Privacy Policy

This Privacy Policy explains how Loh Eben Ong LLP (“we”, “us” or “our”) collects, uses and discloses personal data in connection with our legal services and websites. It applies to LAW.com.sg, book.law.com.sg, help.law.com.sg and other websites or online services operated by us which expressly incorporate it, including our chatbots and LEO Sign.

We handle personal data in accordance with the Singapore Personal Data Protection Act 2012 (“PDPA”) and our applicable professional obligations. This policy does not override duties of confidentiality or legal professional privilege.

This policy applies to personal data we handle, including information received from people outside Singapore. Acceptance of a legal matter involving another jurisdiction is a separate question, addressed in our Terms and conditions.

Our Data Protection Officer oversees data protection enquiries and complaints. You can contact the DPO at info@law.com.sg. Full contact details appear in section J.

Personal data is information about an individual who can be identified from that information, or from it together with other information to which we have or are likely to have access. Depending on your enquiry or matter, it may include:

• Your name, identification particulars, contact details and date of birth.
• Documents, correspondence and information needed for the legal service, including information about other relevant people.
• Payment and transaction information.
• Information released through Singpass or Myinfo when you choose to use those services, as explained in Annex A.

We may receive information when you visit our office, contact us, submit a form or document, request an appointment, use our online services or subscribe to updates. We may also receive information from a person authorised to act for you or from sources permitted by law.

Please provide accurate information and tell us if it changes. If you supply another person’s data, ensure that you have their consent or another lawful basis to provide it for the stated purpose.

We collect NRIC or FIN numbers and copies of identity documents only where required by law or where necessary to establish or verify identity to a high degree of accuracy. The information requested depends on the service concerned.

Our websites may record technical information such as your IP address, browser, operating system and connection details. Such information may be personal data where it identifies you, alone or with other information.

We use personal data for purposes relevant to your dealings with us, including:

• Responding to enquiries, preparing quotations and arranging appointments.
• Assessing whether we can accept instructions, checking identity and meeting legal or regulatory requirements.
• Providing the agreed legal services and communicating about your matter.
• Processing payments and administering our records.
• Operating, securing and improving our websites and online services.
• Sending updates you have requested or other communications permitted by law.

We notify you of the purposes for collecting, using or disclosing personal data and obtain consent where required. Where the PDPA recognises deemed consent or permits processing without consent, we rely on that basis only where its conditions are met. Merely browsing a website is not blanket consent to unrelated uses of personal data.

If we need information to assess or carry out your instructions and you do not provide it, we may be unable to proceed. We will explain the relevant requirements.

Optional marketing preferences are separate from instructions for legal services. You may ask us to stop marketing communications at any time. Where the Do Not Call provisions apply, we check the relevant register unless valid consent or another applicable exception permits the communication.

We do not sell, trade or rent personal data. Where necessary for the stated purposes and permitted by law and our professional obligations, information may be disclosed to:

• People or organisations involved in your matter, in accordance with your instructions and the applicable legal requirements.
• Courts, public authorities or regulators where disclosure is required or authorised.
• Service providers supporting hosting, document processing, communications, appointment booking, payments, website security and other practice operations.
• Government digital services, including Singpass and Myinfo, where used.

Disclosure remains subject to applicable confidentiality and privilege requirements. The use of an external provider does not, by itself, remove our responsibilities for personal data.

Some service providers may process or store information outside Singapore. Where we transfer personal data overseas, we take steps required by the PDPA to ensure comparable protection, including appropriate contractual or other legally recognised safeguards, unless a lawful exemption applies.

We make reasonable security arrangements to protect personal data in our possession or control against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks. No internet transmission or storage system is entirely risk-free.

Please contact us before sending particularly sensitive information if you need an alternative transmission method. Check recipients and attachments carefully. If a message requesting payment or information appears unusual, verify it with our office using independently obtained contact details.

We assess suspected personal data breaches and take appropriate steps to contain and address them. Where a breach is notifiable to the Personal Data Protection Commission, we notify it as soon as practicable and no later than three calendar days after the day we determine that it is notifiable.

We notify affected individuals where required by the PDPA, as soon as practicable on or after notifying the Commission, subject to applicable exceptions. A breach may require notification to the Commission because of significant harm or significant scale; notification to individuals is subject to the separate statutory requirements.

Emails can be delayed, misdirected, intercepted or forged. Contact us if you are unsure whether we have received an important message. We may monitor communications for authorised operational, security or legal purposes. These practical risks do not exclude our duties under applicable law.

We retain personal data while it is needed for the purpose for which it was collected, or for legal or business purposes. Relevant considerations include our professional obligations, the nature of the matter and the need to maintain records of work and transactions.

When retention is no longer necessary, we cease retaining the data or remove the means by which it can be associated with particular individuals, using appropriate disposal or anonymisation measures.

