Privacy & Cookie Policy

GEDZU PTE. LTD. operates strictly in the business-to-business (“B2B”) sector and does not offer consumer services. To ensure complete regulatory clarity across Singapore, the European Economic Area (“EEA”), the United Kingdom (“UK”), and the United States, this Policy separates processing into two distinct operational contexts. Under Context A (Website Visitors, Prospective Buyers & B2B Clients — Section 3), GEDZU PTE. LTD. acts as an independent Data Controller (or Organization under the Singapore PDPA / Business under the CCPA) regarding visitors who browse the Website, submit an inquiry or Playbook configuration request via a web form or webhook, or enter into a commercial contract. Under Context B (On-Demand B2B Lead Research & AI Signal-Scoring — Section 4), GEDZU PTE. LTD. acts strictly as an on-demand Data Processor / Service Provider executing custom, client-commissioned extraction and AI evaluation runs on publicly available corporate web sources on behalf of a B2B Client.

3.1. Edge Server & Security Log Data (Cloudflare Pages). The Website is hosted as a static web property on Cloudflare Pages (operated by Cloudflare, Inc.). When a visitor accesses the Website, Cloudflare’s edge network automatically processes technical connection metadata—specifically the requesting IP address, date and time of the request, requested URL, HTTP status code, referrer URL, browser user-agent string, and operating system—solely to deliver the webpage, mitigate Distributed Denial of Service (DDoS) attacks, and maintain network security. Security log data is retained ephemerally in accordance with Cloudflare’s standard security retention schedule (typically up to 7 days) and is never used to build behavioral user profiles.

3.2. Form Submissions, Webhook Payloads & Onboarding Data. When a business representative submits a Playbook configuration inquiry, commissions Custom Playbook Orders and Monthly Lead Packages, or communicates with GEDZU PTE. LTD. via an embedded form, webhook integration, email, or Upwork workspace, the Company receives the Business Contact Information voluntarily entered by the representative (such as full name, corporate role/title, company name, work email address, website URL, and custom Playbook criteria).

3.3. Billing & Transaction Records. For paying B2B Clients, the Company processes corporate billing addresses, invoice histories, tax registration numbers (VAT/GST IDs), and payment confirmation metadata via its banking institutions, payment processors, or invoicing platforms.

3.4. Analytics, UX Telemetry, First-Party Attribution & Google Consent Mode v2. To measure B2B campaign performance and optimize Website usability, GEDZU PTE. LTD. utilizes: (a) First-Party Attribution Storage (localStorage key l42_attribution) to record first-touch and last-touch campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, wbraid, gbraid, promotional offer flags, and initial referrer) when a prospective B2B buyer submits a live sample or Playbook request; (b) Google Tag Manager (GTM) & Google Analytics 4 (GA4) (operated by Google LLC) for aggregated conversion and traffic telemetry with IP anonymization enabled; and (c) Microsoft Clarity (operated by Microsoft Corporation) for aggregated UX session and heatmap diagnostics to identify interface friction. GEDZU PTE. LTD. enforces Google Consent Mode v2: for visitors accessing the Website from the European Economic Area (EEA) or the United Kingdom, analytics and advertising storage default strictly to ‘denied’ unless and until the visitor actively grants opt-in consent via the privacy preference bar pursuant to Article 6(1)(a) GDPR and § 25(1) TDDDG. For visitors in the United States and non-EEA jurisdictions, analytics measurement operates under standard commercial B2B notice; GEDZU PTE. LTD. does not “sell” personal information for monetary consideration under the California Consumer Privacy Act (CCPA/CPRA).

3.5. Lawful Bases for Context A Processing. Under Singapore Law (PDPA 2012), because the Website exclusively serves corporate buyers and collects name, position, business email, and company details provided for business rather than personal purposes, such data constitutes Business Contact Information (BCI) exempt from Parts 3 to 6 of the PDPA pursuant to Section 4(5) of the PDPA. Under the EU/UK GDPR, where applicable to Website inquiries or Client administration, GEDZU PTE. LTD. relies on Article 6(1)(b) GDPR (performance of a contract or taking steps at the request of the prospective Client prior to entering into a contract), Article 6(1)(f) GDPR (legitimate interests in operating a secure website via Cloudflare Pages, responding to B2B commercial inquiries, and managing client relationships), and Article 6(1)(c) GDPR (compliance with statutory tax, accounting, and ACRA corporate record-keeping obligations).

