How we handle personal data.

This policy applies to personal data we collect through our website, email, phone, and in-person visits when you enquire about services, engage us as a client, subscribe to updates, or interact with our cookie banner. It does not apply to third-party websites we link to, or to processing we perform strictly on behalf of clients under separate written agreements — where we act as a data intermediary, client instructions govern.

We comply with the Personal Data Protection Act 2012 (PDPA) of Singapore and reasonable industry practice for a marketing studio of our size. We review this policy annually and after material changes to our systems.

Contact and identity data: name, job title, company name, business email, business phone, billing address, and correspondence you send us.

Project data: briefs, brand materials, customer research, and assets you provide for engagements. This may include personal data about your customers or employees if you supply it — you are responsible for lawful collection and for informing those individuals.

Website technical data: IP address, browser type, device type, pages viewed, referral URL, and timestamps. Essential cookies store consent choices. Functional and analytics cookies load only with consent — see our Cookie Policy.

Visit data: appointment times, names of attendees, and notes you agree we may keep for follow-up.

We do not knowingly collect data from children under thirteen. We do not require NRIC or passport numbers for standard studio enquiries.

We use personal data to: respond to enquiries; perform contracts; send project files and invoices; maintain archives for stewardship; improve website security; comply with law; and, with consent, send occasional studio notes you opted into.

Under the PDPA, consent is our primary basis for marketing contact. Contract performance covers active engagements. Legitimate interests cover fraud prevention, internal reporting, and anonymised analytics where permitted. You may withdraw consent for marketing without affecting lawful processing before withdrawal.

We share data with: hosting and email providers (Singapore and regional data centres); accounting and legal advisers under confidentiality; translation or production partners when your project requires them; and authorities when law compels disclosure.

We do not sell personal data. We do not share enquiry emails with unrelated advertisers. Client lists are not rented.

If we use overseas processors, we require comparable protection through contract and assess transfer risk consistent with PDPA guidance.

Enquiry emails: twenty-four months after last contact unless an engagement follows. Contract and project files: duration of engagement plus twelve months, unless your contract specifies otherwise or law requires longer retention. Invoices and tax records: seven years. Website logs: ninety days. Cookie consent records: six months aligned with cookie lifetime.

After retention periods, we delete or anonymise data. Anonymised catalogue entries on our site contain no identifiable individuals.

We use access controls, encrypted transfer for file delivery, workstation locks in the studio, and staff training on phishing and confidential briefs. No method is perfect; we notify affected individuals and the Personal Data Protection Commission without undue delay if a breach likely causes significant harm, as required by law.

You may request access, correction, or deletion of personal data we control. You may withdraw consent for marketing or non-essential cookies. You may ask how we collected data and who received it. We respond within thirty days unless complexity requires extension — we will explain why.

Contact [email protected] or write to the address above. Include enough detail to locate your record. We may verify identity before releasing data.

If you remain unsatisfied, you may contact the Personal Data Protection Commission in Singapore.

We send project mail without separate marketing consent because it relates to your engagement. Occasional studio notes — bay availability, open mornings — require opt-in. Every marketing email includes an unsubscribe link. Unsubscribe takes effect within ten working days.

We do not use automated decision-making that significantly affects you without human review. Website analytics, if enabled, aggregate trends and do not determine service eligibility.

Our site links to Gillman Barracks resources and tools such as Google Maps embeds. Those services process data under their own policies. The map iframe loads only when you view a page containing it; it is not used to profile visitors beyond Google's embed behaviour.

We post updates here with a revised effective date. Material changes to how we use client project data will also be communicated by email to active contracts.

Related documents: Terms of Use, Cookie Policy, Legal.

Privacy contact: [email protected] · Phone +65 6690 3847.

© 2026 Boost Forge Spark Pte. Ltd.

For organisations requiring a named contact, email [email protected] with the subject line DPO enquiry. A director handles data protection matters directly — we are a small studio without a separate outsourced DPO function.

When you supply customer testimonials, survey results, or employee quotes, you confirm you have authority to share them. We may redact names in portfolio samples. If you require destruction of all copies after engagement, specify in your contract — default retention applies otherwise.

We sometimes reuse anonymised sentence structures in training internal staff — never identifiable client text without permission. Proof wall tickets on the website are rewritten from real notes with identifying nouns removed.

Clients outside Singapore may transfer personal data to us for project purposes. We process according to this policy and your instructions. If GDPR or other regimes apply to you, we assist with reasonable processor terms in contracts. Website visitors from the EU receive the same consent banner choices — no pre-ticked non-essential cookies.

Video calls may route through providers whose servers sit outside Singapore. We choose vendors with published security statements and disable recording unless you request minutes.

Our services target business clients. If a minor contacts us accidentally, we delete the enquiry. Visitors using public Wi-Fi in Gillman Barracks should know open networks carry risks unrelated to our site — use mobile data for confidential email if needed.

We do not participate in advertising networks that profile visitors across unrelated sites. If that changes, this policy and the cookie banner will update first.

Employee access to client data is limited by role — production staff do not open finance mail; finance does not edit narrative files. Laptops encrypt at rest; studio desktops lock when the roll gate closes.

Incident logs are kept for twenty-four months. Lessons learned feed into staff notes, not public posts.

Data portability requests receive deliverables in common formats — PDF, DOCX, CSV where applicable — within reasonable technical limits. We cannot export proprietary layout templates owned by us unless your contract assigns them.

We may compile anonymised statistics about enquiry volumes and project types for internal planning. Statistics never identify individuals or clients without consent. Published blog posts — if we write them — aggregate trends only.

Training recordings of internal workshops may include redacted client examples. Staff may not download client folders to personal devices; remote access uses VPN where required by client contract.

Whistleblower reports about data mishandling go to [email protected] with subject Integrity. Directors review within five working days.

Hosting provider stores website files in Singapore-region data centres with ISO-aligned controls. Email provider processes business correspondence metadata. Accounting software stores invoice names and addresses. None may use your data for their own marketing.

We review processors annually and terminate unused accounts. Client project folders use separate encrypted storage with access logging enabled.

Penetration testing is not continuous but we patch operating systems monthly and enable automatic security updates on studio machines.

Vendors sign confidentiality terms before receiving client materials. Translators delete source files thirty days after delivery unless retention is requested.

Backups encrypt at rest and restore-tested twice yearly. Backup retention mirrors active project retention unless legal hold applies.

We do not use automated profiling to decide whether to accept clients. Enquiries are read by humans. Spam filtering may auto-delete obvious bulk mail without storing content.

Accounting reconciliation uses spreadsheet formulas — not AI — to match invoices. Any future tool change will be noted here before deployment.

Physical visitor logs at the roll gate record name and time for security — destroyed after ninety days unless an incident requires retention. Logs are not used for marketing.

Questions about this policy: [email protected]. Response target thirty days; complex requests may need extension with explanation.

Effective 14 August 2026 — archived copies of prior policies available on request for compliance audits.

We do not sell data — ever — full stop.

This policy is written in plain English for business readers — ask privacy@ if you need clarification.