Privacy Policy

Last updated 28 February, 2025

1. Declaration

Conversant Solutions Pte Ltd ("Conversant," "we," "us," or "our") is committed to safeguarding personal data and privacy rights in compliance with applicable regulations, including the EU General Data Protection Regulation (GDPR), China’s Personal Information Protection Law (PIPL), Singapore’s Personal Data Protection Act (PDPA), Malaysia’s Personal Data Protection Act (PDPA), Thailand’s Personal Data Protection Act (PDPA), and Indonesia’s Personal Data Protection Law (PDP Law).

This Privacy Policy describes the personal data we collect, how we use it, and the choices available to you regarding our handling of your personal data.

If you have any questions about this policy or your rights, you may contact us at:

Email: support@conversant.tv

Mailing Address: Conversant Solutions Pte Ltd, 250 North Bridge Road #17-01, Raffles City Tower, Singapore 179101.

2. Scope & Applicability

This Privacy Policy applies to:

Website Visitors: Individuals who access our website www.swiftfederation.com and related services, including those who may opt to provide an email address or other contact information receive communications from Conversant, fill out a survey, or provide feedback. [For clarity, “Websites” does not include any sites owned or operated by our Customers, including where we serve as Registrar.]
Customers & Partners: Businesses and individuals who enter into a subscription agreement with Conversant (or its authorized partner) and to whom Conversant provides services pursuant to such agreement. For purposes of this Policy, “Services” refers to all of the cloud-based solutions offered, marketed, or sold by Conversant or its authorized partners that are designed to increase the performance, security, and availability of Internet properties, applications, devices, and networks, along with any software, software development kits, and application programming interfaces ("APIs") made available in connection with the foregoing.
Administrative Users: Individuals with login credentials for a Conversant account and/or those who administer any of the Services for a Customer. In some cases, an Administrative User and Customer may be the same individual. In other cases, an Administrative User may be an agent acting on behalf of a Customer.
End Users: Individuals who (i) access or use our Customers’ domains, networks, websites, application programming interfaces, and applications, or (ii) Customers’ employees, agents, or contractors, who access or use our services.
Job Applicants & Employees: Those applying for or working with Conversant.
Attendees: Individuals who visit our offices or provide their information to Conversant or Conversant representatives when they attend or register to attend Conversant-sponsored events or other events at which Conversant (and/or its representatives) participates, as well as those who participate in Conversant’s studies such as user experience research.

Third-party websites or services: This policy does not apply to third-party websites or services that may be linked from our platform, including Customers’ domains, websites, APIs, applications, and networks, which may have their own terms and privacy policies. Our Customers are solely responsible for establishing policies for and ensuring compliance with all applicable laws and regulations, including those relating to the collection of personal information, in connection with the use of our Services by End Users with whom our Customers interact.

Personal data of Minors: Conversant’s websites and services are not intended for, nor designed to attract, individuals under the age of eighteen. Conversant does not knowingly collect or share personal information from any person under the age of eighteen. To the extent we become aware that we have the personal information of a person under the age of eighteen, we will delete that information. If you become aware of any data we may have collected from children under age 18, please contact us at support@conversant.tv.

When Conversant is a reverse proxy, our IP addresses may appear in WHOIS and DNS records for websites using our Services. We are a conduit for information controlled by others. It is our Customers and their users who are responsible for the content transmitted across our network (e.g., images, written content, graphics, etc.).

3. Information We Collect

3.1 Personal Data You Provide

Conversant may collect your personal information as a Data Controller, or on-behalf of our customers or business partners or affiliates as a Data Processor.

3.1.1 When we act as a Data Controller

As a data controller, Conversant collects personal information that you voluntarily provide based on your relationship with Conversant, or for Conversant’s own business purposes, such as providing services, account management, customer support, and legal compliance. Where legally required, Conversant shall obtain consent before such data collection.

