Data Protection & Privacy Policy

1. About this policy

Orovia Corporate Services & Advisory Pte. Ltd. (UEN 202545239G) (“Orovia”, “we”, “us” or “our”) provides corporate secretarial, accounting, tax, payroll, finance and advisory services. In the course of our work, we handle personal data, and we take that responsibility seriously.

This policy explains what personal data we collect, why we collect it, who we share it with and what rights you have. It applies to our clients and prospective clients, to the individuals connected with them (such as their directors, shareholders, beneficial owners, officers and employees), to job applicants, to our employees, and to visitors to our website.

We handle personal data in accordance with the Personal Data Protection Act 2012 (the “PDPA”) and other applicable law. In this policy, “personal data” means data about an individual who can be identified from that data, or from that data together with other information we have or are likely to have access to.

In some engagements we act as a data intermediary, meaning that we process personal data on behalf of and for the purposes of a client under a written contract, for example when we run payroll for a client’s employees. In those engagements the client decides what data is collected and why, and the client is responsible for responding to requests about that data. We remain responsible for protecting that data, and we will notify the client without undue delay if we have reason to believe that a data breach affecting it has occurred. If you are an employee, director or officer of one of our clients, please raise questions about your data with that client in the first instance, and we will support them in responding.

This policy is provided for information. It is not a contract and does not form part of any letter of engagement or contract of employment.

2. The personal data we collect

Depending on our relationship with you, we may collect:

• Identity and contact details: name, job title, employer, business and personal contact details, specimen signature, and identification documents such as NRIC, FIN or passport details.
• Corporate and ownership information: directorships, shareholdings, beneficial ownership and control, other offices held, nominee arrangements, and related party relationships.
• Due diligence information: information about source of funds and source of wealth, results of sanctions, politically exposed person and adverse media screening, risk assessments, and supporting documents.
• Financial and transactional information: bank account details, payment instructions, invoices, expense claims and transaction records.
• Employment and payroll information: salary, allowances, bonuses, Central Provident Fund (“CPF”) and statutory contributions, bank details, leave records, tax reference numbers and work pass details, where we provide payroll services to your employer or where you are employed by us.
• Correspondence: emails, letters, meeting notes, call records, any recordings, transcripts or summaries of calls and meetings, and other communications with us.
• Website information: IP address, browser type, device information, pages visited and similar technical information collected through our website.

We collect NRIC, FIN or passport numbers, and copies of those documents, only where the law requires it or where we need to establish your identity to a high degree of fidelity, consistent with the guidelines issued by the Personal Data Protection Commission on national identification numbers. We do not use NRIC or FIN numbers, in full or in part, as a password or other means of authenticating your identity.

We collect only what we need for the purposes described below. We do not seek sensitive personal data such as health information unless it is necessary for a specific service, for example administering statutory leave entitlements as part of a payroll engagement.

3. How we collect personal data

We collect personal data, where permitted:

• directly from you, when you contact us, engage us, complete our onboarding forms, submit an enquiry, schedule a consultation, communicate with us through messaging or social media channels, apply for a position or use our website;
• from our client, where you are a director, shareholder, beneficial owner, officer or employee of a client and the client provides your data to us so that we can perform the services;
• from public and commercial sources, including the Accounting and Corporate Regulatory Authority (“ACRA”) and other company registries, sanctions and screening databases, and publicly available media; and
• from third parties involved in an engagement, such as banks, auditors, other professional advisers and government agencies.

If you provide us with personal data about another individual, you confirm that you are authorised to do so and that the individual has been told how their data will be used, as described in this policy.

4. Why we use personal data

We use personal data for the following purposes:

• assessing and accepting new clients and engagements, including conflict checks;
• performing customer due diligence, verifying identity and beneficial ownership, screening against sanctions and other lists, and monitoring the relationship on an ongoing basis;
• providing the services set out in our letter of engagement, including preparing and making filings and submissions on our client’s behalf;
• communicating with you and responding to your queries;
• billing, collecting payment and maintaining our accounts;
• managing our business, including quality control, internal training, risk management, insurance and professional advice;
• maintaining our records and complying with our legal, regulatory and professional obligations, including under the Companies Act 1967, the Corporate Service Providers Act 2024, tax legislation and anti-money laundering and countering the financing of terrorism requirements;
• responding to requests, investigations and orders from regulators, tax authorities, law enforcement and the courts;
• recruiting, assessing and managing our own personnel;
• establishing, exercising or defending legal claims; and
• where you have agreed, sending you updates about our services and regulatory developments we think may interest you.

We rely on your consent where consent is required. In some cases we collect, use or disclose personal data without consent where the PDPA allows this, for example where it is required or authorised by law, where it is necessary for an investigation or proceedings, for evaluative purposes such as assessing a job application, or under the legitimate interests or business improvement exceptions. We rely on the legitimate interests exception mainly to screen and monitor clients and their connected persons for money laundering, terrorism financing and fraud risks, to carry out conflict checks, to keep our premises and IT systems secure, and to recover debts and deal with legal claims. Before doing so, we satisfy ourselves that our legitimate interests outweigh any likely adverse effect on you. We may also rely on deemed consent, including where the data is reasonably necessary to perform a contract with you, or a contract between us and another organisation that is entered into at your request or that a reasonable person would consider to be in your interest. Much of the due diligence information we collect is required by law, and we cannot accept or continue an engagement without it.

