Personal data protection

Clickvault Nest Pte. Ltd. ("we", "us", "our") respects your privacy and is committed to protecting personal data in accordance with the Personal Data Protection Act 2012 (PDPA) of Singapore. This policy explains what personal data we collect, why we collect it, how we use and disclose it, and the rights available to you.

This policy applies to personal data collected through clickvaultnest.pro (the "Site"), email and telephone correspondence with our studio, in-person visits to our premises at 12 Jalan Pinang, and any other channel where we interact with you in a professional capacity. It does not apply to third-party websites linked from our pages, which operate under their own privacy terms.

1. Data Protection Officer

Our Data Protection Officer (DPO) oversees compliance with the PDPA and handles privacy-related enquiries, access requests, and complaints. You may contact the DPO at [email protected]. Postal correspondence may be sent to Clickvault Nest Pte. Ltd., 12 Jalan Pinang, #03-02, Singapore 199139, marked for the attention of the Data Protection Officer.

We aim to acknowledge privacy correspondence within five business days and to provide substantive responses within thirty days, unless an extension is permitted under the PDPA.

2. Scope and roles

For most processing activities described in this policy, Clickvault Nest Pte. Ltd. acts as an organisation responsible for personal data under the PDPA. Where we process personal data on behalf of clients during studio engagements—such as stakeholder lists supplied for campaign development—we act in accordance with contractual instructions and confidentiality obligations set out in engagement letters.

This policy covers data about website visitors, prospective clients, current and former clients, suppliers, and individuals who visit our studio. It does not cover anonymised or aggregated data that cannot reasonably identify an individual.

3. Personal data we collect

3.1 Website visitors

When you browse the Site, our hosting infrastructure may automatically record technical information including your IP address, browser type and version, device type, operating system, referring URL, pages viewed, and timestamps of requests. This information is collected through server logs and essential cookies necessary to operate the Site and remember your cookie consent choice.

We do not operate analytics cookies on clickvaultnest.pro. We do not use third-party advertising trackers, social media pixels, or behavioural profiling tools on this Site. If this changes in future, we will update this policy and request consent where required before enabling such technologies.

3.2 Correspondence and briefings

When you email, telephone, or otherwise contact us, we collect your name, organisation, job title where provided, email address, telephone number, and the content of your message. If you arrange a studio visit, we may record your name, visit time, and host contact for security and scheduling purposes.

We do not operate contact forms on the Site. Enquiries are initiated by you through your own email client or telephone, which means you control what personal data you choose to include in your message.

3.3 Client engagements

During studio engagements we may process additional personal data including billing contacts, approval stakeholders, briefing participants, and content that identifies individuals (photographs, quotations, testimonials, or case references). The scope of such processing is defined in proposals, engagement letters, and confidentiality agreements—not on this Site.

Client materials are stored in access-controlled systems with need-to-know restrictions. Project files are retained in accordance with the retention schedule in section 8 below.

4. Purposes of processing

We collect and use personal data for the following purposes:

• Operating, maintaining, and securing the Site and our internal systems
• Recording and honouring your cookie consent preferences
• Responding to enquiries and scheduling briefings or studio visits
• Delivering marketing and communications services under written contract
• Managing accounts, invoicing, and professional correspondence
• Complying with legal obligations applicable in Singapore
• Protecting our rights, premises, and the safety of visitors and staff

We do not sell personal data. We do not use personal data for automated decision-making that produces legal or similarly significant effects on individuals. We do not send unsolicited marketing communications to individuals who have not consented or with whom we do not have an existing professional relationship reasonably related to our services.

5. Legal bases under the PDPA

Under the PDPA, we rely on one or more of the following bases depending on the processing activity:

• Consent — for optional functional cookies such as Google Maps embeds, and for any optional communications where consent is required
• Contractual necessity — to perform studio engagements you have commissioned and to administer the relationship
• Legitimate interests — to operate our business, respond to enquiries, secure our premises, and maintain the Site, balanced against your rights and reasonable expectations
• Legal obligation — where Singapore law requires us to retain or disclose personal data

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawing consent for functional cookies will prevent Google Maps from loading on the Site until you change your preference through the cookie banner or the Cookies page.

6. Google Maps and third-party embeds

Several pages on clickvaultnest.pro include an optional embedded map provided by Google Maps to help visitors locate our studio near Kampong Glam. The map is not loaded automatically when you first visit. It loads only if you accept functional cookies through our cookie banner, choose to load the map from a placeholder, or save custom preferences with functional cookies enabled.

