Personal Data Protection Act · Singapore

Privacy notice

This notice explains how Your Brand Works Pte. Ltd. collects, uses, discloses and cares for personal data in the course of running a Singapore marketing studio and publishing yourbrandworks.pro. The atelier writes in the third person because the duty sits with the organisation, not with a nameless “we” on a banner. The notice is meant to be read as a working document: medium-long sentences, specific purposes, and a clear path for access and correction. It is prepared with Singapore’s Personal Data Protection Act 2012 (the PDPA) in mind, including the consent, notification, purpose-limitation, accuracy, protection, retention-limitation and transfer-limitation obligations, and the rights of access and correction. Guidance published by the Personal Data Protection Commission (the PDPC) has been considered where it helps a small professional practice apply those rules without theatre.

Last updated 02 September 2026.

The organisation that holds this notice

The organisation is Your Brand Works Pte. Ltd., a Singapore company practising brand strategy, campaign architecture, creative direction and channel planning from 61 Amoy Street, #04-02, Singapore 069878. The public telephone is +65 6224 5138. Ordinary studio correspondence, including first enquiries about a brand programme, goes to hello@yourbrandworks.pro. Questions that concern personal data, this notice, or a request to see or correct a record should be sent to privacy@yourbrandworks.pro. The room keeps Monday to Friday, 09:00–18:00 SGT. The same entity is the publisher of this website, as described in the legal notice.

When this notice says “the atelier” or “the organisation”, it means Your Brand Works Pte. Ltd. acting as the organisation that determines the purposes for which personal data is collected and used in connection with the studio and the site. Processors who only host mail or pages act on the atelier’s instructions and are named in outline below; they are not a second public face for privacy requests. A person who wishes to write about their data should use privacy@yourbrandworks.pro so that the request is not lost among briefing notes.

Scope of this notice

The notice covers personal data that the atelier collects through yourbrandworks.pro, including the contact form on contact.php; data sent by email to hello@yourbrandworks.pro or privacy@yourbrandworks.pro; data left in a telephone call to +65 6224 5138; data exchanged when a visitor comes to Amoy Street by appointment; and data that arises once a professional engagement is discussed or begun. It also covers the thin technical records created when the site is served from Singapore-region infrastructure, and the optional Google Maps embed described later in a short paragraph.

The notice does not try to govern websites the atelier does not publish. It does not apply to personal data that a client organisation holds about its own customers, employees or prospects, except to the limited extent that such data is shared with the studio as part of a brief and is then handled under this notice and the engagement papers. The atelier does not operate a consumer shopfront and does not seek personal data from children for marketing lists. If a message appears to come from a person under sixteen about a school project or a similar enquiry, the studio replies briefly if at all and does not add the details to an engagement file.

Personal data the atelier may collect

The categories are modest and tied to the work. From a first enquiry the organisation typically receives a name, an email address, the text of a message, and any organisation name the sender chooses to include. The contact form also records that the sender ticked a consent box referring to this notice. A telephone call may add a number and a spoken summary, which the desk writes down only as far as needed to reply. If a meeting is arranged, the file may hold appointment times and the names of people expected at the table.

Once a conversation becomes a prospective or live engagement, the atelier may also hold job titles, office addresses, billing contacts, signatures on a proposal, and the contents of working documents that happen to name individuals — for example a stakeholder list the client supplies so that a workshop can be planned. Brand materials often contain photographs or quotations; the studio treats those as client-supplied assets and asks the client to confirm that it has the right to share them. The organisation does not ask for national identity numbers, payment-card PAN data, or health records as a condition of writing a positioning framework. If a client pastes such data into a message unasked, the atelier will ask that it be removed from the thread and will not store it as part of the brand file.

Technical data created by visiting the site may include an Internet protocol address as seen by the managed host, a browser user-agent string, the pages requested, and the time of the request. These server records exist so that the host can operate the site, diagnose faults and discourage abuse. They are not used to assemble a marketing profile of a reader. Cookie-related storage is described on the cookies page and, in shorter form, below.

Contact-form submissions to hello@yourbrandworks.pro

The principal collection on this website is the form on contact.php. When a person completes that form and sends it, the name, email address, message text and PDPA consent mark are transmitted to the atelier and are delivered to hello@yourbrandworks.pro so that the desk can reply. That mailbox is the ordinary inbox of the practice. The purpose of this collection is specific: to understand the enquiry, to answer it within ordinary SGT working hours, to propose a conversation if the brief looks like brand-strategy work the studio can usefully take, and to keep a short record of what was asked so that a later call does not begin from silence.

