TavaSIS — tavasis.com · Operated by ZYT Pte. Ltd.
Last updated: 2 October 2026 · Singapore PDPA compliant · GDPR applicable where relevant
ZYT Pte. Ltd. (“ZYT,” “we,” “us,” or “our”) operates the TavaSIS platform at tavasis.com. We are committed to protecting the personal data of everyone who uses our Platform.
This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights in relation to it.
This Policy applies to all users of TavaSIS, including tourism businesses (“Clients”), sustainability consultants and consulting firms (“Consultants”), Certification Bodies granted access to a project (“CBs”), and visitors to our website.
It also applies to individuals who are not account holders but whose personal data we may hold: staff of a Client who are listed on a project team, external stakeholders who submit feedback through a link a Client has shared with them, and prospective customers or partners who have been in contact with us. Sections 2.6 and 2.7 describe what we hold about these individuals and why.
We comply with the Singapore Personal Data Protection Act 2012 (“PDPA”). Where we process personal data of individuals in the European Economic Area, we also comply with the General Data Protection Regulation (“GDPR”) as applicable.
When we are responsible, and when the Client is
The distinction matters because it decides whom you should ask.
We are the responsible organisation for account registration data, enquiries and support requests, and our own records of prospective customers and partners. You gave those to us directly, and this Policy governs them.
We act as a data intermediary for the certification project data a Client enters or uploads, including anything identifying the colleagues, suppliers, customers or community members who contributed to it. We process that on the Client's instructions, for them. If you were added to a project team, or submitted feedback through a link a business sent you, that business decides what happens to your data — ask them first. We will still help, and will pass a request on.
When you create an account, we collect: full name, email address, organisation name and role, country.
When you use TavaSIS, we collect: certification project data you create or upload (documents, evidence files, checklist responses, notes); actions taken within the Platform (audit trail data, stage progressions, sign-offs); communications between Consultants and Clients within the Platform.
ZYT does not operate automated card payment on the Platform, and we do not collect or store credit or payment card details. Subscriptions are arranged and invoiced directly with ZYT, and we hold the billing contact details and invoice records that follow from that. If we introduce card payment in future, we will update this Policy before doing so.
We automatically collect: IP address and approximate location (country/city level); browser type and version; device type; pages visited, features used, and time spent on the Platform; error logs and performance data.
If you contact us by email, through the contact form, or through the in-Platform support panel, we retain those communications, including any support request and our replies to it.
We keep a record of organisations and individuals we are in contact with about TavaSIS before any account exists — for example after a meeting, an enquiry, or an introduction. This may include name, business email address, business telephone number, organisation, country, website, and notes of our conversations with you. We collect this from you directly, from your organisation's public website, or from the person who introduced us.
If you would like to know what we hold about you in this capacity, or would like it deleted, contact us at dpo@zyt.one and we will act on that request. We do not need to keep it.
Some Platform features involve individuals who never register with us. In each case the Client, not ZYT, decides who is invited and what is asked of them:
Two Platform features read a public web page and summarise it for you, so that you do not have to type in facts that are already published.
We read only pages that are open to any visitor. The Platform does not sign in, and does not attempt to get past a paywall, a login or any other barrier. In both cases the text read is sent to our AI provider to be summarised — see Section 4.
A published page may name individuals, for example a management team or a named contact. Where it does, that information is read as part of the page and may appear in the draft the Platform produces. The Client can edit or remove anything in that draft, and a draft is never published anywhere by us. If you are named on a page we have read this way and you would like to know what we hold, contact us at dpo@zyt.one.
We use your personal data for the following purposes:
| Purpose | PDPA basis | GDPR basis |
|---|---|---|
| Providing and operating the Platform | Contractual necessity | Performance of contract |
| Processing your account registration | Contractual necessity | Performance of contract |
| Managing subscription billing | Contractual necessity | Performance of contract |
| AI-assisted guidance features | Legitimate interest / Contractual necessity | Legitimate interests |
| Improving and developing the Platform | Legitimate interest | Legitimate interests |
| Sending service and account notifications | Contractual necessity | Performance of contract |
| Responding to your enquiries | Legitimate interest | Legitimate interests |
| Complying with legal obligations | Legal obligation | Legal obligation |
| Security and fraud prevention | Legitimate interest | Legitimate interests |
We do not use your personal data for advertising or sell it to third parties.
TavaSIS includes AI-assisted features that generate guidance notes and draft content — at the performance indicator level, and when drafting a Business Profile or a sustainability management document. When you use these features:
We send to the AI provider only what a feature needs in order to draft. Confidential staff feedback is never sent: where a Client offers its staff a confidential channel (Section 2.7), no AI feature reads it.
Because nothing is used for training, anything the AI has produced about you remains an ordinary record in the Platform. A request to see it, correct it or delete it can be acted on in the normal way described in Section 11 — there is no copy of it held inside a trained model.
AI-generated content is a drafting aid only and must be reviewed before it is relied on. Depending on how a project is set up, the reviewer may be an external Consultant or the Client's own manager. See Terms of Use Section 6.3.
