Privacy Policy

This Privacy Policy explains how Orchid Stratos Pte. Ltd. ("Orchid Stratos", "we", "us", or "our") collects, uses, discloses, and protects personal data in connection with our website and consulting services. We are committed to handling personal data responsibly and in accordance with Singapore's Personal Data Protection Act 2012 (PDPA) and its associated regulations.

Please read this policy carefully. By using our website or engaging our services, you acknowledge that you have read and understood this policy.

1. Who we are

Orchid Stratos Pte. Ltd. is a business consulting firm registered in Singapore. Our registered address is 9 Penang Road, #11-06, Park Mall, Singapore 238459. We provide brand, supply chain, and digital maturity consulting services to businesses primarily operating in Singapore and the wider Asia-Pacific region.

For the purposes of data protection law, Orchid Stratos is the data controller in respect of personal data collected through this website and our consulting engagements.

2. Data we collect

Information you provide directly

• Name and job title
• Business name and address
• Email address and telephone number
• Information provided in enquiry or contact forms
• Correspondence and communications with our team
• Information shared during consulting engagements (which may include confidential business data governed separately by engagement terms)

Information collected automatically

• IP address and approximate geographic location
• Browser type, version, and operating system
• Pages visited and time spent on our website
• Referring URL and exit pages
• Device identifiers
• Cookie data (see Section 9)

3. How we use your data

We use personal data for the following purposes:

• Responding to enquiries and communicating with prospective clients
• Delivering consulting services under a client agreement
• Sending relevant updates or service information where you have indicated an interest
• Improving the content and functionality of our website
• Analysing how visitors use our site to understand what is useful
• Complying with legal and regulatory obligations
• Managing our business operations and records

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

4. Legal basis for processing

We collect and use your data under the following legal bases as recognised by the PDPA:

• Consent — where you have given us clear consent to process your data for a specific purpose (e.g. signing up for communications)
• Contractual necessity — where processing is required to fulfil a consulting engagement you have entered into with us
• Legitimate interests — where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights
• Legal obligation — where we are required to process data to comply with a legal duty

5. Sharing your data

We do not sell personal data to third parties. We may share data in the following circumstances:

• Service providers — third parties who assist with website hosting, analytics, email delivery, or IT services, bound by appropriate data processing agreements
• Professional advisers — lawyers, accountants, or auditors where necessary for compliance or dispute resolution
• Regulatory authorities — where required by Singapore law or by a valid legal process
• Business transfers — in the event of a merger, acquisition, or sale of assets, with appropriate notification

Where data is transferred outside Singapore, we take steps to ensure that appropriate safeguards are in place consistent with the PDPA's requirements on overseas transfers.

6. Data retention

We retain personal data for as long as reasonably necessary for the purposes for which it was collected, or as required by applicable law. In practice:

• Enquiry and contact data: up to 24 months from last contact, unless a consulting engagement follows
• Engagement-related data: up to 7 years from project close, in line with general record-keeping requirements
• Website analytics data: typically 26 months in aggregate form

When data is no longer needed, we delete or anonymise it securely.

7. Your rights

Under the PDPA and applicable data protection law, you have the following rights:

• Access — the right to request a copy of the personal data we hold about you
• Correction — the right to request correction of inaccurate or incomplete data
• Withdrawal of consent — where processing is based on consent, the right to withdraw it at any time
• Data portability — where applicable, the right to receive data in a structured, commonly used format
• Objection — the right to object to processing based on legitimate interests

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 13. We will respond within 30 days. We may need to verify your identity before processing a request.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include access controls, encrypted communications where applicable, and regular review of our data handling practices.

No transmission over the internet can be made entirely secure. If you have reason to believe that your interaction with us has been compromised, please notify us promptly.

9. Cookies

Our website uses cookies to support basic functionality, measure site usage, and (where consent is given) deliver relevant marketing. A full description of the cookies we use and how to manage them is available in our Cookie Policy.

You may adjust your cookie preferences at any time via the consent tool on our website.

10. Third-party services

Our website may use third-party services including Google Analytics, Google Maps, and advertising measurement tools. Each of these services operates under its own privacy policy. We encourage you to review those policies if you have specific concerns about how these providers handle data.

Where we use these services, we configure them in a manner intended to minimise unnecessary data collection.

11. Children

Our website and services are directed at business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us and we will remove it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of our website or services following a material update constitutes acceptance of the revised policy.

13. Contact and complaints

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact our Data Protection Officer:

If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commission Singapore (PDPC) at www.pdpc.gov.sg.