The form includes a quiet field intended to discourage automated clutter. If that field is filled, the submission may be discarded and no personal file is opened. The visible fields — name, email, message and consent — are required because the atelier cannot reply to a nameless or unconsented note through this channel. Consent on the form is consent for the organisation to use those details to reply to that enquiry, in line with this notice. It is not consent to add the sender to a newsletter, to pass the address to a media vendor, or to treat the message as a standing instruction for unrelated campaigns.

Messages that arrive directly at hello@yourbrandworks.pro without using the form are treated in the same spirit: they are used to reply and, if an engagement follows, to administer that engagement. The absence of a ticked box on a free email does not prevent the studio from answering a professional letter; the PDPA allows for deemed consent in limited circumstances where a person voluntarily provides data for a purpose that is reasonably obvious, and a first reply to a letter one has just sent is such a purpose. The atelier still prefers the form because the consent language is explicit and the path to privacy@yourbrandworks.pro is printed beside it.

Purposes for which personal data is used

The organisation uses personal data for a closed set of purposes. The first is to respond to enquiries received through the contact form, by email to hello@yourbrandworks.pro, or by telephone, including scheduling a visit to 61 Amoy Street. The second is to assess whether a brief fits the atelier’s professional brand-strategy practice and to prepare a written proposal if it does. The third is to perform an engagement once accepted: to write, review, invoice, and keep working papers that name the counterpart. The fourth is to maintain the website, including cookie preferences and the security of the host. The fifth is to meet legal duties that apply to a Singapore professional practice — for example keeping invoices for the period the law requires, or answering a lawful request from a public authority. The sixth is to handle privacy requests sent to privacy@yourbrandworks.pro.

The atelier does not use enquiry data to build lookalike audiences, does not sell personal data, and does not send promotional mail to a form address unless the person has later asked for a particular note. If the studio ever wished to use data for a new purpose that is not reasonably related to the purposes above, it would notify the individual and seek consent where the PDPA requires it. Channel planning advice given to a client about that client’s own audiences is not a licence for the atelier to appropriate those audiences.

Consent and other bases under the PDPA

Consent is the ordinary basis for the contact form. The sender ticks a box that points to this notice and thereby agrees that Your Brand Works Pte. Ltd. may use the submitted details to reply. Consent may be withdrawn later by writing to privacy@yourbrandworks.pro; the consequences of withdrawal are explained in a later section. The organisation does not bury additional purposes in the same tick.

The PDPA also recognises deemed consent by conduct, deemed consent by notification in defined cases, and exceptions such as the legitimate-interests exception and certain business-improvement uses, each of which has conditions. The atelier relies on deemed consent only where a person has voluntarily provided data for a purpose that is clear in context — for example, giving a mobile number so that the desk can confirm an appointment time. Legitimate interests, if used at all, would be limited to matters such as securing the site against abuse or establishing a legal claim; they would not be used to justify an unexpected marketing list. The organisation does not treat “the atelier would find it convenient” as a legitimate interest.

Where an exception applies, the studio still aims to notify individuals of the purposes in this notice, because notification is a separate obligation and because a quiet professional practice is easier to trust when the file is explainable. Employees or contractors of a client who are copied on a briefing email are typically included because the client has a relationship with them; the atelier does not then write to those people for its own unrelated offers.

Notification of purposes

The PDPA requires an organisation to inform individuals of the purposes for collection, use or disclosure on or before collecting the data, unless an exception applies. This page is that notification for the website and for ordinary studio correspondence. The contact form repeats the essential purpose in a short consent line. A proposal or engagement letter may add purposes that exist only for that brief — for example, sharing a draft with a named printer the client has chosen. Those additions will be written in the same plain register as this notice.

Disclosure and processors

The atelier does not sell personal data and does not disclose enquiry files to other marketing studios. Disclosure happens in a small number of settings. Processors who support the practice may see data as a consequence of their role: the managed web host that keeps Singapore-region infrastructure running; the operator of the mailbox that receives hello@yourbrandworks.pro and privacy@yourbrandworks.pro; and, when an engagement requires it, an accountant or professional adviser bound to confidentiality. Each is expected to use the data only to provide the instructed service.

The organisation may also disclose data if the individual asks it to — for example, introducing the client to a photographer — or if the law requires disclosure. If a matter proceeds to a Singapore court or a regulator, relevant papers may be produced. The atelier will not disclose a privacy request to a third party for their marketing. Within the studio, access is limited to people who need the file to reply or to perform the brief.

