Privacy policy

1. Scope and effective date

This policy covers jumborca.com, the Jumborca customer portal, and your correspondence with us by form or email. Data that Jumborca software processes inside a customer’s own environment is controlled by that customer and governed by the signed contract and data-processing terms, not by this policy.

This version (v2.0) takes effect on 2026-09-20 and replaces the 2026-04-01 version.

2. Who is responsible

• Mainland China: Suzhou Jumborca Software Technology Co., Ltd., Room 1907, GCL Plaza, Suzhou Industrial Park, Jiangsu.
• Singapore and other regions: Jumborca Pte. Ltd., 6 Raffles Quay, #14-02, Singapore 048580.

Both entities share responsibility for personal data handled through this site and the portal; the single point of contact is compliance@jumborca.com.

3. What we collect

• Access logs: IP address, browser type, request path and time, used for security analysis and troubleshooting.
• Forms and email: the name, work email, company, title, phone (optional) and message you provide through the contact form, a demo booking or email.
• Portal accounts: the email, name, company, title and role of a customer portal account, plus the time, IP and browser of each sign-in.
• Cookies and local storage: necessary items only; the full list is in the cookie policy.

We do not collect sensitive personal data through this site and we do not use any third-party advertising or behavioural analytics script.

4. Why we use it

• To reply to your enquiry, arrange demos and POCs, and deliver the software and services agreed in your contract;
• To operate and secure the site and portal, and to detect and prevent abuse;
• To meet legal, regulatory, financial and audit obligations;
• To improve the site and our products.

We do not sell your personal data to anyone, and we do not use it for automated decision-making unrelated to the purposes above.

5. Legal bases

• Personal Information Protection Law of the People’s Republic of China (PIPL): your consent; necessity for concluding or performing a contract; necessity for meeting legal obligations; and the other circumstances the law provides.
• Singapore Personal Data Protection Act 2012 (PDPA): your consent or deemed consent, and the statutory exceptions. Jumborca has completed a PDPA compliance assessment.
• If you are in the EU, the UK or another jurisdiction, we process your data in line with GDPR / UK GDPR and the applicable local law.

6. How long we keep it

• Access logs: 30 days.
• Forms and email correspondence (prospect data): 24 months from the last contact.
• Business information of contracted customers: three years after the end of the relationship, or longer where Chinese law requires it.
• Portal accounts: for the life of the account; kept for 30 days after closure, then deleted or anonymised.
• Sign-in session records: 30 days.

7. Sharing and processors

We share data only as needed to provide the service, with these processors:

• Microsoft Azure: hosts the site, portal, database and object storage.
• Azure Communication Services: sends form confirmations and notification emails.
• Google Fonts: serves web fonts; your browser sends your IP address to Google and the service sets no cookies.
• Azure OpenAI: the AI features of the customer portal send what you type to Azure OpenAI for processing. The service runs inside our own Azure subscription and acts as a processor; your input is not used to train models.

We disclose personal data to no other third party except where the law requires it, in a regulatory investigation, or to protect the legitimate interests of Jumborca and its users. In the event of a merger, acquisition or asset transfer we will tell you in advance.

8. Where it is stored and cross-border transfers

The site and portal are hosted in Microsoft Azure’s Asian regions: the website in East Asia (Hong Kong), the backend and database in Southeast Asia (Singapore). Data you submit through the site and portal is therefore stored and processed outside mainland China. For users in mainland China, we obtain your separate consent to the cross-border transfer before your personal data is transferred.

For transfers out of Singapore we follow the PDPA transfer limitation obligation and ensure the recipient provides a comparable standard of protection.

9. Your rights

Under PIPL and PDPA you can:

• Access and obtain a copy of your personal data;
• Ask us to correct or complete it;
• Ask us to delete it, or to restrict processing where the law allows;
• Withdraw consent, without affecting processing carried out before withdrawal;
• Close your portal account;
• Ask us to explain our processing rules;
• Under PDPA, ask how your personal data has been used or disclosed within the past year.

Email compliance@jumborca.com with the subject “Personal data request”. We reply within 15 working days of verifying your identity. Cookie preferences can be changed at any time via “Cookie settings” in the footer.

10. Security

TLS 1.2+ in transit; encryption at rest for the database and object storage; Microsoft Entra identities with enforced multi-factor authentication for portal accounts and staff; least-privilege production access with full audit trails. Details are in the security notes. If a personal data breach could affect your rights, we notify the regulator and you as the law requires.

11. Children

The site and services are intended for business users and not for anyone under 18. We do not knowingly collect personal data from minors; if you believe we have, contact us and we will delete it.

12. Changes to this policy

Material changes are reflected in the version and effective date in the header and, where appropriate, communicated to contracted customers by email. Earlier versions are available on request.

13. Contact

• Email: compliance@jumborca.com (the former privacy@ alias is no longer in use)
• Mainland China: Suzhou Jumborca Software Technology Co., Ltd., Room 1907, GCL Plaza, Suzhou Industrial Park, Jiangsu
• Singapore: Jumborca Pte. Ltd., 6 Raffles Quay, #14-02, Singapore 048580