PDPA notice

Consent

We collect, use, and disclose personal data based on your consent, or where permitted under the PDPA. Where we rely on consent, we explain why we're collecting the data — for example, on our contact form, the data you share enables us to respond and prepare for a consultation.

Purpose limitation

We only collect, use, and disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances, and which we have notified you of or which are otherwise permitted under the PDPA.

Notification

This notice and our Privacy Policy together explain our data practices. Where we collect data for a new purpose not covered here, we will notify and obtain consent before doing so.

Access and correction

On written request, we will provide you with the personal data we hold about you and how it has been used or disclosed in the preceding year, subject to PDPA exceptions. You may request correction of inaccurate or incomplete data at any time. We will respond to access and correction requests within the timelines set by the PDPA — generally 30 days for access requests.

Accuracy

We take reasonable steps to ensure personal data we hold is accurate and complete, particularly where the data is likely to be used to make a decision affecting you or to be disclosed to another organisation.

Protection

We protect personal data with reasonable security arrangements — encryption in transit, role-based access control, two-factor authentication on systems holding client data, and reliance on platform providers (notably Xero, Aspire, Vercel) with established security postures. See our security page for more detail.

Retention

We retain personal data only as long as it's necessary for the purposes for which it was collected or as required by law. Accounting records are retained for at least 5 years from the relevant Year of Assessment in accordance with the Income Tax Act and Companies Act. After the retention period, data is securely deleted or anonymised.

Transfer limitation

Where personal data is transferred outside Singapore — for example to cloud platforms hosting data in other regions — we ensure the receiving party is bound by legally enforceable obligations to provide a comparable standard of protection, as required under the PDPA.

Openness and accountability

We have appointed a Data Protection Officer responsible for ensuring compliance with the PDPA. The DPO's contact details are below.

Do Not Call (DNC)

We do not conduct cold outreach by phone, SMS, or fax. We only contact prospects who have voluntarily provided their contact details through our website or otherwise initiated contact with us.