Privacy Policy

1. Introduction

Merlion Arc Pte. Ltd. ("Merlion Arc", "we", "us", "our") is committed to handling personal data responsibly and in accordance with Singapore's Personal Data Protection Act 2012 (PDPA) and any amendments thereof. This Privacy Policy explains how we collect, use, disclose, and protect personal data in the course of providing our services and operating our website.

By using our website or engaging our services, you acknowledge that you have read and understood this policy. If you have questions, please contact us at [email protected].

2. Data We Collect

Information You Provide

• Name, email address, and telephone number submitted via our contact form
• Professional context and enquiry details shared through communications with our team
• Information shared during the course of a consulting engagement (where applicable)

Information Collected Automatically

• Browser type, device type, and operating system
• Pages visited, time spent on pages, and referring URLs
• IP address (anonymised where technically possible)
• Cookie data where consent has been granted (see Section 7)

3. Legal Basis for Processing

Under Singapore's PDPA, we process personal data on the following bases:

• Consent: where you have explicitly agreed to our use of your data (e.g. submitting the contact form, accepting optional cookies)
• Contractual necessity: where processing is required to deliver services you have engaged us for
• Legitimate interests: for activities such as website analytics and improving our service quality, where these interests do not override your rights

4. How We Use Your Data

• Responding to enquiries and managing our client relationship with you
• Delivering the services you have engaged us for, including assessments, training, and operations consulting
• Sending relevant communications about our services where you have consented
• Improving our website and service quality through anonymised analytics
• Complying with legal and regulatory obligations

We do not sell personal data to third parties. We do not use personal data for automated decision-making that produces legal or similarly significant effects.

5. Data Sharing

We share personal data only in limited circumstances:

• Service providers: third-party tools used to operate our website or services (e.g. analytics providers, email services) under data processing agreements
• Legal obligations: where required by law, court order, or regulatory authority in Singapore
• Business transfers: in the event of a merger or acquisition, subject to continued protection of your data rights

Any third-party processors are required to handle personal data in a manner consistent with this policy and applicable law.

6. Data Retention

• Contact enquiry data: retained for up to 24 months from last interaction
• Engagement-related data: retained for up to 5 years after engagement completion, as required for professional records
• Analytics data: retained in anonymised form for up to 26 months
• Cookie-related data: as described in Section 7 and our Cookie Policy

Upon expiry of retention periods, data is securely deleted or anonymised.

7. Cookies

Our website uses cookies to function correctly and to understand how it is being used. We use essential cookies (required for site operation) and optional analytics and preference cookies (used only with your consent). For full details, please see our Cookie Policy. You can manage your cookie preferences at any time from the Cookie Policy page.

8. Data Protection Measures

• HTTPS encryption for all data transmitted through our website
• Access to personal data restricted to authorised personnel only
• Mutual non-disclosure agreements in place for all client engagements
• Regular review of data handling practices
• Incident response procedures in place; breach notification to the Personal Data Protection Commission (PDPC) and affected individuals as required under the PDPA

9. Your Rights Under the PDPA

As a data subject under Singapore's PDPA, you have the right to:

• Access personal data we hold about you
• Correct inaccurate or incomplete personal data
• Withdraw consent for data use (where consent is the basis for processing)
• Request the cessation of processing for direct marketing purposes
• Lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their privacy policies independently.

11. Children's Privacy

Our services are directed to organisations and professional individuals. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have collected data from a minor, we will delete it promptly.

12. International Data Transfers

Personal data is primarily stored and processed in Singapore. Where data is processed by third-party service providers outside Singapore, we require that equivalent levels of data protection are maintained, in accordance with the PDPA's transfer limitation obligations.

13. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via our website. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of our website or services after changes constitutes acceptance of the revised policy.

14. Contact Information

For privacy-related enquiries or to exercise your rights:

• Email: [email protected]
• Address: Merlion Arc Pte. Ltd., 80 Robinson Road, #17-02, Singapore 068898