Transfers outside Singapore

The PDPA’s transfer limitation obligation requires that personal data transferred outside Singapore be protected to a standard comparable to the Act. The atelier’s primary files and the public site are intended to live on Singapore-region infrastructure. Some processors, including the operator of a mailbox or a font-delivery network used to render Inter and Newsreader, may handle residual technical data on servers in other countries. Where such a transfer occurs, the organisation takes appropriate steps — contractual clauses, a choice of processors who publish a comparable standard, or a limitation of what is sent — so that the data is not left unprotected.

A client who asks the atelier to use a collaboration tool that the client itself has chosen is asking for a transfer path the client already accepts. The studio will still avoid placing unnecessary personal data in that tool. Individuals who want a fuller picture of a particular processor may write to privacy@yourbrandworks.pro.

Retention

The PDPA requires that personal data not be kept longer than is necessary for the purposes for which it was collected, or for legal or business purposes. Enquiry messages that do not become engagements are kept long enough for the desk to complete the correspondence and to see, if the same person writes again within a reasonable season, that a conversation already took place. They are then deleted or irreversibly anonymised. A working rule in the Amoy Street room is that a quiet enquiry file is reviewed within two years of the last meaningful reply and is not kept “in case it is interesting later”.

Engagement files, invoices and contracts are kept for the life of the work and thereafter for the period Singapore law and ordinary professional practice require for accounting and the handling of any later question about the brief. When that period ends, the papers are destroyed or stored in a form that no longer identifies individuals, unless a longer hold is required by a dispute or a lawful request. Cookie preference records live in the visitor’s browser for six months, as the banner states, and are not a studio archive. Server logs on the host are rotated according to the host’s ordinary practice and the atelier’s instruction that they not become a parallel marketing database.

Withdrawal of consent does not always mean immediate erasure of every line. An invoice that the law requires the organisation to keep will be kept. The studio will, however, stop using the person’s details for the purpose that has been withdrawn — for example, it will not continue a mailing the person has refused — and it will say what must remain on file and why.

Access and correction

An individual may ask Your Brand Works Pte. Ltd. for access to personal data the organisation holds about them, and for information about the ways in which that data has been or may have been used or disclosed during the year before the request, subject to the exceptions in the PDPA. An individual may also ask for correction of data that is inaccurate or incomplete. Requests should be sent to privacy@yourbrandworks.pro, or in writing to 61 Amoy Street, #04-02, Singapore 069878, and should include enough detail for the desk to locate the file — typically a name, the email used on the form, and the approximate date of contact.

The atelier aims to respond within the period expected under the PDPA and PDPC guidance, and in any event with a first acknowledgement during SGT working hours when the mailbox is read. The organisation may need to verify that the requester is the individual concerned. Where the PDPA allows a reasonable fee for access, the studio would say so before doing chargeable work; many straightforward corrections and simple access requests from a recent enquiry can be handled without a fee. Some records may be withheld or redacted where the Act permits — for example, where disclosure would reveal another person’s data that cannot fairly be separated, or where the record is legally privileged. The reply will say if something is withheld.

Correction is not a right to rewrite a professional opinion the atelier formed in a working paper, but it is a right to have factual identifiers and contact details put right. If the organisation disagrees that a passage is inaccurate, it will annotate the file with the individual’s position where the PDPA expects that courtesy.

Withdrawal of consent

Consent may be withdrawn by writing to privacy@yourbrandworks.pro. The atelier will explain the likely consequences. Withdrawing consent for enquiry follow-up means the desk will stop writing to that address about that conversation, which also means the studio cannot usefully continue a proposal on that channel. Withdrawing consent does not unwind work already performed under an engagement, and it does not require the organisation to delete records it must keep. It does require the organisation to stop the onward use that depended on the consent, within a reasonable time after the request is understood.

Cookies and similar storage

The site uses a small set of cookies and equivalent browser storage, described in full on the cookies page. Necessary storage remembers whether the visitor has accepted, rejected or customised optional tools, and it keeps the banner from repeating itself on every page for six months. The only optional category presently offered is the Google Maps embed on the contact page. There is no advertising pixel and no third-party measurement suite placed by the atelier. Choices are made through Accept all, Reject all, Customise and Save preferences. Changing a choice later is explained on the cookies page. Cookie preferences do not replace access and correction rights for personal data held in the studio’s mailboxes and files.

Google Maps on the contact page

If a visitor allows the maps category, the contact page may load an embedded Google Map centred on 61 Amoy Street. In that case Google may collect technical data such as Internet protocol address, browser details and interaction with the map. That collection is Google’s; the atelier does not receive a named profile from the embed and does not use it to score a lead. Visitors who refuse the category still see the address, telephone and email in ordinary text. Google’s own privacy documentation governs what Google does with any data it collects through Maps.