3.1.1.1 Consent Requirements

Conversant obtains consent in the following scenarios:

Marketing & Communications: Users must provide explicit opt-in consent before receiving promotional content.
Cookies & Tracking Technologies: Users are presented with a cookie consent banner where they can accept, reject, or customize tracking preferences (See Section 3.3).
Sensitive Data Processing: If Conversant collects sensitive data (e.g., biometric or health data), explicit consent will be obtained before processing.
International Data Transfers: In jurisdictions such as China (PIPL), explicit consent may be required before transferring personal data outside the country.

3.1.1.2 Explicit Consent Mechanisms:

Affirmative Opt-in Actions: Users actively agree to data collection by selecting consent checkboxes or clicking “Accept.”
Granular Consent Management: Users can select different levels of consent (e.g., marketing emails, personalized tracking).
Withdrawing Consent: Users can withdraw consent at any time through by contacting support@conversant.tv.
Record Keeping: Conversant maintains audit logs of consent records to comply with legal requirements.

3.1.1.3 Data Subjects Categories and Data Collection

The categories of data subjects and the types of personal data collected are as follows:

Website Visitors
- Name, email address, and contact details (if submitted via web forms).
- IP address and device/browser details (for security and analytics).
- Data collected via cookies and other tracking technologies. For more information on data that we collect automatically, see Section 3.3.
Customers, Partners, Administrative Users & Business Contacts
- Name, job title, company name, email, phone number.
- Account credentials (username, password, authentication data).
- Payment and billing details (for paid services).
- Customer support interactions and inquiries.
Employees & Job Applicants
- Resume details, employment history, education background.
- Contact details (email, phone number, home address).
- Government-issued identifiers (where required by law).
End Users of Conversant Services (when acting as a Data Processor)
- User-provided profile information as managed by our customers.
- Content or communication data stored in customer applications.
Attendees
- Name, job title, company, contact details.
- Event attendance records, marketing preferences, and consent status.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

3.1.2 When Conversant is a Data Processor

3.1.2.1 Consent

When acting as a Data Processor, Conversant does not collect consent directly from individuals. Instead:

The Data Controller (Conversant’s customer) is responsible for obtaining user consent.
Conversant processes personal data only under the explicit instructions of the Data Controller, as governed by the Data Processing Agreement (DPA).
If an End User withdraws consent , Conversant follows the Data Controller’s instructions to delete or restrict processing of the data.
If Conversant receives a direct request regarding consent from an individual, we refer them to the Data Controller .

3.1.2.2 Data Collection

When providing services and content delivery solutions (CDN) for customers, Conversant does not collect personal data for its own use but processes data on behalf of customers (who are the Data Controllers). The types of data processed may include:

End Users of Conversant Services (Data collected by customers using Conversant’s services)
User-provided profile information as managed by our customers.
Content or communication data stored in customer applications.
Business Partner Employees (Data provided by customers for secure operations)
Employee or administrator contact details required for service access.

Conversant does not control or determine how this data is used. Data Controllers (Conversant’s customers) are responsible for:

Providing notice and obtaining consent from data subjects.
Determining the lawful basis for processing under applicable laws.
Handling requests related to data access, correction, and deletion.

3.2 Sensitive Information

Conversant does not intentionally collect or process sensitive personal data, such as government-issued identification numbers, biometric data, health records, racial or ethnic information, religious beliefs, sexual orientation, or political affiliations. If we ever need to collect such information, we will obtain your explicit consent before processing, as required by applicable laws, and will implement additional safeguards to protect your data. Users should avoid providing sensitive data unless explicitly requested by Conversant for a valid purpose.

3.3 Data Collected Automatically

We collect certain information automatically when you visit our services. This data is collected only when Conversant is a Data Controller:

Log & Usage Data: IP address, device information, browser type, website interactions. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called “crash dumps”), and hardware settings).
Cookies & Tracking Technologies: Data on user preferences and engagement. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information. For information on our Cookie and Tracking Policy, see Section 12.
Location Data: If permitted, we collect approximate geolocation. We collect location data such as information about your device’s location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device.

