This Privacy Policy describes how Alba Earth Pte. Ltd. (“Alba Earth”, “we”, “us”) collects, uses, processes, stores, transfers, and discloses personal data in connection with its website, AI-driven platform, wearable integrations, and related services (collectively, the “Platform”).
This Privacy Policy applies to all individuals whose personal data is processed through the Platform, including registered users, prospective users, enterprise clients, website visitors, and individuals interacting with integrated third-party services.
This Privacy Policy applies irrespective of the user’s location and governs personal data processing activities carried out by Alba Earth in its capacity as a data controller, except where Alba Earth expressly acts as a data processor pursuant to a separate contractualarrangement.
Personal data is processed in accordance with applicable data protection and privacy laws, which may include, where applicable, the UK General Data Protection Regulation, the EU General Data Protection Regulation, the Singapore Personal Data Protection Act 2012, and other relevant international or national data protection frameworks.
References in this Privacy Policy to specific legal regimes apply only to the extent that such regimes are applicable to the relevant processing activities and to the individual concerned.
Where local law provides additional rights or imposes additional requirements, those provisions shall apply alongside and, where necessary, take precedence over the relevant sections of this Privacy Policy.
By accessing or using the Platform, or by otherwise submitting personal data to Alba Earth, you acknowledge that your personal data will be processed in accordance with this Privacy Policy and applicable law.
Alba Earth acts as a data controller in respect of personal data collected directly from users in connection with account registration, access to and use of the Platform, analytics, communications, security monitoring, fraud prevention, compliance activities, and operational management of the Platform. In its capacity as controller, Alba Earth determines the purposes and means of processing personal data in accordance with applicable dataprotection law and remains responsible for ensuring such processing complies with applicable legal requirements.
Where Alba Earth provides services to enterprise customers, partners, or integration counterparties and processes personal data solely on their documented instructions, Alba Earth acts as a data processor. In such circumstances, the relevant customer or partner remains the data controller responsible for determining the lawful basis and purposes of processing and for ensuring compliance with applicable data protection obligations.
Processor activities are governed by contractual arrangements incorporating appropriate data protection provisions, including obligations relating to confidentiality, technical and organisational security measures, restrictions on sub-processing, assistance with data subject rights, breach notification, and audit rights, in accordance with applicable law.
Where required by applicable law, Alba Earth may appoint sub-processors subject to contractual safeguards ensuring an equivalent level of data protection. Alba Earth remains responsible for ensuring that sub-processing arrangements comply with applicable legal standards.
Nothing in this Privacy Policy modifies or supersedes any separate data processing agreement entered into between Alba Earth and an enterprise customer. In the event of any conflict, the terms of the applicable data processing agreement shall prevail with respect to processor activities.
Alba Earth maintains records of processing activities in accordance with applicable data protection law, including Article 30 of the UK and EU GDPR where applicable.
Alba Earth processes personal data provided directly by users, collected automatically through use of the Platform, generated through user interaction with AI-driven features, and received from integrated third-party services, wearable device integrations, enterprise customers, or authorised partners.
Personal data processed may include identification details, contact information, account credentials, authentication and access data, device identifiers, IP address, browser and operating system information, geolocation data where enabled, usage metrics, interaction logs, system diagnostics, transaction-related information, and content submitted, uploaded, or generated through use of the Platform.
Processing may also involve metadata associated with user interactions, including timestamps, session data, technical event logs, and system performance data necessary to maintain security, integrity, and reliability of the Platform.
Where wearable device integrations are enabled, activity data, sensor-derived data, including but not limited to heart rate, heart rate variability (HRV), sleep stages, activity levels, and stress indicators, telemetry, or related functional data may be processed solely to enable requested Platform functionality and service delivery.
Personal data may further include communications exchanged with Alba Earth, customer support interactions, feedback submissions, compliance-related information, and data necessary for fraud prevention, security monitoring, and enforcement of contractual terms.
Alba Earth does not intentionally collect special category data as defined under applicable data protection law unless explicitly provided by the user and strictly required for the operation of the Platform. Where such data is processed, it is handled in accordance with applicable legal requirements and subject to enhanced safeguards.
The Platform is intended for individuals aged 18 and over. Alba Earth does not knowingly collect personal data from individuals under the age of 18.
Users are required to confirm their age during account registration. If Alba Earth becomes aware that personal data has been collected from a minor in violation of this Policy, such data will be deleted without undue delay.