We share personal data with third-party service providers who help us operate the Platform. All providers are engaged under data processing agreements and are required to process personal data only on our instructions.
| Category | Purpose |
|---|---|
| Cloud infrastructure and database provider | Platform hosting, data storage, authentication |
| Email delivery provider | Transactional emails (account notifications, password resets) |
| AI language model provider | AI-assisted performance indicator guidance and drafting features |
| Error monitoring and performance provider | Platform stability, bug detection |
| Deployment and hosting provider | Website and application delivery |
| Web analytics provider | Aggregate visit counts. Cookieless; collects no personal data |
We do not publicly disclose the names of individual service providers. If you wish to know which specific provider processes a particular category of your data, contact us at service@tavasis.com.
We do not sell, rent, or trade your personal data. We share personal data only in the following circumstances:
Between Consultants and Clients
When a Consultant invites a Client to a project on TavaSIS, both parties have access to the shared project data within that project's scope. Consultants can view all Client-submitted evidence and notes within their projects. Clients cannot view other Clients' projects.
With a Certification Body, when you invite one
A Client or its Consultant may invite a GSTC-accredited Certification Body into a project so that it can review the evidence for its audit. Doing so grants that CB read-only access to the evidence files and the checklist structure for that project only. CBs are independent organisations and are not our processors: once evidence reaches them, they hold it under their own obligations as an accredited body. Access is granted only by your own action and can be raised with us at any time.
Legal requirements
Where we are required to disclose data by law, court order, or regulatory authority.
Business transfers
If ZYT is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users in advance.
TavaSIS is operated from Singapore. Our cloud infrastructure is hosted in the Asia-Pacific region. Some of our third-party providers process data in other countries, including the United States and the European Union.
Where personal data is transferred outside Singapore, we take steps to ensure it is protected by appropriate safeguards in accordance with the PDPA. Where we transfer data of EEA individuals outside the EEA, we rely on appropriate transfer mechanisms as required by GDPR.
Account data
Duration of account, plus 3 years after closure
Project and certification data
5 years from subscription end. Certification records may have longer requirements under applicable standards
Payment records
7 years (Singapore financial record-keeping requirements)
Error logs and technical data
Up to 12 months
Communications
3 years from date of communication
Prospective customer and partner records
Until no longer relevant to an ongoing conversation, or on request — whichever is sooner
Stakeholder and staff feedback submitted to a project
Retained with the project record as certification evidence, and kept if the individual is later removed from the project team
AI-generated drafts and guidance, and the record of which web pages were read to produce them
Retained with the project record on the same basis as project and certification data, and deletable on request at any time
On account termination, you may request export of your project data before closure. After the retention period, data is securely deleted or anonymised.
We implement appropriate technical and organisational measures to protect your personal data, including:
No method of transmission over the internet is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.
If there is a data breach
We maintain an internal response plan and we will use it. Where a breach is notifiable under Part VIA of the PDPA — broadly, one likely to result in significant harm to affected individuals, or of significant scale — we will notify the Personal Data Protection Commission within the statutory period, and notify affected individuals, telling you what happened, what data was involved and what we are doing about it. Where we act as a data intermediary for a Client, we will notify that Client without undue delay so that they can meet their own obligations.
TavaSIS uses essential cookies and session tokens required for Platform functionality (login sessions, security). We do not use third-party advertising or tracking cookies. You may manage cookie settings through your browser; however, disabling essential cookies may prevent the Platform from functioning correctly.
We do count visits to our pages. The analytics service was chosen specifically because it sets no cookies and does not fingerprint visitors: it records the page, the country, the kind of device and where the visit came from, in aggregate only. It does not follow you across other websites and collects nothing that identifies you.
Separately, and to be clear about the distinction: if you go on to create an account, we record how you first arrived — the campaign parameters in the link you followed, the website that referred you, and the first page you landed on — and we keep that alongside your account record. Unlike the aggregate counting above, this is linked to your account. We use it only to understand which channels reach people, it is stored as the referring website's domain rather than the full address, and it is never used to build a profile of your browsing.
To exercise any of these rights, contact us at service@tavasis.com. We will respond within 30 days (or 10 business days under PDPA). We may require verification of your identity before processing your request.
TavaSIS is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
If we change how we handle personal data we will update this Policy and move the date at the top. Where a change materially affects your rights we will tell account holders by email rather than relying on you to re-read the page.
ZYT Pte. Ltd.
As section 11 of the PDPA requires, ZYT Pte. Ltd. has designated an individual responsible for our compliance with the Act. Our Data Protection Officer is reachable at the address below. Address any question, access request, correction request, withdrawal of consent or complaint about personal data there — it is a monitored business address and a person reads it. You do not need to phrase a request formally or cite a section number for us to act on it.
Data Protection Officer: dpo@zyt.one
General enquiries: service@tavasis.com
For complaints under the PDPA, you may also contact the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.
This Privacy Policy was last updated on 29 September 2026. It is founder-drafted and pending formal legal review. ZYT recommends obtaining independent legal advice, particularly in relation to cross-border data transfers and GDPR compliance if serving EEA users at scale.