Privacy Policy

This policy explains how K2SD Group collects, uses, discloses and protects personal data, and it is written to meet the Singapore Personal Data Protection Act 2012 (the PDPA) as amended.

The organisation responsible for your personal data is [To be confirmed before publication], at 33 Mohamed Sultan Road, #03-04, Singapore 238977.

This policy covers this website. It does not cover any other website we link to, including publications that feature our work.

Section 11 of the PDPA requires us to designate an individual responsible for our compliance and to publish their business contact information. Ours is:

[To be confirmed before publication]

Write to them about anything in this policy, to ask what data we hold about you, to correct it, or to complain. We answer within 30 calendar days, or write within 30 days telling you when we will.

We collect personal data only when you give it to us. There is no account to create and nothing to buy on this website.

If you send an enquiry through our contact form, we collect your name, your email address, your subject line and your message.

If you complete our fit-out enquiry form, we collect your name, your email address, and optionally your telephone number, together with your answers about the project: its type, the size of the space, the scope of work, your budget range, your intended start date, your style preferences, whether others are involved in the decision, and anything you add in your own words.

If you subscribe to updates, we collect your name, your email address, your mobile number if you choose WhatsApp, and which of those channels you have chosen.

We do not ask for your NRIC or FIN, and you should not send it to us.

Every field above is one you fill in yourself. We do not buy personal data, and we do not collect it from anywhere else.

Like every website, this one is served by computers that receive your IP address, your browser type and the page you asked for. That is how a page reaches you and we cannot switch it off.

We also load Google's tag manager, which means Google receives that same information. It currently carries no measurement tags, so nothing is being measured today, and if that changes it will only run for visitors who have agreed.

This website sets no cookies of its own.

Two things are kept in your browser's own storage, on your device, and never sent to us:

• Your answer to the cookie notice, so we do not ask again on every page.
• A typographic preference, used by our team when trying type styles. Visitors do not see this control.

Third parties set their own cookies in two places. Our videos are served from Supabase, which sets a short-lived cookie to tell people apart from bots. Where a press article opens in a panel on our page, that publisher's own cookies and tracking apply, and their policy governs, not ours.

We use personal data only for the purposes below, and we will ask you again before using it for anything else:

• To answer your enquiry and to discuss a possible project with you.
• To prepare a proposal, a quotation or an appointment, where you have asked for one.
• To send you studio news and new projects, if you have asked to receive them.
• To keep records we are required by law to keep.

We do not use your data to make automated decisions about you, and we do not profile you.

We rely on your consent, given when you submit a form. Marketing is asked for separately and is never a condition of enquiring: you can send us an enquiry without agreeing to hear from us again.

You may withdraw consent at any time by writing to our Data Protection Officer, or by using the unsubscribe link in any update we send. We will act on it and tell you what it means in practice. Withdrawing consent to marketing does not withdraw an enquiry already in progress.

Where the law allows us to act without consent, for example to respond to something you asked for, we do so only to the extent the PDPA permits.

We do not sell your personal data, and we do not trade it.

These service providers process it on our behalf, under contracts requiring them to protect it to the standard the PDPA requires:

• Resend, United States, which delivers our email. Your enquiry and your subscription pass through and are stored on their systems.
• Vercel, United States, which hosts this website. Our functions run in Singapore.
• Supabase, Singapore, which stores the photographs and films on this site.
• Google, United States, whose tag manager this site loads.

Our marketing partner Zelix Labs is copied on subscription notifications so that they can maintain this website on our behalf.

We also disclose personal data where the law requires it, or to our professional advisers where necessary.

Some of the providers above are in the United States, so your personal data is transferred there and stored there. This is happening now, not something that might happen later.

Section 26 of the PDPA requires us to satisfy ourselves that your data receives a standard of protection comparable to Singapore's. We rely on our contracts with these providers, which bind them to protect it to that standard and name the countries involved.

You may ask our Data Protection Officer for more detail about these arrangements.

We keep personal data only as long as we need it for the purpose it was given, or as long as the law requires.

• Enquiries that do not become projects: [To be confirmed before publication]
• Project records: for the life of the project and afterwards for as long as our professional and tax obligations require.
• Subscriptions: until you unsubscribe, and then only what we need to honour that.

When a purpose ends and no law requires us to keep it, we delete it or make it anonymous.

We protect personal data with measures appropriate to how sensitive it is. This website is served only over an encrypted connection, our email provider encrypts data in transit and at rest, and access to enquiries is limited to the people who need it.

No transmission over the internet is completely secure, and we do not claim otherwise. Please do not send us sensitive personal data through a web form.

Part 6A of the PDPA requires us to assess any data breach and to notify where the law demands it. If a breach is likely to cause you significant harm, or affects 500 or more people, we notify the Personal Data Protection Commission within three calendar days of concluding that it is notifiable, and we notify you as soon as practicable unless the Commission directs otherwise.

Under the PDPA you may:

• Ask what personal data we hold about you, and how we have used or disclosed it in the past year. We answer within 30 calendar days, or tell you within 30 days when we will. A fee may apply, and we will tell you before charging it.
• Ask us to correct it if it is wrong or incomplete. We correct it and tell anyone we passed it to, unless there is a lawful reason not to.
• Withdraw your consent, as described above.

The PDPA does not give a general right to have data erased, and we would rather say so than imply otherwise. Where we no longer need something, we delete it under the section above; where you withdraw consent, we stop using it. If you want something removed, ask, and we will tell you honestly what we can and cannot do.

A small number of exceptions in the PDPA let us refuse a request. If one applies we will tell you which, and why.

Write to our Data Protection Officer first. We will acknowledge you and aim to resolve it within 30 days.

If you are not satisfied, you may complain to Singapore's Personal Data Protection Commission at pdpc.gov.sg.

This website reads in eight languages and we welcome enquiries from anywhere. Our operations and our data protection obligations are Singaporean, and this policy is governed by Singapore law.

If you are in the European Union or the United Kingdom and want to know how we handle your data, write to our Data Protection Officer and we will answer.

We will update this page when our practices change, and the date below is the date of the version you are reading. If a change materially affects how we use data you have already given us, we will ask you before it takes effect.

K2SD Group

33 Mohamed Sultan Road, #03-04, Singapore 238977

Telephone +65 6917 7275

Email concierge@k2sd.co

Data Protection Officer: [To be confirmed before publication]

Effective [To be confirmed before publication]. Last updated [To be confirmed before publication].