Privacy Policy

1. Data Controller

The data controller for personal data collected through this website and our advisory services is Kembang Legal, operating from 101 Thomson Road, #09-06, United Square, Singapore 307591. For data-related enquiries, contact us at [email protected].

2. What Personal Data We Collect

We collect personal data that you voluntarily provide to us, including:

• Full name and contact details (email address and telephone number)
• Business name and role or position
• Description of your franchise or licensing matter as provided in enquiries
• Technical data collected automatically when you visit our website (IP address, browser type, pages visited)
• Cookie preference data stored locally on your device

We do not collect sensitive personal data (such as financial account details or identification numbers) through our website.

3. How We Collect Personal Data

We collect your personal data through:

• Enquiry and contact forms submitted via our website
• Direct correspondence by email or telephone
• Automatic collection via website analytics tools when you visit our site
• Cookies and similar technologies (see our Cookie Policy for details)

4. Legal Basis for Processing

We process your personal data under the following grounds:

• Consent: Where you have given consent, such as when submitting an enquiry form or accepting cookies
• Legitimate interests: To respond to enquiries, maintain records, and improve our advisory services
• Contract: Where processing is necessary to carry out services you have engaged us to perform
• Legal obligation: Where we are required to retain records under applicable Singapore law

5. How We Use Your Personal Data

We use personal data collected for the following purposes:

• Responding to enquiries and communicating with you about your franchise or licensing matter
• Delivering the advisory services you have engaged us for
• Maintaining records of our advisory engagements as required by professional obligations
• Understanding how our website is used so that we can improve its content and structure
• Complying with applicable legal and regulatory requirements

We do not use your personal data for automated decision-making or profiling.

6. Data Sharing

We do not sell or rent your personal data to third parties. We may share your data in limited circumstances:

• With service providers who support the operation of our website (such as analytics and hosting providers), subject to confidentiality obligations
• Where required by law, regulation, or court order
• With professional advisers retained in connection with a specific engagement, where disclosure is necessary and authorised

Any third-party service providers with access to your data are required to handle it securely and only for the purposes we have specified.

7. Data Retention

We retain personal data for as long as is necessary for the purpose for which it was collected:

• Enquiries not resulting in an engagement: up to 12 months from the date of enquiry
• Active advisory engagements: for the duration of the engagement and a further period of 7 years for professional record-keeping purposes
• Website analytics data: up to 26 months in aggregated form

After the applicable retention period, personal data is securely deleted or anonymised.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted transmission of data via HTTPS
• Access controls limiting internal access to personal data
• Secure storage of client records with restricted access
• Regular review of our data handling procedures

In the event of a data breach that is likely to result in harm to affected individuals, we will notify the Personal Data Protection Commission (PDPC) and affected individuals in accordance with the PDPA's mandatory breach notification requirements.

9. Cookies

Our website uses cookies to support functionality and to analyse site usage. You can manage your cookie preferences at any time through our Cookie Policy page.

10. Your Rights Under the PDPA

As an individual whose personal data we hold, you have the following rights under Singapore's PDPA:

• Access: You may request a copy of the personal data we hold about you
• Correction: You may request correction of inaccurate personal data
• Withdrawal of consent: You may withdraw consent to processing at any time, where consent is the basis for processing
• Data portability: In certain circumstances, you may request that personal data be provided in a portable format

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receiving a valid request.

11. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites, and this policy does not apply to them. We encourage you to review the privacy policies of any third-party sites you visit.

12. Children's Privacy

Our services are directed at businesses and business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us so that we can take appropriate steps.

13. Supervisory Authority

If you have concerns about how we handle your personal data that we are unable to resolve, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore. Details are available at www.pdpc.gov.sg.

14. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in how we handle personal data or to comply with legal requirements. The current version and its effective date will always be displayed at the top of this page. Continued use of our website following any update constitutes acceptance of the revised policy.

15. Contact

For all privacy-related enquiries, please contact us at:

Kembang Legal
101 Thomson Road, #09-06, United Square, Singapore 307591
Email: [email protected]