Pentacle Ideation (“Pentacle”, “we”, “us” or “our”) respects the privacy of individuals and is committed to managing personal data responsibly and in accordance with the Personal Data Protection Act 2012 of Singapore, its subsidiary legislation and applicable regulatory requirements, as amended from time to time (collectively, the “PDPA”).
This Privacy Policy explains how we may collect, use, disclose, process, store, transfer, protect and retain personal data in connection with:
- our website;
- our creative, design, marketing, digital and technology services;
- enquiries, quotations, proposals and projects;
- client, supplier, contractor and business relationships;
- employment, internship and freelance applications; and
- other communications or interactions with Pentacle Ideation.
This Privacy Policy applies to personal data in our possession or under our control, including personal data processed for us by authorised service providers.
This Privacy Policy should be read together with our Terms of Use, which govern access to and use of our website.
By providing personal data to us, submitting an enquiry, using our website or engaging our services, you acknowledge that you have read and understood this Privacy Policy.
Where consent is required, we will obtain appropriate consent before collecting, using or disclosing personal data, unless an exception under the PDPA or another applicable law applies.
“Personal data” means data, whether true or not, about an individual who can be identified:
- from that data; or
- from that data and other information to which an organisation has or is likely to have access.
Depending on your relationship and interactions with us, personal data may include:
- name;
- job title and organisation;
- telephone number;
- email address;
- correspondence address;
- signature;
- photographs, videos or recordings;
- billing, payment and transaction information;
- information contained in enquiries, quotations, proposals, contracts, project briefs, feedback and correspondence;
- employment history, qualifications, résumé and portfolio information;
- IP address;
- browser, operating-system and device information;
- website usage information;
- cookie and analytics identifiers; and
- other information relating to an identifiable individual that you voluntarily provide.
Business contact information provided solely for business purposes may be treated differently under the PDPA.
Unless reasonably necessary for a specific lawful purpose, we do not generally request through our public website:
- NRIC or FIN numbers;
- passport details;
- complete credit or debit card details;
- banking passwords;
- one-time passwords;
- account authentication credentials;
- medical information; or
- other highly sensitive personal data.
You should not transmit sensitive or confidential personal information through unsecured channels unless we have specifically requested it and provided an appropriate transmission method.
We may collect personal data directly from you, from your authorised representative or from other permitted sources when you:
- visit or use our website;
- submit an online form or enquiry;
- contact us by telephone, email, messaging application or social media;
- request information, a quotation, proposal, presentation or consultation;
- engage us to provide services;
- enter into an agreement or business arrangement with us;
- attend a meeting, presentation, event, photography session or production;
- provide instructions, content, data, comments, feedback or approvals;
- make or receive a payment;
- submit a résumé, portfolio or application;
- subscribe to communications from us; or
- otherwise voluntarily provide personal data.
We may also receive personal data from:
- your employer, colleagues or authorised representatives;
- our clients, suppliers, contractors and project partners;
- professional advisers;
- recruitment platforms and referees;
- payment, hosting, cloud, analytics, software and cybersecurity providers;
- publicly available sources; and
- other persons or organisations where permitted by law.
If you provide us with personal data relating to another individual, you represent that:
- you are authorised to provide the data;
- you have informed the individual of the relevant purposes;
- you have obtained any consent required by law; and
- the information is accurate and complete to the best of your knowledge.
You must not provide another individual’s personal data without appropriate authority.
We may collect, use and disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances, including the following.
6.1 Enquiries and business development
- responding to enquiries and requests;
- understanding project or business requirements;
- arranging meetings and consultations;
- preparing quotations, proposals and presentations;
- evaluating potential projects and business opportunities;
- communicating about our capabilities and services; and
- following up on enquiries.
