GDPR Statement

Balian AI is incorporated and operates in Singapore and is not established in the European Union. This statement explains our position on the EU General Data Protection Regulation (“GDPR”) and how it may apply to our processing of personal data. It supplements our Privacy Policy and should be read together with it.

1. Does GDPR apply to Balian AI?

Under Article 3(2) GDPR, the Regulation can apply to an organisation outside the EU, without any EU establishment, where the organisation:

(a) offers goods or services to individuals located in the EU (regardless of whether payment is involved); or

(b) monitors the behaviour of individuals located in the EU, to the extent that behaviour takes place within the EU.

We assess whether this applies to us on an ongoing basis. In practice this can be triggered by, for example:

• accepting or actively pursuing advisory engagements involving personal data of individuals based in the EU; or
• marketing the Site or our services specifically to organisations or individuals in the EU.

The Site does not use analytics, tracking technology, or cookies of any kind, and therefore does not monitor the behaviour of EU-based (or any other) visitors.

Where none of the above applies — for instance, where an enquiry or engagement has no connection to the EU — GDPR does not apply to that specific processing, and Singapore’s PDPA governs instead (see our Privacy Policy).

2. Our approach where GDPR applies

Where GDPR applies to specific processing, we apply GDPR-consistent standards to that processing, including:

• identifying a valid legal basis for processing (consent, contract, legitimate interests, or legal obligation);
• honouring the extended data subject rights available under GDPR — access, rectification, erasure, restriction, objection, and data portability (see Section 7 of our Privacy Policy);
• notifying the relevant supervisory authority within 72 hours of becoming aware of a qualifying personal data breach, per Article 33, and notifying affected individuals where required by Article 34;
• using only approved transfer mechanisms (such as Standard Contractual Clauses) for any transfer of in-scope personal data outside the EEA, per Chapter V GDPR; and
• keeping records of the processing activities that fall within GDPR’s scope, per Article 30.

3. EU representative (Article 27)

Article 27 GDPR generally requires a non-EU controller or processor that falls within Article 3(2) scope to designate, in writing, a representative established in a Member State where the relevant data subjects are located — unless a statutory exemption applies (broadly: processing that is occasional, does not involve large-scale special category data, and is unlikely to result in a risk to individuals).

4. Your rights, and how to exercise them

If GDPR applies to processing of your personal data by Balian AI, you have the rights described in Section 7 of our Privacy Policy, including the right to lodge a complaint with your local EU supervisory authority. To exercise any right, or to ask whether GDPR applies to your particular situation, contact:

Data Protection Officer
Balian AI (Shasana Balian AI Pte Ltd)
Singapore
Email: info@balian.ai

5. Relationship to client engagements

Where Balian AI processes personal data solely as a processor on the instructions of a client (for example, personal data within a client’s own AI system that we are engaged to assess or help govern), GDPR obligations relating to that data are principally addressed in the data processing terms of the relevant client contract, not this statement.

6. Related policies

See also our Privacy Policy, Terms of Service, and AI Transparency Statement.

This page is for general information and does not constitute legal advice. Whether GDPR applies to a given situation, and what an Article 27 assessment should conclude, depends on specific facts and should be confirmed with qualified counsel.