LEO Sign has a separate service deletion period, set out in Annex A. Deletion from the signing service is distinct from retention of a document on a client’s matter file.

Our websites use cookies and similar technologies to support their operation and user experience. Browser controls may allow you to refuse or remove cookies, although this can affect some features.

External links, embedded content and third-party services may have their own privacy notices and may collect information when you use them. Please review those notices where relevant. This does not displace our obligations for personal data for which we are responsible.

Our websites include chatbots, including the Leona AI assistant. Please keep enquiries general and avoid entering passwords, identity document numbers, confidential case details or other sensitive information into the chatbot. Contact our office for a suitable way to provide documents or discuss a matter.

A chatbot exchange does not, by itself, confirm that we have accepted instructions. Any personal data handled through our online services remains subject to applicable law.

You may ask for access to personal data in our possession or control and information about how it has been used or disclosed in the preceding year. You may also ask us to correct an error or omission. These requests are subject to the PDPA’s requirements and exceptions, including those protecting other individuals and privileged information.

Please contact our DPO with enough information to identify you and the request. We may need to verify your identity before disclosing information.

We respond to access requests as soon as reasonably possible and deal with corrections as soon as practicable. If we cannot comply within 30 days after receiving a request made in accordance with the applicable requirements, we will inform you in writing within that period when we expect to respond.

We may charge a reasonable fee for an access request where permitted and will give you a written estimate in advance. We do not charge a fee for correcting personal data.

You may withdraw consent on reasonable notice by contacting our DPO. We will explain any likely consequences, including whether we can continue the relevant service. We will cease the collection, use or disclosure concerned unless it remains required or authorised under applicable law.

Withdrawal does not, by itself, require the deletion of records which we have a lawful basis to retain. It does not affect processing lawfully carried out before withdrawal.

Please contact our DPO if you have a concern about how we handle personal data. Include the relevant dates and circumstances so that we can investigate and respond. You may also contact the Personal Data Protection Commission.

We may update this Privacy Policy to reflect changes in our services, practices or applicable requirements. The version date appears below. Where a change requires further notice or consent, we will take the steps required by law. Continued browsing is not treated as consent to a new purpose where separate consent is required.

This policy is governed by Singapore law, subject to any mandatory law that applies. It does not restrict your statutory rights or your ability to raise a concern with a competent regulator.

Data Protection Officer
Loh Eben Ong LLP
135 Middle Road #05-11
Bylands Building
Singapore 188975

Email: info@law.com.sg
Telephone: +65 6338 1810

Please mark your enquiry “Data protection” and avoid sending unnecessary sensitive information in your initial message.

LEO Sign is our document signing service at law.com.sg/sign. It uses Sign with Singpass, a service of the Government Technology Agency of Singapore, to apply a digital signature to a PDF document. A signing request may be sent by us to a client, or started by a person who uploads a document themselves.

1. From you, when a signing request is created: the document you or we upload, your name, email address and mobile number, and where the matter requires it, your NRIC or FIN so that the document can be restricted to you alone.
2. From Singpass, when you sign: your name and identity as recorded in the digital certificate applied to the document, the date and time of signing, and the signed document itself.
3. Technical information necessary to operate the service, including the status of each request and a record of events relating to it.

We never receive or have access to your Singpass password, your Singpass app, or your two-factor authentication. Signing takes place within the Singpass service, and we receive only the result.

1. To obtain your signature on a document, whether for a matter in which we act for you or at your request through our self-service page.
2. Where a document is to be notarised or certified, to verify your identity before our Notary Public acts, as part of our professional due diligence.
3. To notify you and other signatories of the progress and completion of a signing request.

Where we collect your NRIC or FIN, we do so because it is necessary to establish your identity accurately for the legal or notarial service concerned, or because it is required or authorised by law. Where a signing request is restricted to a specific NRIC or FIN, that restriction is enforced by Singpass and not by us.

The document you upload is transmitted to Sign with Singpass for the purpose of signing. We do not disclose it to any other party except as described in section D of this policy, or as required by law or by our professional obligations.

Documents uploaded to LEO Sign, and the signed copies produced, are deleted from the service 14 days after signing or after the request lapses, whichever is earlier. Where we act for you, the signed document is kept on your matter file and retained in accordance with section F of this policy and our professional obligations. Where you have used our self-service page and we do not act for you, you should download and keep your signed copy, because we will not hold it after the deletion period.

Where you choose to use Myinfo to complete one of our online forms, personal data is retrieved from Myinfo with your consent, and only the fields you have consented to release. It is used to complete the form concerned and is then handled in the same way as any other information you provide to us.

Use of LEO Sign is voluntary. If you would prefer to sign on paper, or you do not wish to use Singpass, tell us and we will make other arrangements.