Privacy Policy

01Personal data we collect

Information you provide:

• Contact details when you request access or contact us (e.g. name, email, company, message content).
• Account information if you register (managed through our authentication provider).
• Any other information you choose to send us.

Information collected automatically:

• Usage and device data (e.g. IP address, browser type, pages visited, referring URLs) collected via standard server logs[and cookies/analytics — see Section 6].

Information from third parties:

• Data from our authentication or service providers necessary to operate your account and deliver services.

We do not knowingly collect special-category or sensitive personal data.

02How we use personal data

• To respond to your inquiries and process access requests.
• To create and manage accounts and provide our services.
• To send service communications and, with your consent where required, marketing about our products.
• To operate, secure, maintain, and improve our website and services.
• To comply with legal and regulatory obligations.

03Legal bases (GDPR, where applicable)

We rely on: your consent; the performance of a contract with you; our legitimate interests (operating and improving our business, security, and direct B2B marketing); and compliance with legal obligations.

04Cookies and analytics

[Describe actual usage. If you use only essential cookies, state that. If you use analytics (e.g. a privacy-friendly analytics tool), name it, explain purpose, and provide opt-out / consent-banner details as required.]

05How we share personal data

We do not sell your personal data. We may share it with:

• Service providers / processors who act on our behalf (for example, email delivery, authentication, and cloud-hosting providers), bound by contract to protect it. [List your sub-processors here.]
• Authorities or third parties where required by law or to protect our rights.
• A successor entity in connection with a merger, acquisition, or sale of assets.

06International transfers

We are based in Singapore and our providers may process data in other countries. Where we transfer personal data internationally, we take steps to ensure a comparable standard of protection consistent with the PDPA and, where applicable, use appropriate GDPR safeguards (such as Standard Contractual Clauses).

07Retention

We keep personal data only as long as necessary for the purposes above or as required by law, after which it is deleted or anonymised. Inquiry and contact data is retained for up to 12 months from your last interaction with us. Account data is retained for the duration of your account plus 12 months after termination, except where a longer period is required by law (for example, tax, accounting, or regulatory record-keeping).

08Security

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

09Your rights

Under the PDPA, you may request access to and correction of your personal data and may withdraw consent at any time.

Under the GDPR (where applicable), you may have rights to access, rectification, erasure, restriction, portability, and to object to processing, and to lodge a complaint with your supervisory authority.

To exercise any right, contact us at support@masscrest.com. We may need to verify your identity before responding.

10Data Protection Officer

In accordance with the PDPA, our Data Protection Officer can be reached at support@masscrest.com or the registered address above.

11Changes to this policy

We may update this policy from time to time. Material changes will be notified by appropriate means.

12Contact

Questions about this policy or your personal data: Masscrest Pte. Ltd., support@masscrest.com, 160 Robinson Road, #14-04, SBF Center, Singapore 068914.