Privacy Policy

Taurus One Private Limited (UEN 201810116D) (formerly Janio Technologies Private Limited) ("Janio," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our Fourth-Party Logistics (4PL) platform, services, or visit our website at janio.asia. This policy applies to all users of our services, including shippers, merchants, carriers, and website visitors. By accessing or using our services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, please do not use our services. We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

We collect information necessary to provide our 4PL logistics services effectively. The types of information we collect depend on how you interact with our platform and services.

We use the information we collect for the following purposes:

As a 4PL orchestrator, we share information with third parties only as necessary to fulfill our services or as required by law. We maintain strict controls over all data sharing.

We implement comprehensive security measures to protect your information from unauthorized access, disclosure, alteration, and destruction. Our security practices include: Technical Safeguards: We employ AES-256 encryption for data at rest and TLS 1.3 encryption for data in transit. We require multi-factor authentication for account access and conduct regular security assessments and penetration testing. Our systems are monitored 24/7 for security threats. Organizational Controls: We implement role-based access control (RBAC) for all systems and require employee security training and awareness programs. Personnel with data access undergo background checks. We maintain documented incident response procedures and conduct regular access reviews with comprehensive audit logging. Independent Assurance: Our Information Security Management System is certified to ISO/IEC 27001:2022 (certificate IC-IS-2607249, issued by InterCert, valid from 17 July 2026). We also undergo an annual SOC 2 Type II examination covering the Security, Availability and Confidentiality Trust Services Criteria for the Janio Platform. Copies of our certificate and report are available to customers and prospective customers on request, subject to a non-disclosure agreement. Breach Notification: We maintain a documented incident response and breach notification plan. If a personal data breach occurs that is likely to result in significant harm, we will notify the relevant supervisory authority — including Singapore's Personal Data Protection Commission — and affected individuals without undue delay and within the timeframes required by applicable law. Where we act as a processor for a merchant, we will notify that merchant without undue delay so that they can meet their own notification obligations. While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, but we continuously work to enhance our security measures.

We retain your information only as long as necessary for the purposes outlined in this policy or as required by law. Our retention periods are as follows: Personal data held on behalf of a client, including recipient names, delivery addresses and contact details, is retained for the duration of the client contract plus three (3) months from termination, or for such shorter or longer period as that client contract specifies. Application database backups follow the same period. Financial records, customs declarations and commercial invoices are retained for the period required by applicable tax, customs and accounting law, currently up to seven (7) years. Technical logs are retained for twelve (12) months for security monitoring. Marketing preferences are retained until you withdraw your consent. Where more than one period could apply to the same record, we apply the longest period required by statute, then by contract, then by our internal policy. Upon expiration of the applicable retention period, we securely delete or anonymize your information. Deletion is performed by secure overwriting or cryptographic erasure so that the data is irrecoverable, and the same requirement applies to backup and archived copies. Account deletion requests are processed within thirty (30) days. Backup data is purged according to our retention schedule. Carriers are contractually required to delete the personal data we share with them once it is no longer needed for delivery and any applicable regulatory retention period has expired; because carriers act under their own legal obligations in each destination market, we cannot guarantee deletion within a fixed period.

Depending on your location, you may have certain rights regarding your personal information under applicable data protection laws, including the General Data Protection Regulation (GDPR) and Singapore's Personal Data Protection Act (PDPA). Right of Access: You may request a copy of the personal information we hold about you. Right to Rectification: You may request that we correct any inaccurate or incomplete personal information. Right to Erasure: You may request that we delete your personal information, subject to certain exceptions. Right to Data Portability: You may request to receive your personal information in a structured, commonly used, and machine-readable format. Right to Object: You may object to certain processing of your personal information. Right to Restrict Processing: You may request that we limit how we use your personal information. Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. To exercise any of these rights, please contact us at privacy@janio.asia. We will respond to your request within thirty (30) days. We may need to verify your identity before processing your request. There is no fee for reasonable requests, though we may charge a reasonable fee for manifestly unfounded or excessive requests. If you are a delivery recipient: Where we hold your personal data only because a merchant asked us to deliver an order to you, that merchant is the controller of your data and is best placed to answer your request. Please contact them directly. If you contact us, we will acknowledge your request, tell you which merchant instructed the delivery where we are permitted to do so, and refer your request to them.

As a cross-border logistics provider operating across Southeast Asia, we transfer personal information internationally to fulfill shipments and provide our services. Our primary data storage is located in Singapore. When we transfer personal information outside of your country of residence, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by relevant data protection authorities, Data Processing Agreements with all subprocessors, adequacy assessments for destination countries, and encryption of all cross-border data transfers. We maintain regional compliance with data protection laws in the countries where we operate and can provide regional data residency options where available and required.

Our services are not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at privacy@janio.asia. If we become aware that we have collected personal information from a child without verification of parental consent, we will take steps to remove that information from our servers.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. We will notify you of any material changes by posting the updated policy on our website and updating the "Last Updated" date at the top of this page. For material changes, we will provide notice via email to account holders at least thirty (30) days before the changes take effect. Your continued use of our services after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. Previous versions of this policy are available upon request.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Taurus One Private Limited (UEN 201810116D) 30 Prinsep St, #06-01 Singapore 188647 Email: privacy@janio.asia Data Protection Officer: dpo@janio.asia We will respond to your inquiry within five (5) business days. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority. In Singapore, this is the Personal Data Protection Commission (www.pdpc.gov.sg).