Privacy Policy

This policy explains how K2SD Group collects, uses, discloses and protects personal data, and it is written to meet the Singapore Personal Data Protection Act 2012 (the PDPA) as amended.

The organisation responsible for your personal data is K2SD PTE. LTD. (UEN 202013210W), at 33 Mohamed Sultan Road, #03-04, Singapore 238977.

This policy covers this website. It does not cover any other website we link to, including publications that feature our work.

Section 11 of the PDPA requires us to designate an individual responsible for our compliance and to publish their business contact information. Ours is:

The Data Protection Officer, K2SD PTE. LTD., 33 Mohamed Sultan Road, #03-04, Singapore 238977. Email concierge@k2sd.co, marked for the attention of the Data Protection Officer. Telephone +65 6917 7275.

Write to them about anything in this policy, to ask what data we hold about you, to correct it, or to complain. We answer within 30 calendar days, or write within 30 days telling you when we will.

We collect personal data only when you give it to us. There is no account to create and nothing to buy on this website.

If you send an enquiry through our contact form, we collect your name, your email address, your subject line and your message.

If you complete our fit-out enquiry form, we collect your name, your email address, and optionally your telephone number, together with your answers about the project: its type, the size of the space, the scope of work, your budget range, your intended start date, your style preferences, whether others are involved in the decision, and anything you add in your own words.

If you subscribe to updates, we collect your name, your email address, your mobile number if you choose WhatsApp, and which of those channels you have chosen.

If you ask us about a commission, we collect your name, your email address, your telephone number, and your answers about the property: its type, its approximate size, where it is, and anything you add in your own words. You are asked to tick a box confirming you have read this policy before that form will send.

We do not ask for your NRIC or FIN, and you should not send it to us.

Every field above is one you fill in yourself. We do not buy personal data, and we do not collect it from anywhere else.

Like every website, this one is served by computers that receive your IP address, your browser type and the page you asked for. That is how a page reaches you and we cannot switch it off.

We also load Google's tag manager, which means Google receives that same information. It currently carries no measurement tags.

If you accept the cookie notice, this site also loads the Meta Pixel. Meta then receives that same information, the pages you visit here, and whether you send us an enquiry, subscribe, or tap to contact us by WhatsApp, phone or email. If you decline or do not answer, the Pixel is never loaded.

This website sets no cookies unless you accept the cookie notice.

If you accept, the Meta Pixel sets _fbp, which lets Meta recognise your browser across visits, and _fbc if you arrived by clicking one of our ads. Each lasts up to 90 days. We use them to see whether our Facebook and Instagram advertising brings people to this site and to enquire, and to show our advertising to people who have visited.

If you have accepted and then send us an enquiry or subscribe, our server also tells Meta that it happened. It sends your email address, your name and, for a subscription, your phone number, each scrambled (hashed) so it can only be matched to an account Meta already holds. It never sends what you wrote to us. Meta uses this under its own privacy policy, not ours.

To change your answer, clear this website's data in your browser settings, and the notice will ask you again on your next visit.

Two things are kept in your browser's own storage, on your device, and never sent to us:

• Your answer to the cookie notice, so we do not ask again on every page.
• A typographic preference, used by our team when trying type styles. Visitors do not see this control.

Third parties set their own cookies, or keep their own data in your browser, in three places. The films on our Arts and Styling pages are served from Supabase, which sets a short-lived cookie to tell people apart from bots. Where a press article opens in a panel on our page, that publisher's own cookies and tracking apply, and their policy governs, not ours. A film on a project page is only a picture until you press play. Pressing play loads YouTube's player from Google, which receives your IP address and browser details, keeps its own data in your browser's storage and may set cookies. It does this for itself, not on our behalf, so from that point Google's own policy applies, not ours.

We use personal data only for the purposes below, and we will ask you again before using it for anything else:

• To answer your enquiry and to discuss a possible project with you.
• To prepare a proposal, a quotation or an appointment, where you have asked for one.
• To send you studio news and new projects, if you have asked to receive them.
• If you accept the cookie notice, to measure how our Facebook and Instagram advertising performs, and to show it to people who have visited this site.
• To keep records we are required by law to keep.

We do not use your data to make automated decisions about you. Meta decides who is shown an ad, using the measurement data above, and only for visitors who accepted.

We rely on your consent, given when you submit a form. Marketing is asked for separately and is never a condition of enquiring: you can send us an enquiry without agreeing to hear from us again.