3.4 Third-Party Data Sources

Conversant may receive personal data from third-party sources, such as business partners, fraud prevention services, and publicly available information. The collection and usage of third-party data depend on Conversant’s role as a Data Controller or Data Processor.

3.4.1 When Conversant is a Data Controller:

Conversant receives and uses third-party data for:

Account verification and authentication (e.g., fraud prevention databases).
Business analytics and service improvement (e.g., marketing insights, industry reports).
Regulatory compliance (e.g., due diligence for financial transactions).
Marketing and business development (subject to user consent).

Third-party data used in these cases is processed based on legitimate interests, legal obligations, or consent, and users may exercise rights to access, correct, or delete this data where applicable.

3.4.2 When Conversant is a Data Processor:

Conversant may receive third-party data on behalf of a Data Controller (i.e., a client using Conversant’s services). In this case:

Data is processed strictly under the instructions of the Data Controller.
Conversant does not make independent decisions regarding the use of such data.
Requests to access, correct, or delete third-party data must be directed to the Data Controller managing that data.

3.4.3 Data Retention & Deletion of Data from Third-Party Sources

Conversant retains third-party data only for as long as necessary based on its legal basis and contractual obligations.

As a Data Controller, Conversant enforces retention policies in compliance with applicable laws.
As a Data Processor, Conversant follows the Data Controller’s retention and deletion policies per the agreed Data Processing Agreement (DPA).

Once the retention period expires, the data is securely deleted or anonymized unless longer retention is required by law. You may request deletion of your third-party data by contacting us at support@conversant.tv.

4. How We Use Your Information

Conversant may act as either a Data Controller or Data Processor, depending on the nature of the services provided.

4.1 When Conversant is a Data Controller

As a Data Controller, Conversant determines the purposes and means of processing personal data in relation to the following data subjects:

Website Visitors: Individuals who browse or interact with our website.
Customers & Business Contacts: Individuals who purchase our services, register for accounts, or engage with us for business purposes.
Employees & Job Applicants: Individuals applying for or working with Conversant.
Marketing & Event Participants: Individuals who engage with Conversant at industry events, webinars, or marketing campaigns.

As a Data Controller, Conversant processes personal data for:

Account management, billing, and customer support.
Fraud prevention and security monitoring.
Compliance with legal and regulatory obligations.

4.2 When Conversant is a Data Processor

As a Data Processor, Conversant processes personal data on behalf of customers, based on their instructions, for the following data subjects:

End Users of Conversant Services: Users whose data is processed as part of Conversant’s cloud services and content delivery solutions.
Clients’ Customers: Individuals whose data is stored or managed by our customers using our services.
Business Partner Employees: Employees of organizations that use Conversant’s services for internal operations.

As a Data Processor, Conversant follows the instructions of the Data Controller and processes data for:

Secure storage and content delivery.
Cybersecurity threat detection and mitigation.
Enforcing data retention and deletion policies per contractual agreements.

4.3 User Rights & Compliance:

As a Data Controller, Conversant directly handles user requests related to data access, correction, deletion, and portability.
As a Data Processor, Conversant refers data subjects to the Data Controller (our customers) for rights requests.

4.4 Data Protection Measures:

As both a Controller and Processor, Conversant implements encryption, access controls, and breach notification procedures.
As a Processor, Conversant maintains written agreements (Data Processing Agreements - DPAs) with customers, outlining data handling responsibilities.

5. Data Aggregation

Conversant may aggregate and analyze data to improve its services and enhance cybersecurity capabilities. The scope of data aggregation and sharing depends on whether Conversant is acting as a Data Controller or Data Processor:

5.1 When Conversant is a Data Controller:

Conversant aggregates data from its own customers, administrators, and website visitors to:

Analyze cybersecurity trends (e.g., web crawler behaviors, threat intelligence).
Generate web traffic reports and statistics for internal research.
Improve the performance, reliability, and security of Conversant’s services.
Aggregated, non-personally identifiable data may be shared with third parties (e.g., industry partners, security researchers).
Conversant ensures that aggregated data is anonymized where required by law before any sharing occurs.