When the Google Maps embed loads, your browser connects to Google's servers and Google may collect personal data such as your IP address, device information, and interaction with the map interface. That processing is governed by Google's privacy policy and terms of service, not by Clickvault Nest. We do not control Google's data practices and encourage you to review Google's documentation before enabling functional cookies if you have concerns about third-party processing.

We classify Google Maps as a functional cookie because it provides an enhanced location feature rather than being strictly necessary for the Site to operate. You may use the Site fully without ever enabling the map—the studio address and directions guidance on our Directions page remain available as plain text regardless of your cookie choice.

For detailed information about cookie names, retention periods, and how to change your preferences, see our Cookies page.

7. Disclosure to third parties

We may share personal data with the following categories of recipients, subject to appropriate safeguards:

• Hosting and infrastructure providers that process data on our instructions within Singapore or under contractual transfer protections
• Production partners, photographers, or specialist contractors involved in your project, bound by confidentiality obligations
• Professional advisers including legal counsel and accountants, when necessary for legitimate business purposes
• Public authorities, regulators, or courts when required by applicable law or valid legal process

Third parties are permitted to process personal data only for the purposes we specify and must protect it with appropriate security measures. A list of key sub-processors involved in website hosting is available on request to the DPO.

We do not disclose personal data to unrelated third parties for their own marketing purposes.

8. International transfers

Our primary systems and studio operations are located in Singapore. Where personal data is transferred outside Singapore—for example, to cloud services with regional redundancy or to an international client's systems—we take steps consistent with PDPA requirements to ensure that the receiving organisation provides a standard of protection comparable to that under the PDPA. This may include contractual clauses, assessment of the recipient's jurisdiction, and limiting transfers to what is necessary for the stated purpose.

If you are located outside Singapore and contact us, your data may be processed in Singapore as described in this policy.

9. Retention

We retain personal data only for as long as necessary for the purposes described in this policy, unless a longer period is required by law:

• Enquiry correspondence: up to twenty-four months after last contact, unless an engagement follows
• Cookie consent records: six months, after which the cookie banner reappears so you may review preferences
• Client project files: duration of the engagement plus seven years for legal, accounting, and dispute-resolution purposes
• Server access logs: rotated on a short cycle appropriate to security monitoring, typically not exceeding ninety days in identifiable form

When retention periods expire, personal data is securely deleted or anonymised so it can no longer identify you.

10. Your rights under the PDPA

Subject to exceptions under the PDPA, you have the right to:

• Request access to personal data we hold about you
• Request correction of personal data that is inaccurate or incomplete
• Withdraw consent where processing is based on consent
• Request information about how your personal data has been used or disclosed within the past year

Submit requests to [email protected]. We may need to verify your identity before fulfilling a request to protect against unauthorised access. We will respond within thirty days unless an extension is permitted by the PDPA, in which case we will inform you of the extension and reasons.

Withdrawing consent for optional processing (such as functional cookies) does not affect the lawfulness of prior processing. Some data may need to be retained despite a withdrawal where retention is required by law or for the establishment, exercise, or defence of legal claims.

11. Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the personal data we process. Measures include access controls limiting data to authorised personnel, encrypted transmission of web traffic through TLS, secure storage for client materials, and confidentiality training for staff and contractors with data access.

No method of transmission or storage is completely secure. If we become aware of a data breach that is likely to result in significant harm or is otherwise notifiable under the PDPA, we will notify affected individuals and the Personal Data Protection Commission as required.

12. Cookies and similar technologies

Our use of cookies and local storage is described in detail on the Cookies page, including categories (essential, functional, analytics), the relationship between consent and map embeds, retention periods, and instructions for managing preferences in your browser.

13. Children

The Site and our services are directed at business professionals. We do not knowingly collect personal data from individuals under eighteen years of age. If you believe we have inadvertently collected such data, please contact the DPO at [email protected] and we will take steps to delete it promptly.

14. Changes to this policy

We may update this policy to reflect changes in law, technology, or our practices. Material changes will be noted on this page with an updated "Last updated" date. Where changes affect processing based on consent, we will seek fresh consent where required. Continued use of the Site after non-material updates constitutes acknowledgement of the revised policy for website-related processing.

15. Complaints

If you are dissatisfied with our handling of your personal data, please contact the DPO first at [email protected]. We will investigate and respond in good faith. If the matter is not resolved to your satisfaction, you may lodge a complaint with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

16. Contact

Clickvault Nest Pte. Ltd.
12 Jalan Pinang, #03-02
Singapore 199139
Email: [email protected]
Telephone: +65 6446 2870