Personal data is processed for the operation, administration, maintenance, security, and continuous improvement of the Platform; user authentication and access management; account administration; billing and transactional processing where applicable; technical troubleshooting; service analytics; contractual performance; enforcement of terms; fraud prevention; risk management; and compliance with applicable legal and regulatory obligations.
Processing activities include the provision of Platform functionality, management of integrations with third-party services and wearable technologies, monitoring of system performance, safeguarding of network and information security, ensuring service availability and resilience, and responding to user communications, support requests, and regulatory inquiries.
Personal data may also be processed for internal governance purposes, including auditing, quality assurance, incident response, business continuity planning, and protection of legal rights and interests.
Where AI systems generate outputs based on user inputs or interaction data, personal data is processed to deliver requested functionality, maintain system integrity, detect misuse or anomalous activity, enhance service reliability, and, where permitted by applicable law, improve model performance through controlled evaluation and optimisation processes.
Processing is limited to what is necessary and proportionate to the purposes described above and is conducted in accordance with applicable data protection principles, including purpose limitation and data minimisation.
Personal data is not processed for purposes that are incompatible with the purposes set out in this section unless required or permitted by applicable law.
Where Alba Earth introduces optional data-sharing programs involving anonymised and aggregated insights, such processing will be conducted only with an appropriate lawful basis and clear user transparency. No identifiable personal data will be shared without explicit consent.
Alba Earth applies data protection by design and by default principles in the development and operation of the Platform. Processing activities are assessed prior to implementation to ensure proportionality, risk mitigation, and alignment with applicable legal requirements.
Internal governance controls are maintained to document decision-making relating to data use, AI functionality, and cross-border transfers, and to ensure accountability under applicable data protection frameworks.
Where applicable under the UK General Data Protection Regulation and the EU General Data Protection Regulation, personal data is processed on one or more lawful bases depending on the nature of the individual’s interaction with the Platform and the specific purposes of processing.
Processing may be necessary for the performance of a contract to which the data subject is party, including the provision of Platform services, account creation and administration, access management, billing where applicable, and delivery of requested functionality. Processing may also be carried out in order to take steps at the request of the data subject prior to entering into a contract.
Personal data may be processed where necessary for compliance with legal and regulatory obligations applicable to Alba Earth, including obligations relating to security, record-keeping, fraud prevention, lawful disclosure, regulatory cooperation, and protection of legal rights.
Personal data may further be processed where necessary for the purposes of legitimate interests pursued by Alba Earth. Such interests include operating, administering, securing, maintaining, and improving the Platform; ensuring system integrity, availability, and resilience; preventing misuse, fraud, or unlawful activity; protecting network and information security; enforcing contractual rights; conducting internal governance, auditing, and risk management activities; and managing business operations. Where processing is based on legitimate interests, Alba Earth undertakes an assessment to ensure that such interests are not overridden by the rights and freedoms of the data subject.
Where required by law, processing is based on the data subject’s consent. Consent will be obtained in a clear and transparent manner and may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal. Where consent is withdrawn, certain features or functionalities of the Platform may no longer be available.
Where special category data is processed, such processing will occur only where an additional lawful condition under applicable data protection law applies, and appropriate safeguards are implemented.
Where automated processing or AI-driven functionality forms part of the delivery of Platform services, such processing is conducted within the lawful bases described above and in accordance with applicable legal requirements, including principles of fairness, transparency, data minimisation, and purpose limitation.
Where multiple lawful bases may apply to a particular processing activity, Alba Earth identifies and documents the primary legal basis relied upon in accordance with internal compliance procedures.
Lawful basis determinations are reviewed periodically and updated where processing activities evolve.
For individuals located in Singapore, personal data is processed in accordance with the Singapore Personal Data Protection Act 2012 (“PDPA”). Processing is limited to purposes that a reasonable person would consider appropriate in the circumstances and that have been notified to the individual. Where required under the PDPA, consent will be obtained prior to the collection, use, or disclosure of personal data, and individuals may withdraw consent in accordance with applicable law.
Alba Earth implements reasonable security arrangements to protect personal data in its possession or under its control and takes appropriate steps to ensure that personal data is protected against unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks. Where personal data is transferred outside Singapore, Alba Earth ensures that such transfers are subject to safeguards providing a standard of protection comparable to that required under the PDPA.
