1. Introduction
Welcome to Objection Pte. Ltd. trading as The Primary ("we", "us", "our"). We are committed to protecting your privacy and handling your personal data in an open and transparent manner.
This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit theprimary.com and its associated services, use our platform, submit a contribution, or appear in a professional profile or referral record maintained by us (collectively, the "Services").
We handle personal data in accordance with applicable law, including the EU General Data Protection Regulation (GDPR), UK GDPR and applicable UK data-protection legislation, Singapore's Personal Data Protection Act (PDPA), and applicable US state privacy laws, including the California Consumer Privacy Act as amended (CCPA).
The rights and requirements that apply depend on your location, our activities, and the scope of the relevant law.
This policy is a notice about our processing practices. Using our Services or reading this policy does not by itself provide consent where a separate consent is required.
2. Who We Are
The controller responsible for the processing described in this policy is Objection Pte. Ltd., Company Number 202551418M, trading as The Primary, a company registered in Singapore.
Our registered address is:
68 Circular Rd, Unit 02-01, Singapore 049422
If responsibility for particular processing transfers to an affiliate or group entity, we will identify the relevant controller and provide any notice required by applicable law.
3. Our Data Protection Contact
For questions about this Privacy Policy, our handling of personal data, or exercising your rights, contact:
Data Protection Officer / Privacy Contact
Email: data@theprimary.com
4. What Personal Data We Collect
Depending on how you interact with the Services, we may collect:
- Identity Data: your name, Primary ID, and information used to establish or verify your identity.
- Contact Data: your email address, physical address, and other contact information you provide or that we lawfully obtain.
- Professional Data: your CV, credentials, affiliations, employment history, publications, and other professional information.
- Financial Data: payment details needed to process a transaction where applicable.
- Content Data: objections, evidence, interviews, recordings, transcripts, statements, claims, contributions, and associated metadata.
- Permission Data: records of acceptance, publication and licensing choices, AI-training opt-ins, attribution preferences, restrictions, and withdrawals.
- Technical Data: IP address, browser type, device information, and other technical information about your use of the Services.
- Usage Data: information about how you use our website and Services.
- Public-Source and Referral Data: professional profile information from public sources and information supplied by a person referring or naming you.
Some content may reveal sensitive information or special-category personal data, including political opinions. Where we process such information, we require any additional condition or consent required by applicable law. Public availability alone does not remove these protections.
5. How We Collect Your Data
We collect data in the following ways:
- Directly from you: when you create an account, submit a contribution, participate in an interview, file an objection, submit evidence, select permissions, or communicate with us.
- Automatically: when you use our website, through technical logs, cookies, and similar technologies, subject to applicable consent requirements.
- From public sources: including professional websites, publications, institutional pages, and other publicly accessible sources.
- From third parties: including media outlets, contributors, people making named referrals, and service providers where permitted.
People who have not registered
We may create an initial professional profile from public-source information or receive a named referral even if you have not registered with us. Such a record does not mean that you are a user, endorse The Primary, have verified the profile, or have accepted contributor terms.
For this processing, we rely on legitimate interests where applicable and supported by the required assessment: identifying relevant expertise, maintaining accurate professional records, and contacting people about relevant opportunities. Where another law applies, we require an applicable lawful basis or exception under that law.
We provide the information and notice required for indirectly collected data within the applicable time limits. Where the law permits an exception, we must establish that it applies and use the safeguards it requires; the size of a dataset alone is not sufficient.
You may contact data@theprimary.com to ask about the source of a record, object to processing, request a correction, request deletion where applicable, or claim a profile. We may verify your identity before changing ownership or disclosing information. Claiming a profile does not automatically grant a licence to sell your contributions or consent to AI training.
6. Legal Basis for Processing Your Data
Where GDPR or UK GDPR applies, we identify a lawful basis for each processing purpose:
- Contract: processing necessary to provide services you request or take steps at your request before entering into a contract.
