Privacy Policy

1. Scope of this Policy

This Policy applies to personal data that GBN PTE. LTD. processes through this website, through the corporate services helpdesk, and through the professional engagements we carry out for client companies. It covers data about directors, shareholders, company secretaries, employees, work pass applicants, authorised representatives, vendors and visitors who contact the desk.

The Policy does not apply to the practices of third parties that we do not control, including government registries, banks, immigration systems, or the separate systems of an audit firm that a client chooses to engage. When we pass information to a government authority because a filing requires it, the handling of that information after submission is governed by the rules of that authority and not by this document.

If you provide personal data about another person, for example a fellow director or an employee applying for a pass, you confirm that you have the authority to do so and that the person has been told how their data will be used under this Policy.

2. The Data Controller and the Developer

The data controller responsible for the processing described in this Policy is GBN PTE. LTD., a company with its registered office at 111 North Bridge Road #6-09 Peninsula Plaza, Singapore - 179098, Singapore (SG). The developer who maintains this website and the desk reference platform is GBN Group.

Questions about this Policy, requests to exercise a right, or concerns about how personal data has been handled should be addressed to the desk by email at helpdesk@gbngroup.autos or by telephone at +18149966804. Postal correspondence may be sent to the registered office address above. We aim to acknowledge privacy correspondence within one business day.

Where a client company engages us to act as its corporate secretary or registered office provider, we may process personal data both as a controller for our own compliance and as a service provider on behalf of that company. In the latter case the client company remains responsible for ensuring that its own notices to data subjects are accurate.

3. Personal Data We Collect

We collect only the personal data that the desk needs in order to deliver the service that has been requested. The categories below describe the range of data that may be processed depending on the engagement.

• Identity data: full name, former names, nationality, date of birth, gender, passport or identity document number, and residency status.
• Contact data: postal address, email address, telephone number and, where relevant, an emergency or alternative contact.
• Corporate data: company name, registration number, shareholding, directorships, officer appointments and signatures on resolutions.
• Financial data: bank account details for a client entity, salary information relevant to a work pass application, and bookkeeping records.
• Immigration data: education certificates, employment history, salary evidence and supporting letters for pass and visa filings.
• Communication data: the content of emails, contact form messages, telephone notes and meeting records created during an engagement.
• Technical data: internet protocol address, browser type, device information and pages visited on this website.

We do not seek sensitive categories of data such as medical information unless a specific filing requires it and the subject has given explicit consent. Where a filing does require supporting personal information, we explain the reason before it is collected.

4. How We Collect Personal Data

Most personal data reaches the desk directly from the person concerned or from the client company that has engaged us. A director may send identity documents for incorporation, an employee may provide certificates for a pass application, and an authorised representative may forward a signed resolution. Each of these is a direct collection, and we record the date and the purpose at intake.

We also collect data automatically when you visit this website. A web server records the request, the address it came from and the time. This information is used for security monitoring and for understanding which pages are useful, and it is not used to build a profile of an identifiable individual.

Finally, we may receive personal data from third parties such as a previous corporate secretary, an accountant, a bank, or a government registry in the course of transferring or correcting a company file. When that happens we confirm the source and the authority for the transfer before the data is used.

5. Purposes of Processing

Personal data is processed for the following purposes, each of which is tied to a service that the desk provides or to a legal obligation that the company carries.

• Preparing and lodging company incorporation applications and related consents.
• Maintaining statutory registers, minute books and corporate records.
• Preparing bookkeeping entries, management accounts and year-end financial statements.
• Assembling and submitting work pass, dependent pass and visa applications, renewals and appeals.
• Providing registered office services, receiving mail and forwarding it to the client.
• Preparing and lodging compliance filings, notifications and exemption applications.
• Responding to enquiries, raising tickets and managing the relationship with a client.
• Meeting anti money laundering, know your client and record keeping obligations.
• Protecting the website, the desk systems and the data held on them.

We do not use personal data for automated decision making that produces legal effects, and we do not sell personal data to any party.

6. Legal Basis for Processing

Depending on the circumstance, processing rests on one or more of the following bases. Performance of a contract applies when we carry out a service that a client has engaged us to provide. Compliance with a legal obligation applies when a statute or a regulator requires a record to be kept or a filing to be made. Legitimate interests applies to the ordinary running of a professional desk, including security monitoring and service improvement, where those interests are not overridden by the rights of the individual.