For individuals located in the United States or other jurisdictions, personal data is processed in accordance with applicable local data protection and privacy laws. Where required by law, additional notices, rights, or disclosures may apply, including rights relating to access, correction, deletion, or opt-out of certain data uses. Where jurisdiction-specific requirements impose higher or additional standards, such standards shall apply to the extent required.
Nothing in this section limits the application of other provisions of this Privacy Policy where multiple legal frameworks apply concurrently. Where more than one legal regime applies to a particular processing activity, Alba Earth will comply with the applicable requirements of each regime to the extent required by law.
For residents of certain U.S. states, including California, additional rights may apply under applicable state privacy legislation. Where required by law, individuals may request disclosure of categories of personal data collected, request deletion of personal data, or exercise rights relating to data sharing. Alba Earth does not sell personal data as defined under applicable U.S. state privacy laws.
Alba Earth operates internationally and may transfer, store, and process personal data in jurisdictions outside the user’s country of residence, including jurisdictions where data protection laws may differ from those in the United Kingdom, the European Economic Area, Singapore, or other applicable regions.
Where personal data is transferred from the United Kingdom or the European Economic Area to a jurisdiction that is not subject to an adequacy decision, Alba Earth implements appropriate safeguards in accordance with applicable data protection law. Such safeguards may include the use of the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, binding contractual commitments, or other legally recognised transfer mechanisms.
Where required, Alba Earth undertakes appropriate assessments to evaluate whether transferred personal data will remain subject to a level of protection essentially equivalent to that required under applicable data protection law and may implement supplementary technical, contractual, or organisational measures where appropriate.
Where personal data is transferred from Singapore or other jurisdictions with cross-border transfer restrictions, Alba Earth ensures that transfers are subject to safeguards providing a standard of protection comparable to that required under applicable law.
Personal data may also be processed by third-party service providers located in multiple jurisdictions. In such cases, Alba Earth implements contractual protections, vendor due diligence procedures, and ongoing oversight measures designed to ensure that onward transfers comply with applicable legal requirements.
Where legally required, transfer impact assessments or equivalent risk evaluations are conducted prior to cross-border transfers.
Transfer mechanisms are supplemented, where appropriate, by technical and organisational safeguards designed to mitigate identified transfer risks, including encryption, access controls, and data minimisation practices.
Transfer governance forms part of Alba Earth’s broader data protection compliance framework and is subject to periodic review.
Personal data is retained only for as long as necessary to fulfil the purposes described in this Privacy Policy, including the provision and administration of Platform services, compliance with legal and regulatory obligations, resolution of disputes, enforcement of contractual rights, protection of legal interests, and maintenance of appropriate business records.
Retention periods are determined based on the nature, sensitivity, and purpose of the data, applicable statutory limitation periods, regulatory requirements, contractual obligations, and operational necessity. Alba Earth applies principles of data minimisation and storage limitation and does not retain personal data for longer than is reasonably required for the relevant purpose.
Personal data may be retained in active systems for operational use and, where appropriate, in secure backup or archival systems for limited periods to ensure system integrity, business continuity, and compliance with legal obligations. Access to archived data is restricted and subject to appropriate security controls.
Where personal data is no longer required for the purposes for which it was collected, it is securely deleted, anonymised, or otherwise rendered irreversibly inaccessible in accordance with internal retention schedules and applicable legal requirements. In certain circumstances, personal data may be retained for longer periods where required by law or where subject to legal hold obligations.
Retention practices are subject to periodic review and internal governance oversight to ensure continued compliance with applicable legal and operational requirements.
Personal data may be disclosed to third-party service providers that support the operation, administration, security, and improvement of the Platform, including hosting providers, cloud infrastructure providers, analytics providers, payment processors, security and monitoring providers, integration partners, professional advisers, and other vendors who process personal data on behalf of Alba Earth.
Such disclosures are limited to what is necessary for the relevant service and are subject to appropriate contractual safeguards. These safeguards may include data processing agreements, confidentiality obligations, information security requirements, restrictions on further processing, limitations on onward transfers, and audit or oversight rights, in accordance with applicable data protection law.
Personal data may also be disclosed where required to comply with applicable law, regulation, court order, lawful request from a governmental or regulatory authority, or where disclosure is necessary to establish, exercise, or defend legal claims, protect legal rights, or safeguard the rights, property, or safety of Alba Earth, its users, or third parties.