4.1. No Multi-Tenant Database (On-Demand Processor Model). Unlike traditional data brokers that maintain and license access to a static, multi-tenant database of millions of personal profiles, GEDZU PTE. LTD. does not operate a public or self-serve contact database. Every data extraction and AI Signal-Scoring job is executed strictly on an on-demand basis pursuant to a B2B Client’s specific Playbook for Custom Playbook Orders and Monthly Lead Packages, and delivered into a single-tenant Google Sheet, CSV, or webhook controlled by that Client.

4.2. Distinction Between Pure Corporate Data and Business Contact Data. The majority of attributes extracted and scored by 42leads relate solely to legal entities (juristische Personen), including company names, corporate registration details, physical store, hotel, or office addresses, website URLs, generic role-based contact addresses (info@, contact@, sales@, reception@), central switchboard telephone numbers, aggregate public review ratings, and AI-generated operational pain-point scores. Pursuant to Recital 14 of the EU GDPR, as well as US and Singapore privacy statutes, information concerning legal persons does not constitute Personal Data. Where a B2B Client’s Playbook instructs the extraction of publicly listed corporate representatives (such as a Managing Director / Geschäftsführer named in a public website Impressum, a public corporate leadership page, or a public business directory), the processed fields are strictly limited to professional Business Contact Information: full name, professional job title/role, corporate company affiliation, public professional profile URL, and business contact channel (work email or business phone number). GEDZU PTE. LTD. never extracts private residential addresses, personal mobile numbers published for household use, government identity numbers, financial account details, or special categories of sensitive personal data (Article 9 GDPR).

4.3. Multi-Jurisdictional Legal Basis for Public B2B Research. Under Singapore Governing Law, publicly available corporate contact details extracted for B2B commercial intelligence constitute Business Contact Information exempt from the consent, notification, and transfer obligations of Parts 3 to 6 of the PDPA under Section 4(5). Under European Union and United Kingdom Law, when processing is performed on behalf of an EEA/UK Client acting as Data Controller under the 42leads Data Processing Addendum, the lawful basis for processing publicly accessible B2B professional contact data is Article 6(1)(f) GDPR (Legitimate Interests), read in conjunction with Recital 47 GDPR. The legitimate interest consists of enabling B2B companies to identify organizations experiencing specific, verifiable operational needs (via AI Signal-Scoring of public reviews and web text) so that commercial inquiries are highly relevant and minimally intrusive. Because the data is limited exclusively to information manifestly placed in the public professional domain and carries zero impact on private household life, the Controller’s legitimate B2B interest is not overridden by the data subject’s fundamental rights. Under United States Law, pursuant to the California Consumer Privacy Act as amended by the CPRA, California Civil Code § 1798.140(v)(2) excludes publicly available information—including information lawfully made available to the general public on unrestricted websites, business directories, and widely distributed media—from the statutory definition of “Personal Information.” To the extent any regulated data is processed during a custom job, GEDZU PTE. LTD. acts strictly as a Service Provider / Contractor and does not “sell” or “share” (for cross-context behavioral advertising) personal information.

6.1. Client Inquiry & Contract Records. Retained for the duration of the commercial relationship plus the statutory retention period required under Singapore corporate and tax law (typically five (5) to seven (7) years under the Singapore Companies Act 1967 and Income Tax Act 1947).

6.2. On-Demand Extraction Logs & Single-Tenant Deliverables. Ephemeral compute logs generated during a custom extraction run are automatically purged within seven (7) to thirty (30) days of run completion. Single-tenant Google Sheet Deliverables remain accessible to the commissioning Client for the duration of the engagement and are permanently deleted by GEDZU PTE. LTD. within thirty (30) days following contract termination or upon written instruction from the Client.

7.1. Access, Correction, Erasure, Restriction, and Portability (PDPA ss. 21–22; GDPR Arts. 15–20; CCPA/CPRA). Any natural person whose professional contact information is processed has the right to request confirmation of whether GEDZU PTE. LTD. holds personal data relating to the requester, to obtain a copy of such data in a structured, machine-readable format, to correct inaccuracies, to request restriction of processing, or to request deletion by contacting dpo@gedzu.net.

7.3. No Automated Decision-Making with Legal Effect (GDPR Art. 22). AI Signal-Scoring evaluates corporate entities and operational buying signals for B2B sales prioritization; it never produces legal effects or similarly significant effects concerning any natural person within the meaning of Article 22(1) GDPR.

7.4. Right to Lodge a Regulatory Complaint. Individuals have the right to lodge a complaint with a supervisory authority—in Singapore, the Personal Data Protection Commission (PDPC) (www.pdpc.gov.sg); in the EEA, the competent national data protection authority where the individual resides or works; and in the UK, the Information Commissioner’s Office (ICO).