PDPA Privacy Policy

1.Who We Are

SBC Expand Asia Pte Ltd is the organisation responsible for the processing of personal data collected through the SBC Expand website.

Registered entity

SBC Expand Asia Pte Ltd

Registered address

60 Paya Lebar Road, #11-22, Paya Lebar Square, Singapore 409051

Data Protection Officer

Steven Tong

Email

dpo@startupbootcamp.org

2.What Personal Data We Collect

Depending on how you interact with SBC Expand, we may collect personal data including:

Founder Fit Check

• Name;
• Email Address;
• Company Name;
• Company Location;
• Asian markets being considered;
• Information about current business traction;
• Reasons for exploring expansion into Asia;
• previous Asia expansion activities; and
• information about your desired outcomes or objectives for an Asia go-to-market programme.

Agency Fit Check

• Name;
• Email Address;
• Organisation;
• Agency Type;
• Home market;
• Asian markets;
• Company information or number of companies supported;
• Existing support provided;
• Preferred engagement model;
• Decision timing; and
• Desired outcomes or success criteria.

We may also collect information contained in any free-text responses that you voluntarily provide.

Please do not provide sensitive or special-category personal data unless we specifically request it and there is a lawful basis for collecting it.

Technical information

When you visit our website, our hosting and infrastructure providers may process technical information associated with your visit, such as IP address and browser/request information, for purposes such as website operation, security and troubleshooting.

The website also uses an edge-based country lookup provided by our hosting infrastructure to determine the visitor’s approximate country. We use the resulting country information to determine whether to display a suggestion for the Korean-language version of the website.

The website does not use an external IP-geolocation service.

3.How We Collect Your Personal Data

We may collect personal data:

• when you voluntarily submit information through the Founder Fit Check or Agency Fit Check forms;
• when you contact us regarding SBC Expand or our services;
• automatically through website hosting and infrastructure when you visit the website; and
• from information that you provide to us through other authorised interactions.

The information submitted through the fit-check forms is processed using Google Apps Script and Google Sheets within SBC Expand’s Google Workspace environment. Access to the submission Sheet is restricted to authorised SBC personnel.

A notification is also sent to authorised SBC personnel when a new submission is received.

4.Why We Collect and Use Personal Data

We may collect, use and process your personal data for the following purposes:

1. responding to, handling and processing enquiries, requests, applications, feedback and other communications;
2. assessing whether SBC Expand’s services may be suitable for your company or organisation;
3. understanding your business, market and Asia expansion objectives;
4. contacting you regarding your enquiry and potential services or discussions;
5. managing our relationship with you;
6. providing and administering our services;
7. maintaining appropriate business and enquiry records;
8. operating, securing and maintaining our website and systems;
9. complying with applicable laws, regulations and legal obligations;
10. preventing misuse, fraud or security incidents where applicable; and
11. other purposes directly related to the purposes described above or for which you have provided the information.

We do not currently use the SBC Expand website for advertising, behavioural profiling, analytics, session recording or targeted marketing.

We do not sell your personal data.

5.Legal Basis for Processing Where GDPR Applies

Where the GDPR or UK GDPR applies to the processing of your personal data, we will rely on an applicable lawful basis under the relevant legislation.

Depending on the circumstances, these may include:

Taking steps at your request

We may process information that you provide through a fit-check or enquiry where processing is necessary to respond to your request or take steps at your request before entering into a business relationship.

Legitimate interests

We may process personal data where this is necessary for our legitimate interests, including:

• responding to and managing business enquiries;
• assessing potential business relationships;
• operating and securing our website and business systems;
• maintaining business records; and
• improving our website and services,

provided that those interests are not overridden by your rights and interests.

Legal obligations

We may process personal data where necessary to comply with legal or regulatory obligations.

Consent

Where consent is legally required for a particular processing activity, we will obtain consent and provide an appropriate means for you to withdraw it.

6.Disclosure of Personal Data

We may disclose personal data where necessary for the purposes described in this Notice.

This may include disclosure to:

• service providers that support our website, infrastructure and information systems;
• providers of Google Workspace services used to process and store form submissions;
• hosting and infrastructure providers such as Netlify;
• professional advisers or service providers where necessary;
• relevant governmental or regulatory authorities where required or permitted by law; and
• other parties where you have authorised or requested the disclosure.

For the fit-check forms, submissions are processed through Google Apps Script and stored in Google Sheets/Google Drive under the SBC Google Workspace environment.

Access to the submission Sheet is currently restricted to authorised SBC personnel.