In the event of a merger, acquisition, restructuring, financing, asset sale, or other corporate transaction, personal data may be transferred as part of the relevant assets, subject to confidentiality obligations, due diligence requirements, and applicable data protection safeguards. Where required, individuals will be notified in accordance with applicable law.
Alba Earth does not sell personal data and does not disclose personal data to third parties for their independent marketing purposes without an appropriate lawful basis.
Alba Earth implements appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful access, disclosure, alteration, destruction, loss, or other forms of improper processing. Such measures are proportionate to the nature, scope, context, and purposes of processing, as well as the risks posed to individuals’ rights and freedoms.
Security controls are based on a risk-based approach and may include access governance and role-based access controls, encryption or pseudonymisation where appropriate, secure system architecture, network monitoring, vulnerability and patch management, incident detection mechanisms, and procedures designed to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
Alba Earth conducts periodic security reviews and risk assessments to evaluate the effectiveness of implemented safeguards.
Alba Earth maintains internal policies and governance frameworks relating to information security, access management, data handling, and incident response. Personnel with access to personal data are subject to confidentiality obligations and appropriate training.
Third-party service providers processing personal data on behalf of Alba Earth are required to implement appropriate security safeguards through contractual obligations, due diligence processes, and ongoing oversight measures.
While reasonable and proportionate measures are taken to safeguard personal data, no method of transmission over the Internet or electronic storage can be guaranteed to be entirely secure. Accordingly, users transmit information at their own risk, and Alba Earth cannot guarantee absolute security.
In the event of a data security incident, Alba Earth will assess the impact of the incident and take appropriate remedial action in accordance with applicable legal and regulatory requirements, including notification obligations where required.
Where required by applicable law, Alba Earth will notify relevant supervisory authorities and affected individuals within statutory timeframes following the identification of a personal data breach.
Security controls are aligned with industry standards appropriate to the scale and risk profile of the Platform and are subject to ongoing evaluation and improvement.
Where applicable under the UK General Data Protection Regulation and the EU General Data Protection Regulation, individuals have the right to request access to their personal data, rectification of inaccurate or incomplete data, erasure of personal data, restriction of processing, objection to processing, and the right to receive personal data in a structured, commonly used, and machine-readable format where legally required.
Individuals also have the right, where applicable, not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, except where permitted under applicable law and subject to appropriate safeguards.
Requests to exercise these rights may be submitted using the contact details provided below. Alba Earth may require reasonable verification of identity before fulfilling such requests in order to protect personal data from unauthorised disclosure. Requests will be handled in accordance with applicable legal timeframes and, where permitted by law, may be subject to reasonable limitations, exemptions, or extension of response periods where requests are complex or numerous.
Unless otherwise permitted under applicable law, requests will be handled free of charge. Where a request is manifestly unfounded or excessive, Alba Earth reserves the right to refuse the request or charge a reasonable administrative fee in accordance with applicable law..
Individuals also have the right to lodge a complaint with a competent supervisory authority, including the authority in their place of habitual residence, place of work, or place of the alleged infringement, and with the UK Information Commissioner’s Office (ICO) where theUK GDPR applies.
The Platform may generate AI-driven outputs based on user-provided inputs, interaction data, and system-derived information. Such outputs are produced through algorithmic processing designed to deliver requested functionality, enhance user experience, maintain system integrity, detect misuse or anomalous activity, and improve overall service performance where permitted by applicable law.
AI-generated outputs are intended to assist users and do not constitute legally binding decisions, professional advice, medical advice, financial advice, or determinations producing independent legal or similarly significant effects. Users remain responsible for evaluating and determining the appropriateness, accuracy, and applicability of any outputs generated by the Platform.
Alba Earth does not engage in solely automated decision-making that produces legal or similarly significant effects on individuals without appropriate safeguards in accordance with applicable data protection law. Where automated processing forms part of Platform functionality, it operates within the lawful bases described in this Privacy Policy and in accordance with applicable legal principles, including fairness, transparency, purpose limitation, and data minimisation.
Automated processing is subject to internal governance controls, technical safeguards, model evaluation procedures, and periodic review processes designed to promote reliability, proportionality, and compliance with applicable legal requirements. Where required by law, individuals may request human review of decisions involving automated processing that significantly affect them.
Personal data processed through AI-driven functionality is limited to what is necessary for the delivery of the requested service and is not used for unrelated purposes without an appropriate lawful basis.
Where anonymised or aggregated data is used for the purpose of improving AI systems, such use will occur only in accordance with applicable legal requirements. Where required, users will be informed and provided with a clear opportunity to opt out.