- Legitimate Interests: processing necessary for interests such as operating and securing the Services, maintaining accurate professional records, identifying relevant expertise, and permitted editorial or commercial activities, where those interests are not overridden by your rights.
- Consent: processing for which we request your consent, including the separate AI-training opt-in and other activities that require consent under applicable law.
- Legal Obligation: processing necessary to comply with applicable legal requirements.
We do not treat general public interest in journalism or accountability as automatically establishing the GDPR public-task lawful basis.
For Singapore and other jurisdictions, we obtain consent where required or establish an applicable legal basis or statutory exception. Where special-category data is involved, we also require the additional legal condition applicable to that data.
Accepting a content licence is not blanket consent to all personal-data processing. In particular, a licence permitting sale or onward licensing does not by itself establish that every associated disclosure of personal data is necessary to perform a contract.
For permitted sale or licensing involving personal data, we rely on a documented legitimate-interests assessment where that basis is lawful and appropriate, or obtain consent where required. We do not proceed with a use for which the necessary basis, notice, or permission is absent.
7. How We Use Your Data
We use personal data, within the applicable permissions and lawful bases, to:
- Provide and maintain our Services.
- Manage accounts, Primary IDs, professional profiles, and objections.
- Receive, verify, organize, and respond to contributions.
- Record and enforce publication, licensing, attribution, anonymity, and training choices.
- Process payments where applicable.
- Communicate with you and provide customer support.
- Conduct investigations and make judgments on objections.
- Prepare and publish journalism and other permitted content.
- Prepare, license, or sell permitted contributions and derived knowledge products or datasets.
- Support permitted research, analysis, and AI evaluation.
- Support AI training only where a separate, explicit opt-in applies.
- Improve and secure our website and Services.
- Comply with legal and regulatory obligations.
We do not treat a general service-improvement purpose as permission to train AI models on contributions without the required training opt-in.
8. Who We Share Your Data With
We may disclose personal data to the following categories of recipient where necessary, permitted, and supported by the applicable lawful basis:
- Employees, editors, investigators, and authorised contractors: to provide and operate the Services.
- Service providers: for hosting, databases, authentication, analytics, communications, support, and AI-assisted processing.
- Publishers, research organizations, commercial data customers, AI laboratories, and data brokers: for permitted publication, licensing, sale, research, analysis, evaluation, or separately authorised AI training.
- The public: where information is approved or otherwise lawfully made public as part of our journalism, contributions, profiles, objections, or judgments.
- Affiliates and group entities: where needed to operate the Services or transfer a business function, subject to the same applicable restrictions and legal requirements.
- Legal and regulatory authorities: where required by law or necessary to protect legal rights.
Service providers and processors
Our service-provider arrangements may include:
- Clerk: authentication and account management.
- PostHog: product analytics.
- Google Analytics 4: website analytics.
- Intercom: customer communications and support.
- OpenRouter: access to AI model services; the model provider receiving a request may also process the submitted information.
- Google Cloud, Neon, and Replit: infrastructure, hosting, or database services.
- Customer.io: customer communications.
The role of a provider depends on the service and applicable contractual terms. A recipient is not necessarily our processor for every activity. Information sent through an AI gateway may also be processed by the selected downstream model provider.
Where we use LinkedIn, X, Full Story, or other providers for personal-data processing, those activities and recipient roles must also be reflected in our current disclosures. We use appropriate contractual and other safeguards required by applicable law.
Sale and onward licensing
We may sell or license permitted contribution content and derived datasets to the recipient categories described above. Some permitted content may contain personal data.
The contractual permission to sell or license contributions is established through the contributor terms and the contributor’s selected restrictions. Separate legal requirements apply to the processing and disclosure of personal data.
We do not sell identifying information associated with anonymous contributors. Publication, sale or licensing, and AI training are distinct permissions. A recipient’s purchase or licence does not grant permission to train AI models where the required training opt-in is absent.