5. Who we share personal data with

We may disclose personal data, where permitted, to:

• government agencies and regulators, including, but not limited to, ACRA, the Inland Revenue Authority of Singapore, the CPF Board, the Ministry of Manpower, the Personal Data Protection Commission, the Suspicious Transaction Reporting Office, law enforcement and the courts;
• our client and its authorised representatives, where we hold your data in connection with services provided to that client;
• banks, auditors, lawyers, valuers, insurers and other professional advisers involved in an engagement;
• our service providers, including accounting, payroll, document management, communications, calendar booking, website hosting, analytics, screening, workflow automation, artificial intelligence and cloud service providers, who are required to protect the data where they process it on our behalf;
• our own insurers, insurance brokers and legal advisers, in connection with a claim, complaint or regulatory enquiry; and
• a prospective purchaser of our business or a party to a corporate transaction involving Orovia, subject to appropriate confidentiality protections.

We do not sell personal data, and we do not disclose it for any purposes other than those described in this policy or as required or permitted by law.

Where the law requires us to report a matter to a competent authority, we may be prohibited from telling you that we have done so.

6. Transfers outside Singapore

Some of our service providers store or process data outside Singapore. Where we transfer personal data overseas, we take reasonable steps to satisfy ourselves that the recipient is bound by legally enforceable obligations to protect the data to a standard comparable to the PDPA, as required by the Transfer Limitation Obligation. Those obligations may take the form of contractual terms requiring the recipient to protect the data to that standard, the recipient’s binding corporate rules, or a specified certification granted or recognised under the law of the country or territory to which the data is transferred.

You may ask our Data Protection Officer what safeguards apply to a particular transfer.

7. How we protect personal data

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the data we hold. These include access controls based on least privilege, multi-factor authentication, encryption of data in transit and at rest where appropriate, secure disposal, staff confidentiality obligations and training, and due diligence on our service providers.

No system can be guaranteed to be completely secure. If a data breach occurs that is likely to result in significant harm to affected individuals or is of a significant scale, we will notify the Personal Data Protection Commission and, where required, the affected individuals, in accordance with Part 6A of the PDPA.

8. How long we keep personal data

We keep personal data only for as long as it is needed for the purposes described above, or for as long as we are required to keep it by law. Records supporting customer due diligence, accounting records and tax records are generally kept for at least five years after the end of the engagement or the relevant transaction, and longer where a legal or regulatory requirement or an actual or potential claim requires it. When personal data is no longer required, we securely delete or dispose of it.

9. Your rights

Access

You may ask us for a copy of the personal data we hold about you and information about how it has been used or disclosed in the past year. We may charge a reasonable fee to cover the cost of responding, and we will give you an estimate before proceeding.

Correction

You may ask us to correct personal data that is inaccurate or incomplete. Where we make a correction, we will send the corrected data to organisations to which we disclosed the data in the past year, unless those organisations do not need the corrected data for any legal or business purpose. If we decide not to make a correction, we will annotate the data with the correction you requested.

Withdrawing consent

Where we rely on your consent, you may withdraw it at any time by giving us reasonable notice. We will tell you the likely consequences of doing so. Please note that we may be unable to continue providing services, and may have to end an engagement, if withdrawal prevents us from meeting our legal and regulatory obligations. Withdrawal does not affect data we are required by law to retain.

Marketing

You may ask us at any time to stop sending you marketing communications. We also comply with the Do Not Call provisions of the PDPA and the Spam Control Act 2007, and, where required, check the Do Not Call Register before sending marketing messages to Singapore telephone numbers.

How we handle requests

We may need to verify your identity, and the authority of anyone making a request on your behalf, before we respond. We will respond to an access or correction request as soon as reasonably possible, and normally within 30 days. If we need longer, we will tell you within 30 days when to expect our response. In limited circumstances the PDPA permits or requires us to reject an access request, for example where providing the data would reveal information about another individual, where the data is opinion data kept solely for an evaluative purpose (such as an assessment of a job application or an employee’s performance), or where it relates to an ongoing investigation or proceedings. Subject to the PDPA and the Personal Data Protection Regulations 2021, if we reject an access request we will generally notify you of the rejection and tell you why, and we will preserve a copy of the data concerned for the period the law requires.

10. Our website

Our website uses cookies and similar technologies to operate properly, maintain security and understand how the website is used. Where enabled, these technologies may also support analytics activities. They may collect information such as your IP address, browser type, device information, pages visited and interactions with the website. Some service providers may process this information outside Singapore.

Where required, we will provide appropriate information or choices concerning non-essential cookies. You may also adjust your browser settings to refuse or restrict cookies, although some parts of the website may then not work as intended.

Our website may contain links to or use services provided by third parties, including calendar booking, messaging and social media platforms. When you use those services, the relevant provider may process information under its own privacy policy and terms. Orovia does not control how an independent third party provider handles information through its own platform.

11. Contacting us

Our Data Protection Officer is responsible for overseeing our compliance with the PDPA. Please direct any question, request or complaint about personal data to:

Data Protection Officer
Orovia Corporate Services & Advisory Pte. Ltd.
8 Marina Boulevard, Level 11, Marina Bay Financial Centre Tower 1, Singapore 018981
Email: dpo@oroviacorp.com
Telephone: +65 6653 4526

We will look into any complaint and respond to you. If you are not satisfied with our response, you may raise the matter with the Personal Data Protection Commission.

12. Changes to this policy

We may update this policy from time to time. The current version is available on our website and takes effect from the date shown at the top of this page. Where a change is significant, we will take reasonable steps to bring it to the attention of affected individuals.