Privacy Policy
This Privacy Policy explains how CrowdService Pte. Ltd. (UEN 202699812M), a company incorporated in Singapore (“CrowdService”, “we”, “us” or “our”), collects, uses, discloses and otherwise processes personal data when you visit this website, contact us or otherwise interact with us. We process personal data in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”) and, where they apply to you, other data protection laws such as the EU and UK General Data Protection Regulation (“GDPR”).
Our software is used by investment and lending platform operators. Where we process personal data of our customers’ end users (investors, borrowers) on behalf of a customer, the customer is responsible for that data and its own privacy notice applies; we act as a data intermediary (processor) under a written agreement with the customer. This Privacy Policy covers only personal data that we process for our own purposes.
1. Personal data we collect
We collect the following categories of personal data:
- Contact and enquiry data that you provide through the call-back form, by email, Telegram or phone: your name, phone number, email address, company and position, and the content of your messages.
- Business relationship data about representatives of our customers, prospects and suppliers: contact details, communications, meeting notes and contract-related information.
- Technical data recorded automatically by our web server when you browse the website (server logs): IP address, browser and device type, operating system, referring page, the pages requested and the time of access, as well as the strictly necessary cookie described in section 7.
We do not intentionally collect sensitive personal data (such as identity document numbers, financial account details or health information) through this website. Please do not submit such data through the form.
2. How we use personal data
We use personal data for the following purposes:
- to respond to your enquiry, call you back, provide information about our products, services and pricing, and prepare proposals;
- to enter into and perform contracts with our customers and suppliers, including invoicing and account management;
- to operate and secure the website, including detecting and preventing abuse;
- to send you information about our products, events and updates, where you have agreed to receive it or where otherwise permitted by law (you can opt out at any time);
- to comply with legal and regulatory obligations, respond to requests from authorities, and establish, exercise or defend legal claims.
We will not use your personal data for a purpose that is materially different from those above without notifying you and, where required, obtaining your consent.
3. Consent and legal bases
Singapore (PDPA). We collect, use and disclose personal data with your consent, including consent deemed under the PDPA when you voluntarily provide your data for a purpose (for example, by submitting the call-back form so that we can contact you), or where the PDPA otherwise permits us to do so without consent (for example, for our legitimate interests after assessing that they outweigh any adverse effect on you, or to comply with law).
EU/UK (GDPR). Where the GDPR applies, we rely on: the steps you request before entering into a contract and the performance of a contract (responding to enquiries, serving customers); our legitimate interests in running and promoting our business and securing the website; your consent for marketing communications; and compliance with legal obligations.
Withdrawing consent. You may withdraw your consent at any time by contacting us at the details in section 12. We will process your request within a reasonable time and inform you of the likely consequences (for example, that we may be unable to respond to your enquiry). Withdrawal does not affect processing carried out before it.
4. Marketing messages and the Do Not Call Registry
We send marketing messages only with your consent or as otherwise permitted by law, and each message explains how to unsubscribe. We will not send marketing messages to a Singapore telephone number registered with the Do Not Call Registry unless you have given us clear and unambiguous consent in written or other accessible form.
5. Disclosure of personal data
We do not sell personal data. We share it only as needed for the purposes above, with:
- our affiliated companies and development team that help us deliver our products and services;
- service providers acting on our behalf, such as website hosting, email delivery for the call-back form, messaging and video-conferencing tools, and professional advisers (lawyers, accountants, auditors), who are bound by confidentiality and data protection obligations;
- a buyer, successor or investor in connection with a merger, acquisition, financing or sale of assets, subject to confidentiality obligations;
- courts, regulators, law enforcement and other authorities where required or permitted by law.
6. International transfers
We operate internationally, and personal data may be stored or processed outside Singapore (and outside your country), including in the Russian Federation and other countries where our team, hosting and service providers are located. Where we transfer personal data outside Singapore, we take appropriate steps to ensure that the recipient provides a standard of protection comparable to the PDPA, for example by binding contractual obligations. Where the GDPR applies, we use transfer safeguards recognised under it, such as the European Commission’s standard contractual clauses. You may contact us for more information about these safeguards.
7. Cookies
The website uses only one strictly necessary cookie, which remembers that you have closed or accepted the cookie notice so that it is not shown again. We do not use analytics, advertising or other tracking cookies, and we do not use third-party web analytics or session recording services on this website.
You can block or delete cookies in your browser settings; in that case the cookie notice may be shown again on your next visit.
8. Retention
We keep personal data only as long as it is needed for the purposes for which it was collected or as required by law. As a guide: enquiry data that does not lead to a business relationship is kept for up to 24 months after our last contact; customer and contract records are kept for the duration of the relationship and for up to 5 years afterwards (or longer where required by tax, accounting or other laws); website server logs are kept for a limited period for security purposes, not exceeding 12 months. We then delete or anonymise the data.
9. Protection of personal data
We protect personal data with reasonable administrative, technical and physical security arrangements, including access controls on a need-to-know basis, encrypted connections (HTTPS), secured VPN channels for administrative access, backups and confidentiality obligations for staff and service providers. No method of transmission over the internet is completely secure, but we work to protect your data against unauthorised access, collection, use, disclosure, copying, modification, disposal and loss.
10. Data breaches
If a data breach occurs, we will assess it promptly and, where it is notifiable under the PDPA (or other applicable law), we will notify the Personal Data Protection Commission and affected individuals within the required timeframes, and take steps to contain the breach and mitigate harm.
11. Your rights
Subject to applicable law, you may:
- request access to the personal data we hold about you and information about how it has been used or disclosed in the past year;
- request correction of inaccurate or incomplete personal data;
- withdraw your consent (section 3) and unsubscribe from marketing messages;
- where the GDPR applies, also request erasure, restriction of processing or data portability, and object to processing based on legitimate interests or for direct marketing.
We will respond to access and correction requests within 30 days; if we need more time, we will tell you when we expect to respond. We may charge a reasonable fee for an access request and will tell you in advance. We may need to verify your identity before acting on a request, and there are cases where the law allows us to refuse a request, in which case we will explain why.
If you are not satisfied with how we handle your personal data, please contact us first. You may also lodge a complaint with the Personal Data Protection Commission of Singapore (www.pdpc.gov.sg) or, where the GDPR applies, with the data protection authority in your country of residence.
12. Contact us and Data Protection Officer
For any questions, requests or complaints about this Privacy Policy or our handling of personal data, please contact our Data Protection Officer:
- Email: privacy@crowd-s.link
- Post: Data Protection Officer, CrowdService Pte. Ltd., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914
13. Children
This website is intended for businesses and is not directed at individuals under 18. We do not knowingly collect personal data from children.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be published on this page with a new “Last updated” date. Where changes are significant, we will take reasonable steps to inform you.