You may withdraw consent at any time by writing to our Data Protection Officer, or by using the unsubscribe link in any update we send. We will act on it and tell you what it means in practice. Withdrawing consent to marketing does not withdraw an enquiry already in progress.

Where the law allows us to act without consent, for example to respond to something you asked for, we do so only to the extent the PDPA permits.

We do not sell your personal data, and we do not trade it.

These service providers process it on our behalf, under contracts requiring them to protect it to the standard the PDPA requires:

• Resend, United States, which delivers our email. Your enquiry and your subscription pass through and are stored on their systems.
• Vercel, United States, which hosts this website. Our functions run in Singapore.
• Supabase, Singapore, which stores the photographs on this site and the films on its Arts and Styling pages.
• Google, United States, whose tag manager this site loads.
• Meta Platforms, Ireland and the United States, which receives the advertising measurement data described in section 05, only if you accept the cookie notice.

Our marketing partner Zelix Labs is copied on subscription notifications so that they can maintain this website on our behalf.

We also disclose personal data where the law requires it, or to our professional advisers where necessary.

Some of the providers above are in the United States, so your personal data is transferred there and stored there. This is happening now, not something that might happen later.

Section 26 of the PDPA requires us to satisfy ourselves that your data receives a standard of protection comparable to Singapore's. We rely on our contracts with these providers, which bind them to protect it to that standard and name the countries involved.

You may ask our Data Protection Officer for more detail about these arrangements.

We keep personal data only as long as we need it for the purpose it was given, or as long as the law requires.

• Enquiries that do not become projects: 24 months from your last contact with us, unless you ask us to remove them sooner.
• Project records: for the life of the project and afterwards for as long as our professional and tax obligations require.
• Subscriptions: until you unsubscribe, and then only what we need to honour that.

When a purpose ends and no law requires us to keep it, we delete it or make it anonymous.

We protect personal data with measures appropriate to how sensitive it is. This website is served only over an encrypted connection, our email provider encrypts data in transit and at rest, and access to enquiries is limited to the people who need it.

No transmission over the internet is completely secure, and we do not claim otherwise. Please do not send us sensitive personal data through a web form.

Part 6A of the PDPA requires us to assess any data breach and to notify where the law demands it. If a breach is likely to cause you significant harm, or affects 500 or more people, we notify the Personal Data Protection Commission within three calendar days of concluding that it is notifiable, and we notify you as soon as practicable unless the Commission directs otherwise.

Under the PDPA you may:

• Ask what personal data we hold about you, and how we have used or disclosed it in the past year. We answer within 30 calendar days, or tell you within 30 days when we will. A fee may apply, and we will tell you before charging it.
• Ask us to correct it if it is wrong or incomplete. We correct it and tell anyone we passed it to, unless there is a lawful reason not to.
• Withdraw your consent, as described above.

The PDPA does not give a general right to have data erased, but we will delete what we hold about you if you ask. The next section explains how.

A small number of exceptions in the PDPA let us refuse a request. If one applies we will tell you which, and why.

You can ask us to delete the personal data we hold about you. This covers enquiries sent through this website, and details you give us through our Facebook or Instagram pages or ads, such as a lead form or a message.

To ask:

1. Email concierge@k2sd.co with the subject Delete my data.
2. Give your name and the email address or phone number you used with us. If you contacted us on Facebook or Instagram, give the name on that account instead.

We confirm we have received your request and may ask you to show it is yours. We then delete the data within 30 calendar days and write to tell you it is done.

We keep only what a law requires us to keep, such as a signed contract or an invoice. If that applies, we tell you what we kept and why.

Deleting what we hold does not delete what Meta holds about you. To manage that, use the privacy settings in your Facebook or Instagram account.

Write to our Data Protection Officer first. We will acknowledge you and aim to resolve it within 30 days.

If you are not satisfied, you may complain to Singapore's Personal Data Protection Commission at pdpc.gov.sg.

This website reads in eight languages and we welcome enquiries from anywhere. Our operations and our data protection obligations are Singaporean, and this policy is governed by Singapore law.

If you are in the European Union or the United Kingdom and want to know how we handle your data, write to our Data Protection Officer and we will answer.

We will update this page when our practices change, and the date below is the date of the version you are reading. If a change materially affects how we use data you have already given us, we will ask you before it takes effect.

K2SD Group

33 Mohamed Sultan Road, #03-04, Singapore 238977

Telephone +65 6917 7275

Email concierge@k2sd.co

Data Protection Officer: concierge@k2sd.co, marked for the attention of the Data Protection Officer

Effective 2 September 2026. Last updated 26 September 2026.