5.2 When Conversant is a Data Processor:

Conversant does not independently aggregate data from customers’ End Users or business partners.

Any aggregation performed on behalf of a Data Controller (customer or business partner) is governed by the Data Processing Agreement (DPA).

Conversant only aggregates data if explicitly instructed by the Data Controller for purposes such as:

Improving customer-managed threat intelligence capabilities.
Analyzing trends for performance optimization in customer environments.
Aggregated data remains under the control of the Data Controller, who determines how it may be used or shared.

5.3 Anonymization & Data Sharing Safeguards:

Aggregated data is stripped of personal identifiers before sharing.
Conversant does not sell or commercialize aggregated user data.
When acting as a Processor, Conversant ensures that aggregation practices comply with the customer’s contractual and legal requirements.

6. Legal Basis for Processing

Conversant processes personal data under different legal bases depending on its role as a Data Controller or Data Processor.

6.1 When Conversant is a Data Controller

As a data controller, processing is based on:

Consent: Where users explicitly agree to data processing (e.g., marketing communications).
Contractual Necessity: When processing is required to fulfill a contract (e.g., providing cloud services to customers).
Legitimate Interests: For fraud prevention, service improvement, and cybersecurity, provided such interests do not override user rights.
Legal Obligations: To comply with laws and regulatory requirements (e.g., tax, anti-fraud, and compliance measures).
Vital Interests: To protect life, health, or safety in emergency situations

6.2 When Conversant is a Data Processor

As a data processor, processing occurs only under the instructions of a Data Controller and is governed by a Data Processing Agreement (DPA). The legal basis in such cases is determined by the Data Controller, and Conversant:

Processes data solely based on contractual necessity.
Implements security and retention measures as required.
Redirects user rights requests to the Data Controller for processing.

6.3 How This Affects User Rights:

As a Data Controller, Conversant directly handles user requests related to access, correction, deletion, and portability.
As a Data Processor, Conversant cannot process data subject requests directly and forwards such requests to the respective Data Controller.

7. How We Share Information

Conversant shares personal data only when necessary, and the conditions for sharing depend on our role as a Data Controller or Data Processor.

7.1 When Conversant is a Data Controller:

As a data controller, we determine when and how personal data is shared, in accordance with legal obligations and business needs. Data may be shared with:

Service Providers, including vendors, consultants, and other third-party: We may share your data with third-party vendors, service providers, contractors, or agents (“third-parties“) who perform services for us or on our behalf and require access to such information to do that work. For examples, cloud hosting, payment processing, customer support, and analytics. We have contracts and data processing agreement (DPA) and/or Standard Contractual Clauses (SCC) in place with our third parties, which are designed to safeguard your personal information and ensure no sharing of your personal information with any organization apart from us.
Affiliates and Business Partners: For operational purposes, only where there is a legal basis (e.g., consent, contract, legitimate interest). Affiliates include our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
Legal Authorities: If required by law, regulation, or court order.
Fraud Prevention and Security Services: To detect, prevent, and mitigate security risks and fraud.

In which case, we will require the recipients of your information to honor our privacy policy binded by contracts, DPA, and/or SCC as applicable by law.

7.2 When Conversant is a Data Processor:

As a data processor, we only share data on behalf of and under the instructions of our customers (the Data Controllers). This means:

Conversant does not make independent decisions on sharing customer data.
Data is shared only with sub-processors (third-party service providers) approved by the Data Controller, such as cloud storage providers or IT support services.
Requests from third parties (e.g., law enforcement) are referred to the Data Controller, unless legally prohibited.