Where a disclosure constitutes a “sale” or “sharing” under an applicable US state privacy law, we honour the applicable notice, opt-out, and other requirements. These legal terms can cover arrangements other than a direct exchange of data for money.
We do not use Customer Content to train general-purpose AI models without customer authorisation. Contributor content additionally requires the separate, explicit AI-training opt-in described in our Terms. Any use of data for service improvement remains subject to applicable permissions, contractual controls, and aggregation or anonymisation where appropriate, and does not give other customers access to private content.
9. International Data Transfers
Personal data may be transferred to and processed in countries outside Singapore, the United Kingdom, or the European Economic Area, including the United States, depending on the providers and recipients involved.
Where required, we use an applicable transfer mechanism, such as an adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another legally permitted mechanism. Transfers subject to Singapore law must meet the applicable transfer-limitation requirements.
We assess and apply any additional safeguards required for the transfer. You may contact data@theprimary.com for information about the safeguards relevant to your data.
10. Data Retention and Security
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, accounting, reporting, and dispute-resolution requirements.
Retention depends on the category of data, the purpose of processing, your permissions, whether a record forms part of a lawful public archive, and applicable law. Public availability or archival value does not automatically justify keeping every associated piece of personal data indefinitely.
We may retain limited permission and withdrawal records to demonstrate and enforce your choices. When personal data is no longer required, we delete or anonymise it, subject to applicable obligations and legitimate exceptions.
We use appropriate technical and organizational measures to protect personal data and restrict access to authorised persons. No system can guarantee absolute security.
For anonymous contributors, identifying information is separated from contribution content at ingest and is not sold. A Primary ID or other pseudonymous identifier may still be personal data if it can be linked to an individual. We do not describe data as anonymous merely because a name has been removed.
11. Your Data Protection Rights
Depending on applicable law, you may have rights including:
- Access: request information about processing and a copy of your personal data.
- Correction: request correction of inaccurate data or completion of incomplete information.
- Deletion: request erasure of personal data in applicable circumstances.
- Restriction: request that processing be restricted in applicable circumstances.
- Objection: object to processing, including processing based on legitimate interests where applicable.
- Portability: request a portable copy of eligible data or its transfer to another organization.
- Withdrawal of consent: withdraw consent at any time where processing relies on consent.
- Sale or sharing opt-out: opt out of sale, sharing, targeted advertising, or related processing where applicable law provides that right.
- Other local rights: exercise applicable rights concerning sensitive data, automated decisions, authorised agents, or appeals.
Withdrawal of consent applies prospectively and does not affect processing lawfully carried out before withdrawal. We also comply with any applicable requirements affecting retained data and downstream recipients.
For California residents and others with applicable US state rights, you may submit a sale or sharing opt-out request to data@theprimary.com. We honour legally required opt-out preference signals, including Global Privacy Control where applicable, and provide any additional request mechanism required by law. We do not unlawfully discriminate against you for exercising your rights.
You do not ordinarily have to pay to exercise your rights. We may request information reasonably necessary to verify your identity or authority, but will not seek excessive information for that purpose.
We respond within the time required by applicable law. Under GDPR and UK GDPR, this is generally one month, subject to permitted extensions.
To exercise your rights, contact data@theprimary.com. You may also contact us to claim, correct, or object to a public-source profile or named referral record.
12. How to Complain
If you have concerns about our use of personal data, please contact data@theprimary.com.
You may also complain to the relevant authority, including:
- The Personal Data Protection Commission in Singapore.
- Your competent supervisory authority in the European Economic Area.
- The Information Commissioner’s Office in the United Kingdom.
- The relevant state regulator or attorney general in the United States, where applicable.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the “Last updated” date.
Where required, we will provide additional notice or obtain fresh consent before introducing a new use of personal data. Updating this policy does not itself expand contribution permissions or provide consent to AI training.