6.2 Provision of services
- providing branding, graphic design, marketing, photography, website development, Progressive Web App development, e-commerce, web application, hosting, maintenance, consultancy and related services;
- planning, managing and administering projects;
- managing schedules, deliverables, approvals and communications;
- developing concepts, designs, content, systems and digital platforms;
- coordinating with clients, suppliers, contractors and project partners;
- providing maintenance, technical support and troubleshooting;
- conducting testing, deployment and quality assurance;
- administering hosting, domain, email, cloud, software and third-party services;
- maintaining project records and documentation; and
- fulfilling contractual obligations.
6.3 Administrative and financial purposes
- administering client, supplier and contractor relationships;
- issuing quotations, invoices, statements and receipts;
- processing payments and refunds;
- maintaining accounting, tax, audit and financial records;
- verifying transactions;
- recovering outstanding payments;
- managing insurance matters; and
- maintaining business records.
6.4 Website, system and security purposes
- operating and maintaining our website and systems;
- enabling website functions;
- monitoring performance and availability;
- analysing traffic and usage;
- administering backups;
- diagnosing technical issues;
- detecting and preventing fraud, misuse, malicious activity and security threats;
- managing access controls;
- investigating suspected incidents;
- improving content, functionality, performance and usability; and
- protecting our systems, clients, personnel, data and business interests.
6.5 Employment and engagement applications
- processing employment, internship, freelance and contractor applications;
- assessing qualifications, experience and suitability;
- arranging interviews;
- conducting reference or background checks where appropriate;
- communicating with applicants;
- preparing employment or engagement offers;
- maintaining recruitment records; and
- considering applicants for suitable opportunities.
6.6 Legal, compliance and risk-management purposes
- complying with applicable laws, regulations, court orders and regulatory requirements;
- responding to lawful requests from public agencies and authorities;
- obtaining legal, accounting or professional advice;
- preventing, detecting and investigating unlawful activity;
- managing disputes, complaints and claims;
- conducting audits and investigations;
- establishing, exercising or defending legal rights;
- enforcing contractual obligations;
- recovering debts;
- managing business, financial and operational risks; and
- protecting the rights, property, safety and interests of Pentacle Ideation and other parties.
6.7 Business transactions
- evaluating or facilitating a potential restructuring, financing, investment, assignment, transfer, sale or acquisition of the business or its assets;
- conducting due diligence; and
- transferring appropriate records to a permitted purchaser, successor or assignee.
6.8 Other purposes
We may also collect, use or disclose personal data:
- for purposes incidental or reasonably related to those stated above;
- for purposes specifically notified to you;
- with your consent;
- where permitted under the PDPA; or
- where required by law.
We will not require consent to the collection, use or disclosure of personal data beyond what is reasonably necessary to provide the relevant product or service.
Where required, we will obtain consent before collecting, using or disclosing personal data.
Consent may be express or deemed to have been given in circumstances permitted under the PDPA, including where:
- you voluntarily provide personal data for an obvious purpose;
- processing is reasonably necessary to conclude or perform a contract with you; or
- another legally recognised form of deemed consent applies.
We may collect, use or disclose personal data without consent where permitted or required under the PDPA or another applicable law.
This may include circumstances relating to:
- emergencies;
- investigations;
- debt recovery;
- legal proceedings;
- legitimate interests;
- business improvement;
- evaluative purposes;
- employment matters;
- publicly available information;
- prevention or detection of unlawful activity; or
- legal and regulatory compliance.
Where required, we will undertake and document an appropriate assessment before relying on an exception.
We may disclose personal data, where reasonably necessary, to:
- our employees and authorised personnel;
- freelancers, contractors and project partners;
- designers, developers, photographers, videographers and production vendors;
- printers and fulfilment providers;
- hosting, cloud, email and telecommunications providers;
- software, analytics, artificial-intelligence and cybersecurity providers;
- technical-support and backup providers;
- payment processors, banks and financial institutions;
- accountants, auditors, lawyers, insurers and professional advisers;
- clients where disclosure is necessary for a project;
- recruitment platforms and referees;
- government agencies, regulators and law-enforcement agencies;
- courts and tribunals;
- a prospective or actual purchaser, investor, successor, assignee or adviser involved in a business transaction;
- any person authorised by you; and
- any other party where disclosure is permitted or required by law.
We will endeavour to disclose only the personal data reasonably necessary for the relevant purpose.
Where a service provider processes personal data on our behalf, we will take reasonable steps to require it to:
- process personal data only for authorised purposes;
- implement appropriate security arrangements;
- restrict unauthorised access and disclosure;
- notify us of relevant security incidents where required; and
- comply with applicable contractual and legal obligations.
We do not sell personal data to third parties.
Pentacle Ideation may develop, operate, host, maintain or support websites, applications, e-commerce platforms, campaigns, customer-management systems, membership platforms, loyalty systems, e-voucher systems and other digital services for clients.
In providing these services, we may process personal data on behalf of a client.
Where we process personal data solely on behalf of and for the purposes of a client, Pentacle Ideation may act as a data intermediary under the PDPA.
In such circumstances:
- the client generally determines why and how the personal data is collected, used and disclosed;
- the client remains responsible for its privacy notices, consent mechanisms and applicable legal obligations;
- we will process personal data according to the client’s lawful instructions and the applicable agreement;
- we will implement reasonable security arrangements for personal data in our possession or under our control; and
- we will notify the client without undue delay after becoming aware of a relevant data breach, where required.
Requests concerning personal data collected through a client-owned website, application, campaign, membership programme, e-commerce platform or other system should generally be directed to the relevant client.
Nothing in this section limits any obligation imposed directly on Pentacle Ideation under applicable law.
Clients may provide personal data, databases, mailing lists, customer records, photographs, content or other materials to us for a project.
The client is responsible for ensuring that:
- it has lawful authority to provide the information;
- all required privacy notifications have been given;
- all necessary consents have been obtained;
- the intended processing is permitted by law;
- the information is accurate and suitable for the intended purpose; and
- its instructions do not require Pentacle Ideation to breach applicable law.
We may reasonably rely on the client’s instructions and representations unless we have reason to believe that doing so would be unlawful.
To the fullest extent permitted by law, the client remains responsible for claims, complaints or losses arising from personal data or materials supplied without the necessary authority, consent or lawful basis.
When you visit our website, certain technical information may be collected automatically, including:
- IP address;
- browser type;
- device type;
- operating system;
- screen resolution;
- referring website;
- pages visited;
- links selected;
- date and time of access;
- duration of visits;
- approximate location;
- error and diagnostic information; and
- cookie or similar identifiers.
Our website may use cookies and similar technologies to:
- provide essential website functionality;
- maintain security;
- remember settings and preferences;
- measure website traffic;
- analyse how visitors use the website;
- detect errors;
- improve performance and usability; and
- support analytics or marketing activities.
You may block or delete cookies through your browser settings. Disabling cookies may affect the availability or operation of certain website functions.
Where required by applicable law, we will obtain consent before using non-essential cookies or similar technologies.
Our website may use or include third-party services such as:
- website analytics;
- maps;
- video players;
- social-media plug-ins;
- web fonts;
- spam-prevention services;
- content-delivery networks;
- enquiry forms;
- cloud services; and
- external links.
These third parties may independently collect or process information in accordance with their own privacy policies.
We do not control the privacy, security or data-handling practices of independent third parties.
You should review the applicable privacy policies and terms before providing personal data to a third-party service.
Where you have provided consent, or where otherwise permitted by law, we may send information concerning:
- our services;
- projects;
- events;
- business updates;
- announcements; and
- relevant offers or opportunities.
Marketing communications may be sent by email, telephone, text message, messaging application, post or another permitted channel.
You may withdraw consent or unsubscribe at any time by:
- using the unsubscribe facility provided in the communication; or
- contacting our Data Protection Officer.