Consent applies where we ask for it, for example before sending a newsletter or before processing a special category of data. Consent may be withdrawn at any time by writing to helpdesk@gbngroup.autos, although withdrawal does not affect processing that was lawful before the withdrawal or processing that is required by law.

Where a filing is submitted to a government authority, the authority has its own legal basis for processing the information once it is received, and this Policy does not govern that subsequent handling.

7. Data Used in Corporate Filings

Many of our services require personal data to be submitted to a public registry. Company incorporation, changes of officers, changes of registered address, annual returns and share transactions all result in some information becoming part of a public record. Before we submit a filing, we tell the client which items will become public and which will remain confidential.

We do not submit personal data to a registry unless the engagement requires it, and we confirm the accuracy of names and identity numbers with the client before submission. Once a filing is accepted, the registry controls the public record and requests to correct or remove information must generally be made under the rules of that registry.

Where a client asks us to delay or withhold a filing to protect personal data, we explain any legal consequence of that choice, because an unfiled change can create a compliance problem that is more serious than the exposure the client was trying to avoid.

8. Cookies and Similar Technologies

This website uses a minimal set of cookies and browser storage. Strictly necessary cookies support navigation and security. Preference storage may remember a choice such as an open or closed panel. We do not run advertising cookies and we do not allow third party advertising networks to track visitors across this site.

You can block or delete cookies through the settings of your browser. Blocking strictly necessary cookies may affect how the site behaves, but it will not prevent you from reading the pages or contacting the desk. Where we introduce a new category of cookie that is not strictly necessary, we will ask for consent before it is set.

Server logs that record technical data are kept for a limited period for security and troubleshooting, after which they are deleted or aggregated so that they no longer identify an individual.

9. How We Share Personal Data

We share personal data only where it is necessary to deliver a service, to meet a legal obligation, or to protect the desk and its clients. The categories of recipient are limited and are described below.

• Government authorities and registries, including the company registry, the tax authority and the immigration authority, when a filing requires it.
• Banks, auditors and payment providers, where a client engagement or a payment requires the details.
• Professional advisers such as lawyers, tax specialists or valuers, engaged with the knowledge of the client.
• Technology providers that host the desk systems and the website, bound by confidentiality and security obligations.
• Any party that the client or the data subject directs us in writing to inform.

We do not sell personal data, and we do not rent mailing lists. Where a service provider processes data on our behalf, we require a written agreement that limits the use of the data to the service and imposes appropriate security measures.

10. Data Retention

We keep personal data only for as long as it is needed for the purpose for which it was collected, plus any period required by law. Corporate records are generally retained for the period that a company is required to keep its own registers and accounting records, because the desk may be asked to produce a record long after the relevant transaction has closed.

Where a record supports a filing that a regulator may inspect, the retention period follows the rule of that regulator. Where a record supports only a routine enquiry that did not lead to an engagement, it is deleted or archived after a short period. When a retention period ends, the data is securely destroyed or made anonymous so that it can no longer be linked to a person.

If you ask us to delete data that we are required to keep, we will explain the obligation and keep only what the law demands, restricted to that purpose.

11. How We Protect Personal Data

Security at the desk follows the same station discipline as the document bench. Access is limited to the people who need a record to do their work. Files are held in controlled systems with access logging, and paper records are kept in locked storage at the registered office. Documents are released only to a person whose authority has been confirmed.

We use encryption for data in transit where the service supports it, and we apply access controls and periodic review to the systems that hold client records. Staff and contractors who handle personal data are bound by confidentiality obligations and receive guidance on handling records correctly.

No system is perfectly secure, and no method of transmission is entirely free of risk. We work to reduce that risk to a level appropriate to the sensitivity of the data, and we review our measures as the service grows. If you believe a record has been exposed, contact the desk immediately at helpdesk@gbngroup.autos or +18149966804.

12. International Transfers

The desk is based in Singapore, and most personal data is processed within Singapore. Some technology providers may store data on servers located in another country. Where a transfer of personal data leaves Singapore, we take steps to ensure that the receiving party is bound by obligations comparable to those that apply locally, whether through a contract, a certification or another recognised safeguard.

