PERSONAL DATA PROTECTION & PRIVACY POLICY

This Privacy Policy governs how Loh Eben Ong LLP (“we”, “us”, or “our”) collects, uses, maintains, and discloses information from clients and users of our websites and services. All visitors to our Site (as defined below) are subject to our terms and conditions of access.

A. SCOPE AND APPLICATION

(i) Covered Platforms

This Policy applies to:

(collectively referred to as the “Site”)

(ii) Territorial Restrictions

Our services are NOT available to persons in the United States of America (USA) or Canada. This Privacy Policy does not apply to residents or citizens of the USA or Canada, who are prohibited from using our services.

(iii) Legal Framework

This Policy complies with the Singapore Personal Data Protection Act (No. 26 of 2012) (“PDPA”) and its subsequent amendments. By using our Site or services, you consent to the practices described in this Policy.

(iv) Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee our data protection responsibilities and ensure compliance with the PDPA. You may contact our DPO using the contact details in Section N below.

B. PERSONAL DATA DEFINITION

“Personal Data” means any data about an individual who can be identified:

  • From that data alone; or
  • From that data combined with other information we have access to

This includes but is not limited to:

  • Name, NRIC, passport number, identification numbers
  • Contact details (telephone, address, email)
  • Date of birth, gender
  • Documents containing personal information
  • Payment information

C. DATA COLLECTION

(i) Methods of Collection

We collect Personal Data when you:

  • Visit our office
  • Register on our Site
  • Use our Online Legal Services
  • Subscribe to newsletters
  • Complete forms
  • Communicate with us

(ii) Types of Information Collected

Personal Data:

  • Identity information and documents
  • Contact details
  • Payment information
  • Documents required for legal services (birth certificates, marriage certificates, educational certificates)
  • Data received from Singapore Government digital services, including Singpass and Myinfo, where you choose to use them (see Annex A)

Non-Personal Data:

  • Browser type and version
  • Operating system
  • IP address
  • Connection information

(iii) Consent for Collection

We will obtain your consent before collecting Personal Data unless:

  • Collection is necessary for legal services you have engaged
  • Collection is required or authorised by law
  • It is impracticable to obtain consent and collection is in your vital interests

(iv) Notification

When collecting Personal Data, we will notify you of:

  • The purposes for collection
  • Whether provision is voluntary or mandatory
  • Consequences of not providing the data

(v) Cookies

Our Site uses cookies to enhance user experience. You may configure your browser to refuse cookies, though some Site features may not function properly.

D. USE OF PERSONAL DATA

We use your Personal Data for:

  • Service provision: To deliver legal services you have engaged us for
  • Customer service: To respond to inquiries and support requests
  • User experience: To understand and improve how users interact with our Site
  • Site improvement: To enhance our products and services based on feedback
  • Payment processing: To facilitate transactions for services ordered
  • Communications: To send updates, respond to queries, and provide information

We will only use your Personal Data for purposes:

  • For which we have obtained your consent
  • That are reasonably related to the original purpose of collection
  • As required or permitted by law

E. DATA PROTECTION

(i) Security Measures

We implement appropriate:

  • Data collection, storage, and processing practices
  • Security measures against unauthorised access, alteration, disclosure, or destruction
  • SSL encryption for sensitive data transmission (https://glutenfreepleasure.com/__proxy_domain/law.com.sg)
  • Regular security assessments and updates
  • Staff training on data protection

(ii) Data Breach Notification

In the event of a data breach that is likely to result in significant harm or impact, we will:

  • Notify the Personal Data Protection Commission within 72 hours
  • Notify affected individuals as soon as practicable
  • Take reasonable steps to contain and remediate the breach

(iii) Limitations

We do not warrant that data transmission is completely secure. Despite our efforts, risks remain from hacking, viruses, malware, human error, and unauthorised interception.

F. DATA SHARING AND DISCLOSURE

(i) Our Practices

We do not sell, trade, or rent Personal Data. We may share:

  • Information with relevant third parties necessary for service provision
  • Aggregated demographic information (not linked to personal identification) with business partners

(ii) Third-Party Service Providers

We use third-party providers for:

  • Web hosting
  • Government digital services, namely Singpass and Myinfo, operated by the Government Technology Agency of Singapore
  • Payment processing
  • Website security and anti-abuse services
  • Other operational services

While we select quality providers, we cannot control their information management practices.

(iii) Third-Party Consent

When providing information about others, you confirm you have obtained their consent for us to process their data.

G. DATA RETENTION AND DISPOSAL

(i) Retention Period

We retain Personal Data only for as long as necessary to:

  • Fulfil the purposes for which it was collected
  • Comply with legal and regulatory requirements
  • Support business and legal needs

Specific retention periods apply to particular services. Documents uploaded for signing through LEO Sign are deleted in accordance with Annex A.

(ii) Secure Disposal

When Personal Data is no longer needed, we will:

  • Securely destroy or anonymise the data
  • Ensure disposal methods prevent unauthorised access
  • Document disposal in accordance with our retention policy

H. CROSS-BORDER DATA TRANSFERS

If we transfer your Personal Data outside Singapore, we will ensure:

  • The recipient is bound by legally enforceable obligations
  • Protection standards are comparable to the PDPA
  • Appropriate contracts or safeguards are in place

I. DO NOT CALL REGISTRY

We comply with Singapore’s Do Not Call (DNC) Registry requirements. If we conduct telemarketing:

  • We check numbers against the DNC Registry
  • We respect your preferences for marketing communications
  • You may opt out of marketing messages at any time

J. INTERNET COMMUNICATIONS

By using our services, you acknowledge:

  • Internet communications are not secure
  • Emails may not reach intended recipients
  • Risk of device loss or theft containing client information
  • Our emails are not encrypted by default
  • Risk of viruses despite precautions
  • Potential for forged emails using our domain

We may monitor emails for authorised purposes under Singapore law.

K. THIRD-PARTY ELEMENTS

(i) External Links

Our Site may contain links to third-party websites. We are not responsible for their content, practices, or privacy policies.

(ii) Advertising

Third-party advertisers may use cookies to deliver targeted advertisements. This Policy does not cover third-party cookie use. For Google ads, refer to Google Advertising Policies.

L. YOUR RIGHTS AND RESPONSIBILITIES

(i) Access and Correction

Under the PDPA, you have the right to:

  • Request access to Personal Data we hold about you
  • Request correction of errors or omissions in your Personal Data
  • Request information about how your Personal Data has been used or disclosed within the past year

We will respond to your request within 30 days and may charge a reasonable fee for processing your request.

(ii) Consent Withdrawal

You may withdraw consent for certain uses of your Personal Data by contacting us. Please note:

  • Withdrawal may affect our ability to provide services to you
  • We may continue to process data where required by law
  • Withdrawal does not affect processing based on consent before withdrawal

(iii) Data Portability

Where applicable, you may request to receive your Personal Data in a commonly used format or have it transmitted to another organisation.

(iv) Your Responsibility

You must:

  • Provide accurate and complete information
  • Update us promptly of any changes to your Personal Data
  • Review this Policy periodically
  • Ensure you have authority to provide third-party Personal Data

M. POLICY UPDATES

We may update this Policy at any time. Changes will be reflected in the revision date below. Continued use of our Site after changes constitutes acceptance of the updated Policy.

N. CONTACT INFORMATION

For questions about this Privacy Policy or our data practices, contact:

Data Protection Officer
Loh Eben Ong LLP
135 Middle Road #05-11
Bylands Building
Singapore 188975
Tel: +65 6338 1810
Email: info@law.com.sg
Website: LAW.com.sg

O. GOVERNING LAW

This Privacy Policy is governed by Singapore law and subject to the exclusive jurisdiction of Singapore courts.

ANNEX A: LEO SIGN AND GOVERNMENT DIGITAL SERVICES

(i) About LEO Sign

LEO Sign is our document signing service at law.com.sg/sign. It uses Sign with Singpass, a service of the Government Technology Agency of Singapore, to apply a digital signature to a PDF document. A signing request may be sent by us to a client, or started by a person who uploads a document themselves.

(ii) What we collect

  1. From you, when a signing request is created: the document you or we upload, your name, email address and mobile number, and where the matter requires it, your NRIC or FIN so that the document can be restricted to you alone.
  2. From Singpass, when you sign: your name and identity as recorded in the digital certificate applied to the document, the date and time of signing, and the signed document itself.
  3. Technical information necessary to operate the service, including the status of each request and a record of events relating to it.

We never receive or have access to your Singpass password, your Singpass app, or your two-factor authentication. Signing takes place within the Singpass service, and we receive only the result.

(iii) Why we collect it

  1. To obtain your signature on a document, whether for a matter in which we act for you or at your request through our self-service page.
  2. Where a document is to be notarised or certified, to verify your identity before our Notary Public acts, as part of our professional due diligence.
  3. To notify you and other signatories of the progress and completion of a signing request.

(iv) NRIC and FIN

Where we collect your NRIC or FIN, we do so because it is necessary to establish your identity accurately for the legal or notarial service concerned, or because it is required or authorised by law. Where a signing request is restricted to a specific NRIC or FIN, that restriction is enforced by Singpass and not by us.

(v) Disclosure

The document you upload is transmitted to Sign with Singpass for the purpose of signing. We do not disclose it to any other party except as described in Section F of this Policy, or as required by law or by our professional obligations.

(vi) Retention

Documents uploaded to LEO Sign, and the signed copies produced, are deleted from the service 14 days after signing or after the request lapses, whichever is earlier. Where we act for you, the signed document is kept on your matter file and retained in accordance with Section G of this Policy and our professional obligations. Where you have used our self-service page and we do not act for you, you should download and keep your signed copy, because we will not hold it after the deletion period.

(vii) Myinfo

Where you choose to use Myinfo to complete one of our online forms, personal data is retrieved from Myinfo with your consent, and only the fields you have consented to release. It is used to complete the form concerned and is then handled in the same way as any other information you provide to us.

(viii) Your choices

Use of LEO Sign is voluntary. If you would prefer to sign on paper, or you do not wish to use Singpass, tell us and we will make other arrangements.

Last Updated: 28 July 2026 Previous Versions: 31 August 2025; 23 July 2025; 1 September 2022; 6 June 2020; 8 November 2017; 19 March 2015; 27 January 2015; 3 July 2014; 1 July 2014; 24 June 2014