Withdrawal from marketing communications will not prevent us from sending:
- project communications;
- service notices;
- invoices and payment reminders;
- transactional messages;
- contractual communications;
- security notices; or
- other non-marketing communications necessary for an existing relationship.
Where applicable, marketing messages sent to Singapore telephone numbers will be managed in accordance with the Do Not Call provisions of the PDPA.
Some of our hosting providers, cloud platforms, software vendors, artificial-intelligence services, technical-support providers or project partners may operate outside Singapore.
Personal data may therefore be:
- transferred outside Singapore;
- stored on servers outside Singapore;
- accessed by authorised personnel outside Singapore; or
- processed in another country or territory.
Where personal data is transferred outside Singapore, we will take appropriate steps to ensure that the overseas recipient is bound by legally enforceable obligations to provide a standard of protection that is at least comparable to that required under the PDPA, unless an applicable exception applies.
Appropriate safeguards may include:
- contractual data-protection obligations;
- applicable foreign laws;
- binding corporate rules;
- recognised certifications;
- data-transfer agreements; or
- other transfer mechanisms permitted under applicable law.
Where consent is relied upon for an overseas transfer, we will provide the information required by applicable law and obtain the relevant consent.
We will make reasonable security arrangements to protect personal data in our possession or under our control against:
- unauthorised access;
- unauthorised collection;
- unauthorised use or disclosure;
- copying;
- modification;
- loss;
- disposal;
- alteration;
- destruction; and
- similar risks.
Depending on the nature and sensitivity of the personal data, safeguards may include:
- password and authentication controls;
- access restrictions and role-based permissions;
- secure hosting and network configurations;
- firewalls and anti-malware protection;
- encryption or secure transmission where appropriate;
- security updates and software patches;
- backups;
- monitoring and logging;
- confidentiality obligations;
- personnel training;
- vendor-management measures;
- physical-security controls; and
- secure deletion or disposal procedures.
Access to personal data will be limited, as far as reasonably practicable, to persons who require it for authorised business purposes.
Although we implement reasonable security arrangements, no website, email service, electronic transmission, cloud platform, software system or storage method can be guaranteed to be completely secure, continuously available or free from errors, malicious activity or unauthorised interference.
You are responsible for taking reasonable precautions when communicating or transacting online, including:
- keeping passwords and authentication credentials confidential;
- using secure devices and networks;
- maintaining updated operating systems and security software;
- verifying requests for sensitive information;
- avoiding transmission of sensitive data through unsecured channels; and
- notifying us promptly of suspected unauthorised access or a security incident.
To the fullest extent permitted by law, Pentacle Ideation will not be responsible for loss caused solely by:
- your failure to safeguard credentials;
- inaccurate or incomplete information supplied by you;
- unauthorised access arising from your device, network or account;
- transmission through an unsecured channel selected by you;
- a security failure of an independent third-party service outside our reasonable control;
- malicious or unlawful activity that could not reasonably have been prevented despite appropriate safeguards;
- internet, hosting, telecommunications or power failures outside our reasonable control; or
- events of force majeure.
Nothing in this Privacy Policy excludes, restricts or modifies any obligation or liability that cannot lawfully be excluded, restricted or modified under the PDPA or another applicable law.
If we become aware of a suspected or confirmed data breach affecting personal data in our possession or under our control, we will take reasonable steps to:
- contain the incident;
- investigate its cause and scope;
- assess the personal data affected;
- assess the likely harm to affected individuals;
- determine whether the breach is notifiable under the PDPA;
- take remedial and preventive action;
- notify the Personal Data Protection Commission where required; and
- notify affected individuals where required.
Where we process personal data on behalf of a client, we will notify the client without undue delay after becoming aware of a relevant breach, in accordance with applicable legal and contractual obligations.
