Privacy policy

Overview

BrandVertex Pte. Ltd. ("BrandVertex", "we") respects your privacy and is committed to protecting personal data in accordance with the Personal Data Protection Act 2012 (PDPA) of Singapore. This policy describes what data we collect through brandvertex.one and our agency services, why we collect it, how long we keep it, and the choices available to you.

Organisation details (data controller)

BrandVertex Pte. Ltd.
UEN: 202834710M
Registered address: 290 Orchard Road, #12-03 Paragon, Singapore 238859
Data protection contact: [email protected]
General enquiries: [email protected] · +65 6725 3164

Categories of personal data collected

Contact details	Name, email, phone, company, job title, postal address
Project data	Brand briefs, identity preferences, budget ranges, feedback on deliverables
Technical data	IP address, browser, device type, pages viewed, referral source, cookie IDs
Consent records	PDPA form consent timestamps, cookie preference choices

Purposes of use

We process personal data solely for legitimate business purposes:

1. Responding to website enquiries and scheduling studio consultations at our Orchard Road atelier
2. Delivering brand strategy, identity design, messaging development and related marketing agency services under contract
3. Invoicing, payment processing, tax compliance and contractual record-keeping required under Singapore law
4. Website analytics to improve content, navigation and accessibility (with consent where required by our cookie banner)
5. Legal compliance, fraud prevention and protection of our legitimate business interests including dispute resolution
6. Service-related communications to existing clients regarding project milestones, deliverable reviews and studio sessions
7. Internal quality assurance, training and methodology improvement using anonymised project learnings where identifiable data is excluded

We do not use personal data for purposes incompatible with those described above without notifying you and, where required, obtaining fresh consent.

Consent and legal bases

We obtain explicit consent through the consent_pdpa checkbox on contact forms — this checkbox is never pre-ticked. Cookie preferences are collected via our banner (Accept all / Reject all / Customise) and stored for six months on your device. Where processing is necessary to perform a contract you have entered, consent may not be the sole basis. You may withdraw consent at any time by emailing [email protected]; withdrawal may affect our ability to continue providing services and does not affect lawfulness of prior processing.

For existing clients, additional consent for marketing communications may be recorded in service agreements. Non-essential marketing emails include unsubscribe mechanisms. Contractual processing continues under the legal basis of performance of a contract regardless of marketing opt-out.

Sharing and cross-border transfers

We do not sell personal data. Recipients may include cloud hosting providers, email services, analytics platforms, payment processors, project management tools and professional advisers — each bound by confidentiality obligations and data processing terms where applicable. Where data leaves Singapore, we implement contractual safeguards ensuring protection comparable to PDPA standards, including standard contractual clauses or verification of recipient certification schemes.

Third-party processors are selected based on security posture, reputation and relevance to the service provided. We review vendor practices periodically and require notification of material security incidents affecting our data.

Retention schedule

• Unconverted website enquiries: 24 months from last contact
• Active and completed client projects: engagement period plus 7 years (legal/accounting)
• Marketing consent logs: consent period plus 3 years
• Aggregated analytics: up to 26 months; raw server logs shorter where feasible

Data no longer required is securely deleted or irreversibly anonymised.

Individual rights under PDPA

You may request access to personal data we hold about you, correction of inaccuracies, or information about how your data has been used in the past year. Submit requests to [email protected] with sufficient identification detail. We respond within 30 days unless an extension applies under PDPA. A reasonable fee may apply for manifestly excessive requests.

Access requests should specify the data categories sought and preferred delivery format. Correction requests should identify the inaccurate field and provide the corrected information. We may request supporting documentation to verify identity before releasing or modifying records.

PDPC complaint route

If unresolved through us, you may contact the Personal Data Protection Commission:
10 Pasir Panjang Road, #03-01 Mapletree Business City, Singapore 117438 · www.pdpc.gov.sg · +65 6377 3131

Cookies

See our Cookie Policy for categories, vendors, durations and opt-out instructions.

Security

We use HTTPS encryption, role-based access controls, staff confidentiality training, secure password policies and vendor due diligence to protect personal data. Client project files are stored on access-restricted systems. No internet transmission is fully secure; we take reasonable steps commensurate with the sensitivity of data processed and review security measures following material changes to our technology stack.

Minors

Our services target business professionals. We do not knowingly collect data from persons under 18. Contact [email protected] if you believe we have done so.

Policy updates and change log

• 1 July 2026 (v1.0): Initial publication for brandvertex.one launch

Material changes will be noted on this page with an updated effective date.

Automated decision-making

BrandVertex does not use personal data for automated decision-making or profiling that produces legal or similarly significant effects on individuals. Analytics data is reviewed by humans for aggregate website improvement purposes only.