7.3 Data Sharing Restrictions:

Conversant does not sell or rent personal information.

Any data transfers comply with applicable legal and contractual safeguards (e.g., Standard Contractual Clauses (SCCs) for EU data transfers, China PIPL regulatory approvals).

8. Data Storage and Localization

Conversant stores and processes personal data in secure global data centers. The location of data storage depends on Conversant’s role as a Data Controller or Data Processor and compliance with applicable data localization laws:

8.1 When Conversant is a Data Controller:

Data may be stored in global data centers unless required by law to store data locally. Where local storage is required, Conversant complies with applicable regulations, including:

China (PIPL): Certain personal and sensitive data must be stored in China unless authorized for cross-border transfer.
Indonesia (PDP Law): Government-regulated data must be stored within Indonesia.

8.2 When Conversant is a Data Processor:

Conversant follows the data storage requirements imposed by the Data Controller. If a customer (Data Controller) requires local storage, Conversant ensures compliance through:

8.3 Cross-Border Data Transfer Safeguards

Cross-border data transfer, if any, is conducted in accordance with our privacy policy stipulated in Section 9.

9. International Data Transfers

Conversant processes your information at the Company’s operating offices and in places where the parties involved in the processing are located. We may transfer your information to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

We will take all steps reasonably and necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. The applicable data transfer mechanisms depend on whether we act as a Data Controller or Data Processor.

9.1 When Conversant is a Data Controller:

As a data controller, Conversant determines the legal basis for data transfers and ensures compliance with applicable data protection laws, including:

EU & UK GDPR: Transfers are conducted under Standard Contractual Clauses (SCCs) or other legally approved transfer mechanisms.
China PIPL: Cross-border transfers are conducted in compliance with China’s Personal Information Protection Law (PIPL) requirements, including security assessments or contractual safeguards where necessary.
Indonesia PDP Law: Conversant adheres to Indonesia’s data localization requirements for applicable industries.
Malaysia & Thailand PDPA: Transfers occur under legally approved mechanisms such as Binding Corporate Rules (BCRs) or Data Transfer Agreements.
Singapore PDPA: Transfers comply with the Singapore Personal Data Protection Commission (PDPC) guidelines, including contractual safeguards.

9.2 When Conversant is a Data Processor:

As a data processor, Conversant does not independently transfer personal data across borders.

Data transfers occur only under the instructions of the Data Controller, who is responsible for ensuring compliance with applicable transfer rules.

Where a customer (Data Controller) requires cross-border transfers, Conversant follows contractually agreed mechanisms such as:
Standard Contractual Clauses (SCCs) for GDPR compliance.
China PIPL-compliant contractual clauses or other legally required safeguards.
Local data storage requirements if mandated by the Data Controller’s jurisdiction.

9.3 Additional Safeguards:

Conversant applies encryption and access controls for cross-border data transfers.
Conversant ensures sub-processors (third-party service providers) comply with contractual data transfer requirements.
Customers acting as Data Controllers remain responsible for obtaining any regulatory approvals for international transfers where required.

10. Data Security & Retention

Conversant employs industry-standard security and data retention practices based on its role as a Data Controller or Data Processor:

10.1 When Conversant is a Data Controller:

We implement encryption, access controls, and intrusion detection to protect personal data under our direct control.
Personal data is retained only as long as necessary to fulfill legal, regulatory, or contractual obligations.
When retention is no longer required, data is securely deleted or anonymized, unless a longer retention period is required by law.

10.2 When Conversant is a Data Processor:

We apply security and retention measures based on contractual agreements with the Data Controller.
Data is processed only as instructed by the Data Controller and is not retained beyond the agreed period.
Upon contract termination or upon instruction from the Data Controller, data is deleted or returned in accordance with the Data Processing Agreement (DPA).

10.3 Additional Security Safeguards:

Continuous security monitoring to detect and mitigate threats.
Access control policies to restrict unauthorized data access.
Data minimization principles to limit data retention where possible.