We will retain personal data only for as long as reasonably required for:
- the purpose for which it was collected;
- providing services or completing a project;
- maintaining client and business records;
- accounting, tax and audit purposes;
- contractual and insurance requirements;
- resolving complaints or disputes;
- recovering outstanding amounts;
- complying with legal and regulatory requirements;
- establishing, exercising or defending legal claims; or
- another legitimate business or legal purpose.
When personal data is no longer required for any business or legal purpose, we will cease retaining it or remove the means by which it can be associated with an identifiable individual, where reasonably practicable.
Personal data may remain temporarily in secure backups or archival systems until it is deleted or overwritten as part of normal retention and backup cycles.
We will make reasonable efforts to ensure that personal data is accurate and complete where it is likely to be:
- used to make a decision affecting the individual; or
- disclosed to another organisation.
You are responsible for:
- providing accurate and complete information;
- checking information before submission; and
- informing us promptly of relevant changes.
We may reasonably rely on information provided by you, your employer or your authorised representative.
To the fullest extent permitted by law, we are not responsible for consequences arising from inaccurate, incomplete or outdated information where we have reasonably relied on the information supplied.
Subject to the PDPA and applicable exceptions, you may request:
- access to personal data about you that is in our possession or under our control; and
- information about how such personal data was used or disclosed during the applicable period prescribed under the PDPA.
Requests must be submitted in writing to our Data Protection Officer.
The request should contain sufficient information to enable us to:
- verify your identity;
- understand its scope; and
- locate the relevant personal data.
We may request additional information or supporting identification before processing the request.
Where permitted under the PDPA, we may charge a reasonable fee for processing an access request. We will notify you of the estimated fee before proceeding.
We may refuse, limit or redact access where permitted or required under the PDPA.
You may request correction of an error or omission in personal data about you that is in our possession or under our control.
Correction requests must be submitted in writing to our Data Protection Officer and should:
- identify the information to be corrected;
- explain why it is inaccurate or incomplete; and
- provide supporting information where appropriate.
Where required under the PDPA, we will correct the personal data as soon as practicable and send the corrected information to other organisations to which it was disclosed during the applicable period, unless an exception applies.
You may withdraw your consent to our continued collection, use or disclosure of personal data by providing reasonable written notice to our Data Protection Officer.
Before processing the withdrawal, we may inform you of its likely consequences.
Depending on the nature and extent of the withdrawal, we may be unable to:
- respond to an enquiry;
- continue providing services;
- complete a project;
- process a transaction;
- administer an agreement; or
- continue a business or contractual relationship.
Withdrawal of consent does not affect:
- personal data previously collected, used or disclosed lawfully;
- our right to retain or process personal data where permitted or required by law;
- outstanding contractual obligations;
- debt-recovery rights; or
- other legal rights and remedies.
We may use software, automation or artificial-intelligence tools to support activities such as:
- content development;
- design exploration;
- translation;
- transcription;
- data organisation;
- analytics;
- website functionality;
- cybersecurity;
- project administration; and
- business operations.
Where personal data is processed using such tools, we will take reasonable steps to:
- use personal data only for authorised purposes;
- limit the amount of personal data disclosed;
- select appropriate service providers;
- apply relevant access and security controls; and
- comply with applicable legal and contractual requirements.
Clients should not provide sensitive, confidential or regulated personal data for processing through an artificial-intelligence service unless this has been expressly agreed and appropriate safeguards have been established.
Our website and communications may contain links to websites, applications and services operated by independent third parties.
Pentacle Ideation does not control and is not responsible for their:
- privacy policies;
- data-processing practices;
- security arrangements;
- availability;
- content;
- accuracy; or
- conduct.
The inclusion of a link does not constitute an endorsement, warranty or representation regarding the third party.
You should review the relevant privacy policy and terms before providing personal data to any third-party service.
Personal data submitted in connection with an employment, internship, freelance or contractor application may be used to:
- assess qualifications, experience and suitability;
- review résumés and portfolios;
- arrange interviews;
- conduct reference or background checks where appropriate;
- verify information provided;
- communicate with the applicant;
- prepare an offer or engagement;
- fulfil legal and administrative requirements; and
- consider the applicant for another suitable opportunity.