Data breach notification

In the event of a data breach likely to result in significant harm or affect a significant number of individuals, we will notify the Personal Data Protection Commission and affected individuals as required under the PDPA and related PDPC guidance. We maintain internal incident response procedures reviewed periodically by management.

Third-party links

Our website may contain links to external sites such as portfolio platforms or social media profiles. We are not responsible for the privacy practices of those sites. Review their privacy policies before submitting personal data.

Business transfers

If BrandVertex undergoes a merger, acquisition or sale of assets, personal data may transfer to the successor entity subject to comparable privacy protections. We will notify affected clients and website users where required by law.

Marketing opt-out

You may opt out of non-essential marketing emails at any time using the unsubscribe link or by contacting [email protected]. Opting out does not affect transactional communications related to active brand strategy or identity engagements under contract.

Accuracy of data

You are responsible for ensuring personal data you provide is accurate and current. Notify us promptly of changes to contact details so we can maintain effective communication during active projects and comply with PDPA correction obligations upon request.

Contact

[email protected] · BrandVertex Pte. Ltd., 290 Orchard Road, #12-03 Paragon, Singapore 238859 · +65 6725 3164

Data protection officer function

Although BrandVertex is not legally required to appoint a Data Protection Officer under the PDPA for our current scale of operations, we designate a privacy contact at [email protected] responsible for overseeing compliance, responding to access requests and liaising with the PDPC where necessary. This contact receives regular updates on changes to Singapore data protection guidance affecting marketing agency client data handling.

Processing of client brand materials

During brand strategy and identity engagements, clients may supply logos, customer lists, internal brand documents, photography and campaign performance data. We process such materials solely to deliver contracted services. Client-supplied personal data embedded in brand collateral (for example, team photographs or testimonial quotes) is handled according to instructions in the service agreement and deleted or returned upon project completion unless retention is required for legal purposes.

Employee and contractor access

Access to personal data is limited to BrandVertex staff and contracted specialists who require it for their role. All personnel with data access receive orientation on PDPA obligations and confidentiality requirements. Access credentials are revoked promptly when employment or contracts end. We maintain access logs for systems containing client enquiry and project data where technically feasible.

Direct marketing

BrandVertex may send service announcements, studio event invitations or programme updates to contacts who have provided consent or who are existing clients with an ongoing relationship. Each marketing email includes an unsubscribe mechanism. We do not purchase third-party mailing lists. Frequency is limited to content relevant to brand strategy and identity services for Singapore businesses.

Records of consent

We maintain records of PDPA form consent including timestamp, form version and the specific purpose stated at collection. Cookie consent choices are stored locally on your device for six months with a corresponding server-side log entry where our hosting configuration supports it. These records help demonstrate compliance during audits or in response to individual access requests about how consent was obtained.

International clients

Regional enterprises engaging BrandVertex from outside Singapore may transfer personal data to our Orchard studio for project delivery. By submitting an enquiry or entering a service agreement, you acknowledge transfer to Singapore for processing under this policy. We apply PDPA standards regardless of the data subject's country of residence unless a higher standard is contractually agreed.

Questions and complaints

For any privacy concern, contact [email protected] with sufficient detail for us to investigate. We aim to acknowledge enquiries within five business days and resolve straightforward requests within thirty days. Escalated or complex matters may require additional time with written notice. Unresolved complaints may be referred to the PDPC as described above.

Website analytics detail

Where analytics cookies are enabled, we may collect aggregated information about page views, session duration, scroll depth and referral sources. This data helps us understand which brand programme pages resonate with Singapore marketing teams and whether navigation structures serve user needs effectively. Analytics data is not used to build individual behavioural profiles for sale to third parties. IP addresses may be anonymised at collection depending on tool configuration.

Enquiry form data flow

When you submit our contact form, data is transmitted via HTTPS to our email handling system and may be stored in our client relationship records. Honeypot fields help filter automated spam submissions. Form data includes the subject line selected (brand programme enquiry, identity audit request, corporate brand project or general inquiry), your message content and PDPA consent confirmation. We do not use enquiry data for purposes unrelated to responding to your request unless you separately opt in to marketing communications.

Retention of anonymised data

After retention periods expire, personal data is deleted or irreversibly anonymised. Anonymised aggregate statistics derived from website analytics or project metrics may be retained indefinitely for internal business planning. Such statistics cannot reasonably be used to identify individuals.

Your responsibilities

When providing personal data about colleagues or third parties (for example, listing additional stakeholders on a marketing brief), you confirm you have authority to share that data and have informed those individuals about BrandVertex as a recipient. You are responsible for the accuracy of data you submit and for notifying us of changes that affect our ability to communicate with you during active brand strategy or identity engagements.