Privacy Policy

QCE Vision ("QCE Vision," "we," "our," "us") operates the sovereign substrate for connected enterprises, a deep-tech infrastructure layer comprising compute, intelligence, distribution, and economics, anchored in the Johor-Singapore Special Economic Zone (JS-SEZ). This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you visit qcevision.com, use any QCE Vision platform, engage with the OmniPlace marketplace, or otherwise interact with our ecosystem.

This policy applies to all entities operating under the QCE Vision group, QCE Global, QCE Gateway, QCE Technologies, QCE AI, and QCE 360, unless a specific product publishes its own supplementary notice, in which case that notice governs the product and this policy governs the remainder of the relationship.

We hold a simple position: information you entrust to a sovereign platform should remain sovereign. That principle shapes every clause below, from what we collect, to where it resides, to how long we keep it, to how you make it disappear.

We collect three categories of information, and nothing beyond what the service requires.

We do not knowingly collect special-category data, health, biometric, political, religious, or sexual-orientation information, and we ask that you do not upload such data into any QCE Vision platform.

Information we hold is used for the following purposes, and no others:

• Service Delivery: Provisioning accounts, executing workloads on the sovereign substrate, and delivering the platform features you or your organisation have engaged.
• Security & Integrity: Authenticating access, detecting and responding to threats, preventing fraud, and maintaining the Zero-Trust boundary across human, agent, and machine interfaces.
• Commercial Operations: Billing, settlement, treasury reconciliation, and the administration of contracts, licences, and facilities.
• Support & Communication: Responding to your enquiries, delivering service notices, and, where you have opted in, sharing product updates and ecosystem news.
• Product Improvement: Analysing aggregated, pseudonymised usage to improve platform reliability, performance, and capability.
• Legal & Regulatory Compliance: Meeting our obligations under applicable law, responding to lawful requests, and enforcing our agreements.

We do not use your information to train third-party artificial-intelligence models, and we do not sell your information to any party for any purpose. Ever.

We do not sell your personal data. We do not rent it, trade it, or expose it to advertising networks. We share information only in the narrow circumstances below:

• Within the QCE Vision Group: Between our five operating entities, strictly to deliver the service you engaged and subject to this policy.
• Service Providers: Regulated payment processors, infrastructure operators, and professional advisers, bound by contract to process data only on our instructions and under confidentiality.
• Partners You Have Engaged: Where you have explicitly directed us to share information with a third party, for example, a broker, adviser, or integration you have authorised.
• Legal & Regulatory: Where required by law, court order, or a competent regulatory authority, and only to the extent legally compelled. Where permissible, we notify you before disclosure.
• Corporate Transactions: In the event of a merger, acquisition, or asset transfer, information may be transferred to the successor entity, subject to this policy or a policy of equivalent protection.

QCE Vision operates from the Johor-Singapore Special Economic Zone, and our default posture is one of residency-first, transfer-second. Information you entrust to QCE Vision is stored and processed within the jurisdiction you select during onboarding, or, where no selection is made, within our primary JS-SEZ and Singapore infrastructure.

• Default No-Transfer Posture: We do not transfer personal data across borders unless a lawful transfer mechanism is in place and the transfer is necessary to deliver the service you engaged.
• Jurisdictional Control: Where a customer operates under a regulatory regime that mandates in-country residency, we configure storage and processing to remain within that jurisdiction.
• Cryptographic Custody: Encryption keys are held in hardware security modules under our control. Core intellectual property, algorithms, and keys reside in private, sovereign enclaves, never on public cloud infrastructure.
• Full Policy: The complete residency, transfer, and jurisdictional-control framework is set out in our Data Sovereignty & Residency Policy.

Security is engineered into the substrate, not bolted onto it. We protect information with the following measures, applied consistently across our platforms:

• Encryption in Transit: Mutual TLS (mTLS) on all internal and external interfaces; TLS 1.3 for public endpoints.
• Encryption at Rest: AES-256 for stored data, with hardware security modules safeguarding key material.
• Zero-Trust Architecture: Every human, agent, and machine-to-machine request is authenticated and authorised, no implicit trust by network position.
• Least-Privilege Access: Role-based access controls limit data visibility to those with a documented need, with all access logged.
• Continuous Audit: Automated schema audits and integrity checks run on a fixed cadence; anomalies trigger immediate investigation and remediation.
• Sovereign Infrastructure: Core systems run on bare-metal and private enclaves under our operational control, reducing exposure to third-party platform risk.

No system is perfectly secure. If we become aware of a breach affecting your information, we will notify affected parties and the relevant authorities without undue delay, and we will publish a post-incident account of what occurred and what we changed.

We retain information only for as long as it serves the purpose for which it was collected, or as long as applicable law requires. Retention is governed by the following principles:

• Active Accounts: Retained for the life of the relationship, and for a reasonable period afterward to meet billing, legal, and support obligations.
• Security Logs: Retained for a defined window sufficient to investigate incidents, then deleted or irreversibly aggregated.
• Legal Holds: Where information is subject to a legal hold, litigation, or regulatory request, retention is extended until the matter concludes.
• Deletion Requests: On a verified deletion request, personal data is permanently removed from our production systems within 30 days, and from backups within the standard backup-rotation window.

Depending on your jurisdiction, including the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Malaysia's Personal Data Protection Act (PDPA), and Singapore's PDPA, you may hold the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Have inaccurate or incomplete data corrected.
• Deletion: Request the erasure of your personal data, subject to legal-retention obligations.
• Portability: Receive your data in a structured, machine-readable format (JSON/CSV).
• Restriction & Objection: Restrict or object to certain processing activities, including direct marketing.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Non-Discrimination: Exercise your rights without any degradation of service.

To exercise any right, write to privacy@qcevision.com. We verify identity before acting, respond within the statutory window applicable to your jurisdiction, and escalate unresolved matters to our Data Protection Officer.

QCE Vision platforms are designed for enterprises, professionals, and adults (18 years and older). We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal data, contact us at privacy@qcevision.com and we will delete it promptly.

We use a minimal set of cookies and local-storage entries, all of which fall into the strictly-necessary or functional category:

• Session Cookies: Required to maintain your authenticated session.
• Preference Storage: Remembers choices such as language, region, and display preference.
• Security Cookies: Supports cross-site request forgery protection and threat detection.

We do not deploy third-party advertising cookies, cross-site tracking pixels, or behavioural-profiling scripts. Where we measure product usage, we do so through self-hosted, pseudonymised analytics.

We may update this policy as our services, our entities, or applicable law evolve. When we make a material change, we will:

• Update the "Last Updated" date at the top of this page.
• Publish a concise summary of the change in our governance changelog.
• Notify affected account holders by email and in-product notice at least 14 days before the change takes effect, where the change materially affects your rights.

Continued use of QCE Vision platforms after the effective date constitutes acceptance of the revised policy.

Questions about this policy, your data, or the exercise of your rights are handled by our Legal, Sovereignty & Compliance function, one of the nine core business functions that govern the QCE Vision ecosystem.