Accuracy

The PDPA requires an organisation to make a reasonable effort to ensure that personal data it uses is accurate and complete, particularly when the data is likely to be used to make a decision that affects the individual or is likely to be disclosed to another organisation. The atelier’s decisions are usually about whether it can take a brief and how to address a letter. It therefore relies in the first instance on the spelling and details the individual supplies. Staff are asked not to “improve” a name or a company style without asking. If a visiting card and an email signature disagree, the desk will follow the form the person last confirmed.

Protection and security

The organisation is required to protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. In a small Amoy Street practice those arrangements are concrete rather than ceremonial. Mailboxes for hello@yourbrandworks.pro and privacy@yourbrandworks.pro are reached with authenticated access. The public site is served over ordinary encrypted transport from a managed host in the Singapore region. Working papers are kept on systems the studio controls or on processors bound by instruction, not on shared public boards. Paper notes from a table session are not left on the stair. When a file is closed and retention ends, deletion is intended to be actual, not a move to a forgotten folder named archive.

No professional studio can honestly say that a system is beyond all interference. The atelier’s commitment is to arrangements that are reasonable for the sensitivity of the data it actually holds — names, emails, briefing text — and to prompt attention if a weakness is found. Individuals who believe their data has been mishandled should write to privacy@yourbrandworks.pro. The organisation will also consider, where a notifiable data breach standard under Singapore law applies, whether authorities and affected individuals must be informed, and will do so in the manner that standard requires.

Direct marketing and the Do Not Call regime

The atelier does not run a volume outbound list from form submissions. If the organisation were to send a marketing message to a Singapore telephone number, it would observe the Do Not Call provisions that apply to such messages, including checking the relevant register where required and honouring a clear refusal. An email that is a reply to a person’s own enquiry is not treated as unsolicited marketing. A person who does not wish to receive even a considered professional note after a first reply can say so in a sentence to privacy@yourbrandworks.pro or hello@yourbrandworks.pro.

Links, fonts and other third-party pages

Pages on this site may link to other organisations. Those destinations have their own practices. The atelier is not the organisation for personal data those sites collect once the visitor has left yourbrandworks.pro. Type for this site is requested from Google Fonts (Inter and Newsreader). That request may allow Google to see a technical address of the browser in order to deliver the files. It is a presentation choice, not a briefing about the visitor’s brand. Visitors who block third-party fonts will still receive the HTML and the studio’s own style sheet.

Complaints and the Personal Data Protection Commission

A person who is concerned about the way Your Brand Works Pte. Ltd. has handled personal data is asked to write first to privacy@yourbrandworks.pro or to 61 Amoy Street, #04-02, Singapore 069878, so that the atelier can look at the file and reply. The organisation treats such letters as part of its PDPA duty, not as an inconvenience. If the matter cannot be resolved with the studio, the individual may approach the Personal Data Protection Commission, which is Singapore’s authority for the PDPA. The PDPC publishes contact details and complaint pathways on its public website. The atelier will cooperate with any enquiry the Commission makes in accordance with the law. Using the Commission’s process does not prevent a person from seeking other remedies that Singapore law may allow.

This notice is not legal advice to the reader and is not a substitute for the text of the PDPA or for the PDPC’s advisory guidelines. It is the atelier’s account of how a brand-strategy practice on Amoy Street intends to behave.

How to write to the atelier about privacy

Privacy mailbox: privacy@yourbrandworks.pro. General studio mailbox: hello@yourbrandworks.pro. Telephone: +65 6224 5138, Monday to Friday, 09:00–18:00 SGT. Post: Your Brand Works Pte. Ltd., 61 Amoy Street, #04-02, Singapore 069878. Related pages: legal notice, cookies, terms, contact.

Changes to this notice

The organisation may revise this notice when its practices, processors or the law require a clearer sentence. The new wording will be published on this page with an updated date. Material changes — a new purpose, a new optional embed, a new mailbox — will be described in the change-log below rather than hidden in a rearranged paragraph. Continued use of the contact form after a revision is an opportunity to read the new text; it is not a trick to expand consent. For a live engagement, a change that affects how that client’s data is used will also be mentioned in the ordinary correspondence of the brief where the PDPA expects notice.

Change-log

02 September 2026 — First publication of this privacy notice for yourbrandworks.pro, covering organisation identity, contact-form submissions to hello@yourbrandworks.pro, consent and other PDPA bases, retention, access and correction, cookies, the Google Maps embed on contact.php, security arrangements, and reference to the PDPC. Last updated 02 September 2026.