Where model evaluation or improvement involves personal data, Alba Earth will provide appropriate transparency and implement the required lawful basis and safeguards.
Alba Earth maintains internal governance processes relating to AI system design, evaluation, and deployment. Such processes include structured review of model behaviour, risk assessment of automated outputs, and oversight mechanisms proportionate to the nature of the processing.
The Platform is not designed or intended to operate as a high-risk AI system within the meaning of emerging AI-specific regulatory frameworks.
The Platform deploys cookies and similar technologies necessary for core functionality, security, system integrity, fraud prevention, and the provision of essential services. Such cookies enable the operation of the Platform and cannot be disabled without affecting basic functionality, service availability, or security safeguards.
Cookies may include session-based and persistent cookies, as well as first-party technologies and, where applicable, limited third-party technologies required to support hosting infrastructure, payment processing, security monitoring, or integrated services.
Where only strictly necessary cookies are used, consent mechanisms may not be required under applicable law. Where the Platform deploys only strictly necessary cookies, Alba Earth may provide a cookie settings panel without deploying a consent banner. Alba Earth assesses cookie usage in accordance with relevant regulatory requirements, including applicable UK and EU ePrivacy rules and related data protection obligations, and determines the appropriate lawful basis for the deployment of each category of cookies.
A cookie settings panel is made available to allow users to review the categories of cookies in use and manage preferences where applicable. Users may modify their cookie preferences at any time through the settings panel, subject to the limitations applicable to strictly necessary cookies. Users may also control cookies through browser-level settings; however, disabling certain cookies may affect Platform functionality.
Further information regarding cookie categories, purposes, duration, and retention periods is provided in the applicable Cookie Policy or related notice. Cookie practices are subject to periodic review and internal governance oversight to ensure continued compliance with legal and operational requirements.
Where third-party technologies are used, such providers are subject to contractual safeguards designed to ensure compliance with applicable data protection standards. Alba Earth does not permit the use of cookies for independent third-party marketing purposes without an appropriate lawful basis.
If additional categories of cookies or tracking technologies are introduced, including analytics, performance, advertising, or behavioural tracking technologies, appropriate disclosures, transparency measures, and consent mechanisms will be implemented prior to activation, and this Privacy Policy and related documentation will be updated accordingly.
Alba Earth reserves the right to modify or update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, supervisory authority recommendations, industry standards, operational practices, security requirements, technological developments, or the functionality of the Platform.
Any updates will take effect upon publication on the Platform unless otherwise stated. The “Last revised” date at the top of this Policy will indicate the date of the most recent update. Where required by applicable law, or where changes materially affect the manner in which personal data is collected, used, disclosed, or transferred, Alba Earth will provide additional notice through the Platform, by email, or through other appropriate communication channels designed to ensure transparency.
Updates will not apply retroactively in a manner inconsistent with applicable data protection law. Alba Earth will not materially reduce the level of protection afforded to personal data without a lawful basis and, where required, appropriate notice or consent.
Where changes require renewed consent under applicable legal requirements, such consent will be obtained prior to the continued processing of personal data affected by such changes. Where processing is based on legitimate interests, Alba Earth will reassess the balancing of interests where material changes occur.
Continued use of the Platform following the publication of an updated Privacy Policy constitutes acknowledgment of the revised terms, except where additional consent is required under applicable law.
This Privacy Policy does not override or modify any specific data protection terms agreed separately with enterprise customers under a binding data processing agreement.
Users are encouraged to review this Privacy Policy periodically to remain informed about how personal data is collected, used, safeguarded, and transferred.
Alba Earth Pte. Ltd.
UEN: 202545479G
Registered office: 51 Goldhill Plaza, #07-10, Singapore 038988
Alba Earth acts as the data controller for the purposes described in this Privacy Policy.
For any questions regarding this Privacy Policy or to exercise applicable data protection rights, individuals may contact:
Email: privacy@albaearth.com
Privacy Lead: The Data Protection Team
Individuals also have the right to lodge a complaint with a competent supervisory authority as described in Section 12 of this Privacy Policy.
Where required under Article 27 of the EU General Data Protection Regulation, Alba Earth has appointed, or will appoint, a representative within the European Union. Details of such representative will be made available in this Privacy Policy.
Early access is free. The first 500 members permanently lock in exclusive perks and founder-level access. Your feedback will shape what Zenda becomes.