We will not disclose personal data to unrelated third parties for their own independent marketing purposes without an appropriate legal basis.

7.International Transfers

SBC Expand is based in Singapore, but some service providers used to operate the website and process submissions may process personal data outside Singapore.

These may include infrastructure and service providers such as Google and Netlify.

Where personal data is transferred outside Singapore or outside the jurisdiction in which you are located, we will take appropriate measures required by applicable data protection law to ensure that your personal data receives an appropriate level of protection.

Where GDPR applies, we will use an applicable lawful transfer mechanism, such as an adequacy decision or appropriate contractual safeguards such as the European Commission’s Standard Contractual Clauses, where required.

8.Retention of Personal Data

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law.

Enquiries where we do not work together

Where an enquiry does not result in SBC Expand working with you, we intend to retain the relevant personal data for up to 24 months after our last contact.

Customers

Where you become a customer of SBC Expand, we intend to retain relevant personal data for the duration of the project or business relationship and for up to 24 months after the project or relationship ends, unless a longer period is required or permitted by law.

When personal data is no longer required, we will delete it or otherwise remove the means by which it can be associated with you, subject to legal or legitimate business requirements.

9.Protection of Personal Data

We take reasonable technical and organisational measures to protect personal data against unauthorised access, collection, use, disclosure, alteration, loss or destruction.

These measures include, where appropriate:

• minimising the personal data collected;
• restricting access to submission records to authorised personnel;
• using access controls within our Google Workspace environment;
• using HTTPS/TLS to protect information transmitted through the website;
• implementing website security controls; and
• reviewing and improving our information-security measures as appropriate.

No method of transmission over the Internet or electronic storage is completely secure. We therefore cannot guarantee absolute security.

10.Cookies and Browser Storage

SBC Expand does not currently use cookies for analytics, advertising, marketing or cross-site tracking.

Our production website audit identified no cookies being set by the SBC Expand application and no Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, session-recording or similar analytics technologies.

The website may use local storage and session storage in your browser to remember whether the Korean-language suggestion has been shown or dismissed. This is used for website functionality and is not used to track you across websites.

The website also uses Google Fonts to display fonts. Your browser may connect to Google’s servers to retrieve these resources.

We may update this section if the technologies used on the website change.

11.Your Rights

Depending on the laws applicable to you, you may have rights including:

• requesting access to personal data we hold about you;
• requesting correction or updating of inaccurate information;
• withdrawing consent where processing is based on consent;
• requesting deletion or cessation of processing where provided by applicable law;
• objecting to or requesting restriction of certain processing;
• requesting data portability where applicable;
• objecting to direct marketing; and
• lodging a complaint with an applicable data protection authority.

We will consider and respond to requests in accordance with the law applicable to the request.

For Singapore requests, we generally aim to respond as soon as reasonably possible and, where applicable, within the relevant statutory timeframe. For our operational process, we generally aim to process withdrawal requests within 10 business days and access/correction requests within 30 days, subject to the applicable law and complexity of the request.

The Singapore PDPC guidance supports responding to access/correction requests within 30 days or notifying the individual within that period if more time is required. PDPC

To exercise your rights, contact our DPO using the details below.

12.Accuracy of Personal Data

We generally rely on information provided by you.

Please inform us if your personal data changes or if you identify an error in information that we hold about you.

13.Complaints

If you have concerns about how SBC Expand handles your personal data, please contact our DPO first so that we can investigate and address the matter.

Depending on where you are located and which law applies, you may also complain to the relevant data protection authority, including:

• Singapore: Personal Data Protection Commission;
• Malaysia: Personal Data Protection Commissioner;
• Taiwan: the competent authority under the Taiwan Personal Data Protection Act;
• EU/EEA: your relevant supervisory authority; and
• UK: the Information Commissioner’s Office, where applicable.

The relevant authorities’ roles and jurisdiction may depend on your circumstances.

14.Automated Decision-Making and Profiling

SBC Expand does not currently use personal data collected through the SBC Expand website to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

We also do not currently use the website for behavioural profiling or targeted advertising.

15.Contact Us

For questions, complaints, withdrawal requests, access requests, correction requests or other privacy-related matters, please contact:

EU Representative

Where an EU representative is required under the GDPR, the representative’s details will be published here.

UK Representative

Where a UK representative is required under the UK GDPR, the representative’s details will be published here.

16.Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes to our processing activities, services, legal requirements or website technologies.

The latest version will be published on this page together with the date it was last updated.