Personal Data Protection Act (PDPA) Privacy Policy

1. Introduction & Commitment

A.1 Business Pte Ltd (UEN: 200704403Z) is committed to protecting the privacy, confidentiality, and security of personal data entrusted to us by clients, directors, shareholders, and website users in accordance with the Personal Data Protection Act 2012 (PDPA) of Singapore.

This Privacy Policy sets out the principles and practices governing the collection, use, disclosure, retention, and care of personal data collected through our business consulting engagements, accounting services, company incorporation filings, and digital website channels.

2. Categories of Personal Data Collected

In the course of providing corporate secretarial, accounting, tax filing, and company formation services, we collect necessary personal data, including:

• Identity Data: Full legal names, alias, national identity card numbers (NRIC), passport numbers, nationality, date of birth, and residency status.
• Contact Data: Residential addresses, registered office addresses, personal and corporate email addresses, and telephone/mobile numbers.
• Statutory & Corporate Governance Data: Shareholding percentages, directorships, powers of attorney, board resolutions, and member registers required by the Accounting and Corporate Regulatory Authority (ACRA).
• Financial & Transactional Data: Corporate bank account numbers, used cheque stubs, bank statements, salary vouchers, and Central Provident Fund (CPF) contribution registers.
• Due Diligence (AML/CFT) Records: Proof of address, source of wealth declarations, and Politically Exposed Person (PEP) screening records mandated by ACRA and the Monetary Authority of Singapore (MAS).

3. Purposes of Collection, Use, and Disclosure

We process personal data strictly for legitimate business, statutory, and contractual purposes, including:

• Executing company incorporation, corporate secretarial appointments, and statutory lodgements via ACRA BizFile.
• Compiling general ledgers, financial statements, and corporate income tax returns (Form C-S / Form C) for submission to IRAS.
• Verifying customer identity under Singapore Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) requirements.
• Communicating statutory reminders, AGM notices, and annual return filing deadlines to corporate directors.
• Processing commercial bank wire transfers, PayNow transactions, and accounting service fees.

4. Disclosure of Personal Data to Third Parties

A.1 Business Pte Ltd will not sell, rent, or trade your personal data. We disclose personal data only where necessary and lawful to:

• Singapore Regulatory Bodies: ACRA, the Inland Revenue Authority of Singapore (IRAS), the Ministry of Manpower (MOM), and Singapore Customs as required by written law.
• Professional Banking Partners: Commercial banking institutions (such as OCBC, DBS, UOB) with your explicit authorization for corporate bank account opening.
• Cloud Software Providers: Secure, SOC2-compliant accounting systems (such as Xero) when contracted by you for cloud accounting maintenance.

5. Data Retention & Section 199 Mandate

Under Section 199 of the Singapore Companies Act (Cap. 50) and the Singapore Income Tax Act, business entities and registered filing agents are legally required to retain transaction records, books of accounts, and underlying vouchers for a minimum of five (5) years from the end of the relevant financial year.

Upon the expiration of the statutory retention period and fulfillment of all operational requirements, personal data will be safely disposed of or anonymized.

6. Security Measures

We employ robust administrative, operational, and technical safeguards to prevent unauthorized access, collection, disclosure, copying, modification, or leakage of personal data. These measures include encrypted local networks, role-based access controls, and strict physical document handling protocols at our International Plaza office.

7. Rights of Access, Correction & Withdrawal

Under the PDPA, individuals have the right to request access to their personal data in our possession and request corrections where data is inaccurate or incomplete. You may also withdraw consent for non-statutory data processing by providing written notice to our Data Protection Officer.

8. Contacting the Data Protection Officer (DPO)

If you have any questions, feedback, or requests regarding this Privacy Policy or our data protection practices, please contact our designated officer: