Privacy Policy

1. Who we are

Organisation

Arkflow Solutions Pte. Ltd.

UEN

202638999Z

Registered address

60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051

Data Protection Officer (by role)

arkflowsg@gmail.com

Telephone

+65 8765 5809

ArkFlow has designated a Data Protection Officer under section 11(3) of the PDPA. The role, rather than a named individual, is the point of contact; the current holder can be confirmed on request. Please direct any data protection question, request or complaint to the address above so that it is received and actioned reliably.

2. Scope

This Policy applies to personal data ArkFlow handles as an organisation in its own right: enquiries submitted through our website, communications with prospective and existing clients, records of the individuals we deal with at client organisations, supplier and contractor contacts, and job applicants.

Where ArkFlow processes personal data on a client's behalf while delivering the services — for example, a clinic's patient enquiry records held in a system ArkFlow configures — ArkFlow acts as a data intermediary. That processing is governed by the client's own privacy notice and by the Data Protection & Confidentiality Agreement, not by this Policy. Individuals with questions about that data should contact the relevant business directly.

3. What we collect

Through the enquiry form on this website we collect your name, business name, business type, indicative monthly enquiry volume, what you would like help with, your email address, and optionally your phone number, preferred contact channel and any message you write.

We also hold contact details, enquiry content, client relationship records, billing information, technical information (IP address, browser type, pages viewed, referring source, and campaign parameters in a link you followed) and recruitment information, depending on how you deal with us.

Booking a call opens a scheduling widget provided by our CRM provider. Information you enter there is submitted to that provider directly.

We do not ask for, and you should not send us, identity document copies, payment card numbers, passwords, health information, or personal data about third parties, through a website form or general email.

4. Why we use it

• To respond to your enquiry and to contact you about it.
• To prepare proposals, quotations and order forms.
• To provide, support, administer and improve our services.
• To manage the contractual relationship, including invoicing, payment and record-keeping.
• To send service and account communications relating to an existing engagement.
• To send marketing about our services where you have consented or where we are otherwise permitted to do so.
• To operate, secure and improve our website.
• To meet legal, regulatory, accounting and tax obligations.
• To establish, exercise or defend legal claims.
• To assess job applications.

5. Consent and your choices

We rely on your consent, or on an exception permitted under the PDPA, to collect, use and disclose your personal data for the purposes above. Where you provide your contact details to make an enquiry, we take that as consent to contact you about it.

You may withdraw consent at any time by writing to arkflowsg@gmail.com. We will act on your request within a reasonable period and tell you the likely consequences — for example, we may no longer be able to provide a service or respond to your enquiry.

Withdrawing consent does not affect processing carried out before withdrawal, or processing we are legally required or permitted to continue.

6. Marketing and the Do Not Call Registry

Before sending marketing messages to Singapore telephone numbers, we check the Do Not Call Registry unless a valid exemption applies or you have given us clear and unambiguous consent in evidential form.

Marketing emails and messages include a way to unsubscribe. We act on unsubscribe requests within the period required by law. You can opt out of marketing at any time without affecting any service we already provide to you.

7. Who we share it with

We share personal data only where necessary, and only with service providers who support our operations — including cloud hosting, CRM, email, messaging, accounting, payment and analytics providers — under obligations of confidentiality and data protection; professional advisers such as lawyers, accountants and insurers; regulators, law enforcement or other authorities where we are legally required to disclose; and a purchaser or successor in the event of a merger, acquisition or restructuring, subject to appropriate protections.

We do not sell or rent personal data, and we do not disclose it to third parties for their own unrelated marketing.

The providers currently used by this website are:

• GoHighLevel (HighLevel) — our CRM and scheduling platform. Enquiries submitted through the contact form are sent to it, and the booking widget is provided by it.
• Google Analytics — website analytics. We do not send your name, email address, phone number or message content to it; our analytics code removes those fields before any event is sent.
• Vercel — our website hosting provider, which necessarily processes the technical information described in clause 3 in order to serve the site.

These providers operate their own infrastructure, terms and security arrangements. We do not own or control that infrastructure.

8. Transfers outside Singapore

Some of our service providers operate outside Singapore. Where personal data is transferred overseas, we take the steps required by the PDPA's Transfer Limitation Obligation to ensure it receives a standard of protection comparable to that required in Singapore, through contractual protections or another legally recognised mechanism.

9. Protection

We apply administrative, technical and physical measures appropriate to the risk, including access controls, named accounts, multi-factor authentication on privileged accounts, least-privilege permissions, encryption in transit where supported, secure credential handling, and confidentiality obligations on our personnel.

No system connected to the internet can be guaranteed completely secure. If a data breach occurs that is likely to result in significant harm or is of significant scale, we will assess it and notify the Personal Data Protection Commission and affected individuals as required under the PDPA.

10. How long we keep it

We keep personal data only for as long as it serves the purpose it was collected for, or for as long as we are legally or contractually required to keep it. Indicative periods:

Enquiries that do not become engagements

Up to 12 months from last contact

Client relationship records

Duration of the engagement plus 6 years

Accounting and tax records

At least 5 years, as required under Singapore law

Marketing consent and opt-out records

For as long as we conduct marketing, plus a reasonable period afterwards

Unsuccessful job applications

Up to 12 months, unless you ask us to keep them longer

Website analytics

Up to 26 months

When personal data is no longer needed, we delete or anonymise it, subject to backup cycles and records we are required to retain. Where data sits in a third-party provider's system, that provider's own retention behaviour applies and we cannot shorten it beyond what the provider supports.

11. Your rights

Under the PDPA you may ask us for access to the personal data we hold about you and information about how it has been used or disclosed in the past year, and you may ask us to correct it if it is inaccurate or incomplete.

Send requests to arkflowsg@gmail.com. We may ask you to verify your identity. We will respond as soon as reasonably possible and in any event within the timeframe required by the PDPA, and will tell you if we cannot meet it. A reasonable fee may apply to an access request, and we will tell you the amount before proceeding. There is no fee for a correction request.

Certain exceptions apply under the PDPA — for example, where disclosure would reveal another individual's personal data or is subject to legal privilege.

12. Website and cookies

Our website uses cookies and similar technologies to make the site work, remember preferences and understand how the site is used. You can control cookies through your browser settings. Blocking some cookies may affect how parts of the site function.

Our Cookie Policy explains what is set, by whom and why.

Our website may link to third-party sites. We are not responsible for their privacy practices, and you should read their policies.

13. Children

Our services are for businesses. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Complaints

If you have a concern about how we handle personal data, contact us first at arkflowsg@gmail.com so we can try to resolve it. If you remain dissatisfied, you may lodge a complaint with the Personal Data Protection Commission of Singapore.

15. Changes

We may update this Policy. The version published on our website applies from the date shown on it. Where a change is significant, we will take reasonable steps to bring it to your attention.