Where a client instructs us to send data to an overseas adviser, a foreign bank or an overseas registry, we carry out that instruction on the understanding that the client has authority to give it and will inform the affected people.

If you would like to know whether a specific category of your data is transferred outside Singapore, write to the desk and we will explain the arrangement that applies.

13. Your Rights

Subject to the law that applies and to the exceptions that protect other people and legal obligations, you have the right to ask for access to the personal data that we hold about you; to ask us to correct data that is inaccurate or incomplete; to ask us to delete data that we no longer have a lawful reason to keep; to object to or restrict certain processing; and to ask for a copy of data in a portable format where that right applies.

To exercise a right, write to helpdesk@gbngroup.autos with enough detail for us to identify the record and confirm your identity. We may ask for proof of identity before releasing data, because releasing a record to the wrong person would be a privacy breach in itself.

We will respond within a reasonable period, and where a request cannot be granted we will explain the reason and any further step that is available to you. If you believe a request has been handled incorrectly, you may raise the matter with the desk again before approaching a regulator, and we will review the file with a fresh set of eyes.

14. Marketing Communications

We send service updates and regulatory reminders only where there is a lawful basis to do so. A client with an active engagement may receive reminders that relate to the services being provided, because those messages are part of the service rather than marketing. Promotional messages that are not tied to an engagement are sent only with consent.

Every promotional message includes a clear way to opt out. You can also opt out at any time by writing to helpdesk@gbngroup.autos or by calling +18149966804. Opting out of marketing does not stop essential service messages about a filing, an invoice or a compliance deadline.

We do not share contact details with third parties for their own marketing purposes.

15. Privacy for Children

The services of GBN PTE. LTD. are intended for companies and for adults acting in a professional capacity. This website is not directed at children, and we do not knowingly collect personal data from a person under the age of sixteen except where a dependent pass or a family related filing requires it and a parent or guardian has provided the information.

Where a filing does require information about a child, the data is used only for that filing, is kept with the parent file, and is retained only for as long as the filing and the law require. If you believe a child has provided personal data to the desk without appropriate consent, contact us and we will remove it.

16. Third Party Links and Services

This website may link to a government portal, a bank or another professional service. Those sites operate under their own privacy notices, and we are not responsible for how they handle personal data. We encourage you to read the privacy notice of any site before you submit personal data to it.

Where we use a third party tool on our behalf, such as an email provider or a document storage service, we choose providers that offer appropriate safeguards and we limit their use of the data to the service they provide. A list of the categories of provider is available on request.

17. Data Breach Response

If we become aware of a breach that affects personal data, we act quickly. The first step is to contain the incident and confirm what was affected. The second is to assess the risk to the people whose data is involved. Where a breach is likely to result in significant harm, we notify the affected individuals and any regulator that the law requires, and we set out what happened, what has been done and what the individual can do.

We keep a record of incidents and the steps taken, and we review each one to reduce the chance of a repeat. If you discover a possible breach, please report it to helpdesk@gbngroup.autos or call +18149966804 so that the response can begin immediately.

18. Changes to this Policy

We may update this Policy to reflect a change in the service, in the law or in the way the desk operates. When we make a material change we will update the date at the top of this page and, where the change is significant, we will provide a clearer notice through the website or by email to clients with an active engagement.

The version published on this page is the current version. We encourage you to review it periodically, particularly before you begin a new engagement or before you provide personal data about another person.

19. How to Contact Us

For any privacy question, request or concern, contact GBN PTE. LTD. at the registered office, 111 North Bridge Road #6-09 Peninsula Plaza, Singapore - 179098, Singapore (SG). You may also email helpdesk@gbngroup.autos or telephone +18149966804 during business hours, Monday to Friday, 9:00 to 18:00 Singapore time.

When you write, please include enough detail for us to identify the record and the service it relates to. If your request is about a company engagement, note the company name and registration number so that the file can be located quickly. We aim to acknowledge every privacy request within one business day and to resolve it within the period the law allows.

If you are not satisfied with the response, you may ask for the matter to be escalated to a senior member of the desk. We will review the file, explain the position and, where we have made a mistake, correct it.