Unsuccessful applications may be retained for a reasonable period for administrative, legal and future recruitment purposes.
Applicants should avoid including unnecessary sensitive personal information in résumés or portfolios.
Our website and services are principally intended for businesses and individuals aged 18 and above.
We do not knowingly collect personal data from children through our public website without appropriate consent or lawful authority.
A parent or legal guardian who believes that a child has provided personal data to us without appropriate consent may contact our Data Protection Officer.
Business contact information may be collected, used and disclosed for legitimate business purposes, including:
- professional communications;
- project coordination;
- business development;
- supplier management;
- networking; and
- maintaining business relationships.
Business contact information may be excluded from certain provisions of the PDPA where it is not provided solely for personal purposes.
Pentacle Ideation has designated a Data Protection Officer to oversee its data-protection policies and practices and to handle enquiries, requests and complaints relating to personal data.
Questions, complaints, access requests, correction requests and withdrawal-of-consent requests may be directed to:
Please include sufficient information for us to:
- identify you;
- verify your identity or authority;
- understand your request; and
- locate the relevant personal data.
We will acknowledge and respond within a reasonable period, having regard to the complexity and scope of the request and applicable legal requirements.
If you believe that we have not handled your personal data appropriately, please contact our Data Protection Officer.
We may request additional information to investigate the matter.
We will endeavour to:
- acknowledge the complaint;
- investigate it fairly;
- communicate the outcome within a reasonable period; and
- take appropriate remedial action where necessary.
Nothing in this section prevents an individual from contacting the Personal Data Protection Commission or exercising a right available under applicable law.
This Privacy Policy describes our general personal-data practices.
It does not:
- create contractual rights beyond those imposed by applicable law;
- guarantee that every electronic system or transmission will be completely secure;
- override a separate written agreement;
- restrict any lawful right or remedy available to Pentacle Ideation;
- require disclosure of legally privileged or confidential information; or
- exclude an obligation that cannot lawfully be excluded.
Where a separate contract, project agreement, data-processing agreement or client-specific privacy notice applies, it should be read together with this Privacy Policy.
Applicable law will prevail in the event of any inconsistency.
To the fullest extent permitted by Singapore law, Pentacle Ideation will not be liable for indirect, incidental, special, punitive or consequential loss arising solely from:
- use of or inability to use our website;
- reliance on information transmitted through an unsecured channel;
- unauthorised access caused by an individual’s failure to protect credentials;
- inaccurate information supplied by a user, client or third party;
- an interruption, act or failure of an independent third-party service;
- circumstances beyond our reasonable control; or
- a third party’s breach of its own legal, contractual or security obligations.
This limitation does not apply to liability that cannot lawfully be excluded or restricted, including liability imposed under the PDPA.
Nothing in this Privacy Policy limits an obligation of a client, supplier, contractor or user under a separate agreement with Pentacle Ideation.
This Privacy Policy is governed by the laws of Singapore.
Subject to mandatory statutory rights, any dispute arising from or relating to this Privacy Policy will be subject to the jurisdiction of the courts of Singapore.
Nothing in this section prevents an individual from lodging a complaint with the Personal Data Protection Commission or exercising another right available under applicable law.
We may review and amend this Privacy Policy periodically to reflect changes in:
- applicable laws and regulatory guidance;
- technology;
- our services and business practices;
- our service providers; or
- operational and security requirements.
The revised Privacy Policy will be published on our website with an updated “Last updated” date.
Unless otherwise stated, revisions take effect when published.
Continued dealings with us following publication of an updated policy will be subject to the updated policy, but will not by itself constitute consent where express consent is required by law.
You are encouraged to review this Privacy Policy periodically.
This Privacy Policy is prepared in English.
Where a translated version is provided, the English version will prevail to the extent permitted by law in the event of an inconsistency.