11. Your Privacy Rights & Choices

Under applicable data protection laws, individuals have certain rights regarding their personal data. The ability to exercise these rights depends on whether Conversant acts as a Data Controller or Data Processor:

11.1 When Conversant is a Data Controller:

Individuals may directly exercise the following rights with Conversant:

Access & Correct Data: Request a copy of your personal data and correct any inaccuracies.
Withdraw Consent: Revoke consent for processing where applicable (e.g., marketing communications).
Object to Processing: Restrict or object to certain uses of your data based on legitimate interests.
Data Portability: Request a structured, machine-readable format of your data.
Erasure (Right to be Forgotten): Request deletion of personal data, where legally permissible.
Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by contacting us at support@conversant.tv. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration, to respond to service requests, or for other non-marketing purposes.

11.2 When Conversant is a Data Processor:

As a data processor, Conversant processes personal data solely under the instructions of the Data Controller (our customers).

Data subject requests must be directed to the relevant Data Controller, who will determine how to respond.
If Conversant receives a request from an individual regarding data it processes on behalf of a customer, we will promptly forward the request to the Data Controller for further action.

11.3 How to Exercise Your Rights

How you may exercise your rights with Conversant depends on whether Conversant acts as a Data Controller or Data Processor with regards to the collection and processing of your personal information.

If Conversant is the Data Controller, you may submit your request via support@conversant.tv.
If Conversant is the Data Processor, please contact the organization that provides your data (e.g., our customer) to submit a request.

Requests will be processed in accordance with applicable laws:

EU/UK (GDPR): Within 30 days.
China (PIPL): Within 15 days.
Malaysia (PDPA): Within 21 days.
Indonesia (PDP Law): Within 30 days (following GDPR industry best practices due to lack of a strict legal mandate).
Thailand (PDPA): Within 30 days (or reasonable timeframe as per regulatory guidance).
Singapore (PDPA): Within 30 days (or as soon as reasonably possible per PDPC guidelines).

12. Cookies & Tracking

12.1 Cookie Policy

We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information in our websites. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Policy available at: https://www.swiftfederation.com/cookie-policy/.

12.2 Control over Do-not-track feature

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

13. Data Breach Notification

Conversant follows strict breach response protocols to mitigate risks and comply with applicable laws. Our notification responsibilities depend on our role as a Data Controller or Data Processor:

13.1 When Conversant is a Data Controller

As a data controller, we assess whether a breach is likely to result in a risk to data subjects. If required by law, we notify regulators according to the stipulated notification period of the applicable low:

EU GDPR: Within 72 hours of becoming aware of the breach.
China PIPL: Immediate notification to authorities and affected individuals.
Indonesia PDP Law: Immediate notification to authorities and impacted parties.
Malaysia PDPA: Notification required if the breach poses harm to data subjects.
Thailand PDPA: Notification within 72 hours if the breach is likely to cause harm.
Singapore PDPA: Notification within three calendar days if it results in significant harm.

In addition, we notify Affected Individuals If the breach is likely to cause serious harm (timing based on jurisdictional requirements).

We implement corrective measures and work with regulators if further action is required.

13.2 When Conversant is a Data Processor:

As a data processor, we do not notify regulators or individuals directly but instead:

Inform the Data Controller as soon as possible after becoming aware of a breach.
Provide all relevant details to assist the Data Controller in meeting its legal obligations.
Follow the Data Controller’s instructions on breach response, including regulatory disclosures.

13.3 Security Measures to Prevent Breaches

Conversant undertakes the following security measures to prevent against data breaches:

Continuous intrusion detection and threat monitoring.
Encryption and access controls to minimize breach risks.
Incident response plans to ensure rapid investigation and mitigation.

14. Policy Updates

We may update this Privacy Policy from time to time. The latest version will always be available at Privacy Policy Page.

15. Contact Information

For privacy-related inquiries, please contact: