Privacy Policy

1. Introduction

Pulau Legal is committed to handling personal data responsibly and in accordance with the Personal Data Protection Act 2012 (PDPA) of Singapore. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have in relation to your data.

If you have questions about this policy or our data practices, you may contact us at [email protected] or by post to 12 Marina Boulevard, #38-04, Marina Bay Financial Centre Tower 3, Singapore 018982.

2. Personal Data We Collect

We collect personal data in the following ways:

Information You Provide Directly

• Full name and contact details (email address, telephone number)
• Business name, role, and industry sector
• Nature of your enquiry and any details you include in your message
• Correspondence and communications you send to us

Information Collected Automatically

• Browser type, operating system, and device type
• Pages visited on this website and time spent on each
• Referring website or search query
• IP address and approximate geographic location
• Cookie identifiers (see our Cookie Policy for details)

Information From Third Parties

We may receive limited personal data from third-party services such as analytics providers or referral partners, where you have consented to such sharing with those parties.

3. Legal Basis for Processing

Under the PDPA, we process personal data on the following bases:

• Consent: Where you have given explicit consent, such as by submitting an enquiry form or accepting cookies.
• Contractual necessity: Where processing is necessary to fulfil or prepare for a legal services engagement.
• Legitimate interests: Where we have a legitimate business interest that does not override your rights, such as improving our services, managing security, or responding to professional enquiries.
• Legal obligation: Where we are required to process data to comply with applicable law, court orders, or regulatory requirements.

4. How We Use Your Personal Data

Personal data collected through this website is used for the following purposes:

• Responding to enquiries and assessing whether we can assist with your matter
• Communicating with you regarding your engagement with Pulau Legal
• Performing conflict-of-interest checks as required by professional conduct rules
• Complying with anti-money laundering obligations and Know Your Client (KYC) requirements
• Sending relevant information about our services where you have expressed interest
• Maintaining records for legal, regulatory, and audit purposes
• Improving the functionality and content of this website

We do not use personal data for automated decision-making or profiling in any way that produces legal or similarly significant effects.

5. Sharing Personal Data

We do not sell personal data. We share personal data only in the following limited circumstances:

• Service providers: Trusted third parties who assist with website hosting, analytics, and IT security, under contractual data protection obligations.
• Professional advisors: Co-counsel, accountants, or other professionals where necessary to progress your matter and with your knowledge.
• Regulatory and legal requirements: Where required by Singapore law, court order, or regulatory authority.
• Business transfer: In the event of a merger, acquisition, or restructuring of our practice, subject to equivalent data protection obligations on the recipient.

Any third party receiving personal data from us is required to process it in accordance with applicable data protection law.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law or professional conduct obligations.

• Enquiry data (non-client): Retained for up to 12 months from the date of initial contact, unless an engagement commences.
• Client engagement records: Retained for a minimum of seven years from the conclusion of the matter, in line with professional conduct requirements in Singapore.
• Website analytics data: Retained for up to 26 months in aggregated or anonymised form.

When retention periods expire, personal data is securely deleted or permanently anonymised.

7. Data Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. These include:

• TLS encryption for data transmitted to and from this website
• Access controls limiting data access to personnel with a need to know
• Secure document management systems for client files
• Regular security assessments of our IT infrastructure
• Staff training on data protection and information security obligations

While we take appropriate precautions, no transmission over the internet is entirely secure. In the event of a data breach that may affect your rights or interests, we will notify you and the Personal Data Protection Commission (PDPC) as required by the PDPA.

8. Cookies

This website uses cookies to support its basic functions and to understand how visitors use the site. Cookies are small text files placed on your device by your browser when you visit a website.

We use the following categories of cookies:

• Essential cookies: Necessary for the website to function correctly. These cannot be disabled.
• Analytics cookies: Used to understand visitor behaviour in aggregate form, to improve the website's content and structure.
• Preference cookies: Used to remember settings you have selected during your visit.
• Marketing cookies: Used by third-party advertising services, where you have consented.

You can manage your cookie preferences through our Cookie Policy page at any time.

9. Your Rights

Under the PDPA, you have the following rights in relation to your personal data:

• Right of access: You may request information about the personal data we hold about you.
• Right of correction: You may request that inaccurate or incomplete personal data be corrected.
• Right to withdraw consent: Where we process data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to object: You may object to processing for direct marketing purposes at any time.
• Right to data portability: Where applicable under law, you may request a copy of your data in a structured, machine-readable format.

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond within the timeframes required under the PDPA.

If you believe your data protection rights have not been observed, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

10. Children's Privacy

Our services are directed at businesses and individuals aged 18 and above. We do not knowingly collect personal data from persons under the age of 18. If we become aware that we have done so, we will delete the relevant data promptly.

11. Third-Party Websites

This website may contain links to third-party websites or resources. We are not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policy of any website you visit.

12. International Data Transfers

Where personal data is transferred outside Singapore — for example, to cloud service providers with servers in other jurisdictions — we take steps to ensure that the recipient provides a standard of protection comparable to the PDPA. This may include contractual data protection clauses or assessments of the applicable legal framework in the destination country.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or regulatory guidance. Material changes will be communicated by updating the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of our website or services following any update constitutes your acknowledgement of the revised policy.

14. Contact Us

For any questions, requests, or concerns related to this Privacy Policy or your personal data, please contact: