection with the Voya platform and website. It also explains how we use cookies and similar technologies (see section 14), so it is the single privacy notice for voya.global.

Voya Global Pte. Ltd. (Voya, we, us or our) is a private company limited by shares incorporated in Singapore and operates the Voya platform for collaborations between travel-related businesses (Brands) and content creators (Creators).

For questions about this Privacy Policy or our handling of Personal Data, contact our Data Protection Officer / Privacy Team at privacy@voya.global. Registered office: 8 Temasek Boulevard, #17-02A Suntec Tower Three, Singapore 038988.

This Privacy Policy applies to Personal Data processed through Voya websites, mobile applications, software, APIs, account registration, social-media integrations, Campaigns, Bookings, Platform communications, subscriptions, support and related Platform Services (together, the Platform).

It should be read together with the Voya Terms of Service presented to Users when they register for or use the Platform, and any additional privacy information we present at the point where we collect Personal Data. Third-party services, including social-media platforms and payment providers, apply their own privacy policies to processing they perform independently.

We may collect the following categories of Personal Data, depending on how a person uses the Platform:

• Account and contact data, such as name, email address, telephone number, login and account details.
• Business and professional data, such as company name, role, business registration information, website, brand profile, Creator profile, portfolio and professional information.
• Identity and verification data, including information and documents used for identity, business, domain, email, telephone, portfolio, audience-authenticity or other verification checks.
• Social-media and connected-account data obtained with the User's authorisation through supported integrations, including account identifiers, handles, profile information, audience or engagement metrics and other categories described at the time the relevant permissions are requested (see section 07).
• Campaign, Booking and collaboration data, such as Campaign Briefs, applications, invitations, Booking Confirmations, Deliverables, reviews, ratings and collaboration history.
• Communications and support data, including in-Platform messages, complaints, dispute communications, customer-support correspondence and reports of suspected fraud, abuse or security issues.
• Content and media uploaded or submitted to the Platform, together with associated metadata.
• Subscription, billing and transaction data, such as plan details, invoices, payment status, transaction references and fraud-prevention signals. Payment-card details may be processed directly by Voya's payment processor rather than stored by Voya, depending on the payment flow.
• Technical, device and usage data, such as IP address, browser or device identifiers, login history, timestamps, audit logs, security events and information about use of Platform features, including information collected through cookies and similar technologies (see section 14).
• Compliance and investigation data, including records reasonably required to assess eligibility, investigate suspected misconduct, respond to legal requests or comply with sanctions, fraud-prevention and other regulatory obligations.

We may collect Personal Data directly from Users; automatically when the Platform is used; from connected social-media accounts or other third-party services at the User's direction; from Brands or Creators involved in a Campaign or Booking; from verification, payment, analytics, cloud, security or support providers; and from public records or publicly available sources where permitted by law.

Where a User provides Personal Data about another person, the User should ensure that the disclosure is lawful and that any required notices or consents have been provided or obtained.

We may collect, use and disclose Personal Data for purposes that are reasonably appropriate in the circumstances and notified to the individual, including:

• creating and administering Accounts and Profiles;
• assessing eligibility, onboarding and verification;
• enabling social-media account connections, profile enhancement, audience analytics and Campaign functionality;
• facilitating Campaign discovery, applications, invitations, Bookings, Deliverables and collaboration management;
• enabling Platform communications and notifications;
• processing subscriptions, billing, refunds where applicable and financial records;
• providing support, handling complaints and facilitating User-to-User disputes;
• protecting Users and the Platform, including authentication, fraud prevention, cybersecurity, content moderation, investigations and enforcement;
• complying with legal and regulatory obligations and responding to lawful requests from authorities;
• maintaining records and evidence relating to acceptance of terms, Campaigns, Bookings, communications and transactions;
• improving, testing, maintaining and developing Platform functionality, analytics and service quality;
• communicating administrative information and, where permitted and subject to applicable choices, marketing information about Voya; and
• other purposes reasonably related to the above or separately notified at or before collection.

Where the Singapore Personal Data Protection Act 2012 (PDPA) applies, Voya will collect, use and disclose Personal Data in accordance with the PDPA, including on the basis of consent where required or an applicable exception, deemed consent mechanism or other permitted basis where available.

Where consent is relied upon, an individual may withdraw consent by contacting privacy@voya.global or by using available Platform controls. Withdrawal will apply prospectively and may affect Voya's ability to provide features that require the relevant Personal Data. Voya may continue to retain or process information where permitted or required by law.

Creators may choose to connect supported third-party social-media accounts, including Instagram and TikTok, for purposes such as identity verification, profile enhancement, audience analytics and Campaign management.

When a User initiates a connection, Voya will request only the permissions and categories of information presented through the relevant platform authorisation flow and needed for the stated Platform purposes. The User may withdraw the authorisation by disconnecting the relevant account, subject to information Voya may need to retain for legal, security, audit or dispute-resolution purposes. Step-by-step instructions for deleting connected-account data are available at Data Deletion Instructions.

Connected-account functionality also depends on the relevant third-party provider. Those providers process information under their own terms and privacy policies.

Connecting an account is a separate authorisation flow controlled by the relevant provider. Nothing in this Privacy Policy, including the cookie information in section 14, expands the permissions requested through that authorisation flow. Voya does not store the passwords or other login credentials Users hold with those providers.

We may disclose Personal Data where reasonably necessary for the purposes described in this Policy, including to:

• other Users, where information is part of a Profile, Campaign, Booking, Deliverable, review or communication intended to be shared with them;
• cloud hosting, infrastructure, analytics, communications, customer-support, security and other technology service providers;
• identity, business and audience-verification providers;
• payment processors and billing providers;
• social-media and API providers when a User chooses to connect or use those services;
• professional advisers, insurers, auditors and corporate service providers;
• law-enforcement, regulators, courts or other authorities where disclosure is required or permitted by law; and
• potential or actual purchasers, investors or successors in connection with a merger, acquisition, financing, reorganisation or sale of all or part of Voya's business, subject to appropriate confidentiality and legal safeguards.

Voya operates an international Platform and may transfer or make Personal Data accessible outside Singapore, including where Users, service providers or technology infrastructure are located in other countries.

Where the PDPA applies, Voya will take appropriate steps to ensure that overseas transfers comply with the PDPA's Transfer Limitation Obligation, including by using legally enforceable obligations or other mechanisms recognised under applicable law to provide a standard of protection comparable to that required under the PDPA, subject to any applicable exception.

Voya will implement commercially reasonable technical and organisational measures designed to protect Personal Data in its possession or under its control against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.

Security measures may include access controls, authentication, encryption or equivalent safeguards where appropriate, logging and monitoring, vulnerability management, backup and recovery procedures, incident-response processes and restrictions on personnel access. No internet-based service can guarantee absolute security.

Voya will retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected, or for legitimate business, legal, regulatory, audit, fraud-prevention, security or dispute-resolution purposes.

When retention is no longer necessary, Voya will cease retaining the Personal Data or remove the means by which it can be associated with particular individuals, where required by applicable law.

Subject to applicable law and any permitted exceptions, an individual may request access to Personal Data held by Voya and information about how it has been used or disclosed, and may request correction of inaccurate or incomplete Personal Data.

Requests may be submitted to privacy@voya.global. Voya may take reasonable steps to verify identity before processing a request and may charge a reasonable fee where permitted by law and notified in advance.

Voya maintains processes for assessing and responding to suspected Personal Data breaches. Where notification thresholds under the PDPA or other applicable law are met, Voya will notify the Personal Data Protection Commission and/or affected individuals as required by law.

This section is Voya's cookie notice. It explains how Voya uses cookies, software development kits (SDKs), pixels, local storage and similar technologies in connection with the Platform, and the choices available to Users.

14.1 What these technologies do

Cookies and similar technologies may store or access information on a User's browser or device. They enable the Platform to recognise a session, remember preferences, maintain security, measure performance and understand how Platform features are used.

14.2 Categories we may use

• Strictly necessary: authentication, session management, fraud prevention, security and core Platform operation. These are required for the Platform to work and cannot be switched off through our preference controls.
• Functional: preferences, language, interface settings and optional Platform functionality.
• Analytics and performance: measurement of traffic, feature use, errors and service performance, used to maintain and improve the Platform.
• Marketing or advertising: campaign attribution, advertising measurement or personalised marketing, only where deployed and permitted by applicable law.

14.3 Third-party technologies

Voya may use third-party technology providers for hosting, analytics, communications, security, support, social-media integrations or other Platform functionality. Those providers may place or access cookies or similar technologies where necessary for the relevant service, subject to their own terms and privacy practices. Information collected through these technologies is handled in accordance with this Privacy Policy.

14.4 Your choices

Where required by applicable law, non-essential cookies or similar technologies will not be used until the User has made the required choice through Voya's consent-management interface. Users may change available preferences through that interface at any time.

Users may also control cookies through browser or device settings, including by blocking or deleting cookies. Disabling strictly necessary technologies may affect Platform functionality.

14.5 Social-media and OAuth integrations

Connecting a supported social-media account, including Instagram or TikTok, involves a separate authorisation flow controlled by the relevant provider and is described in section 07. This section does not expand the permissions requested through that authorisation flow.

Where Voya sends marketing communications, it will do so in accordance with applicable law and the preferences available to the recipient. Recipients may use the unsubscribe mechanism in a marketing message or contact privacy@voya.global to change marketing preferences.

Administrative, security, transactional or other service communications may still be sent where necessary to operate an Account or provide the Platform Services.

The Platform is intended for persons aged eighteen (18) years or older. Voya does not knowingly permit persons under 18 to register as Users. If Voya becomes aware that a person under 18 has provided Personal Data in breach of the eligibility requirements, Voya may take steps to delete or otherwise handle that information as appropriate under applicable law.

The Platform may contain links to or integrations with third-party websites, applications and services. Voya does not control the independent privacy practices of those third parties. Users should review the privacy information provided by those third parties before providing information to them.

Voya may update this Privacy Policy, including the cookie information in section 14, from time to time to reflect changes in law, Platform functionality, technology, providers or business practices. Material changes will be notified through appropriate electronic means before taking effect where required by applicable law. The current version and its effective date will be published on the Platform.

Questions, requests or complaints concerning Personal Data, or about our use of cookies and similar technologies, may be directed to:

Individuals may also have the right to raise a complaint with the Personal Data Protection Commission of Singapore or another competent data protection authority, depending on the circumstances.