- We collect what we need to answer you, check who our clients are as the law requires, and do the work you engage us for.
- We never sell personal data, and we send marketing only if you agree.
- Identity documents go through a secure portal, never by email.
- We keep client due diligence records for five years after the relationship ends, because the law requires it. Enquiries that go nowhere are deleted after two years.
- You can ask to see, correct or delete your data. We reply within 30 days.
- Singapore's Personal Data Protection Act applies to everything we do. India's Digital Personal Data Protection Act also applies when we serve people in India.
1. Who we are
This policy explains how Northwise Pte. Ltd. ("Northwise", "we") handles personal data. We are the organisation responsible for your data under Singapore's Personal Data Protection Act 2012 (PDPA), and its data fiduciary under India's Digital Personal Data Protection Act 2023 (DPDP Act) where that Act applies.
Northwise Pte. Ltd. (UEN 202651421M)
60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051
Data protection officer: write to [email protected], marked for the attention of the Data Protection Officer
2. Whose data this covers
- Visitors to this website and people who use our tools.
- People who contact us or apply online.
- Directors, shareholders, beneficial owners, officers, employees and representatives of our clients and prospective clients.
- Nominee directors, partners, referrers and suppliers.
- Job applicants.
If you give us personal data about someone else, such as a fellow director or an employee for payroll, you confirm that you are allowed to and that you have told them how we will use it.
3. What we collect
| Category | Examples |
|---|---|
| Identity | Name, date of birth, nationality, passport, NRIC or FIN number, copies of identity documents |
| Contact | Email, phone, residential address, proof of address |
| Due diligence | Role, shareholdings, source of funds or wealth, results of sanctions, adverse media and politically exposed person screening |
| Engagement | Company records, board papers, accounting and tax information, payroll data such as salary and CPF, information for tax clearance |
| Billing | Invoices, payment records and bank details. Card details are handled by our payment provider; we never see full card numbers |
| Communications | Emails, messages, call notes and feedback |
| Website | Technical data your browser sends, such as IP address and browser type, when pages and fonts load. See the cookie policy |
We do not ask for more than the purpose needs. We do not collect sensitive data such as health or religion unless the law requires it for a specific service, and then only with your agreement.
4. Where we get it
- From you, through forms, email, calls and our client portal.
- From our clients, about their directors, shareholders and staff.
- From public sources, such as ACRA's register and official sanctions lists.
- From screening and identity verification providers we use for due diligence.
- From government agencies, banks, auditors and other advisers when we act for you.
5. Why we use it
| Purpose | Basis |
|---|---|
| Answering enquiries and preparing proposals | Your consent, given when you contact us |
| Customer due diligence and screening before and during an engagement | Legal obligation under the Corporate Service Providers Act 2024 and anti-money laundering rules |
| Delivering the services you engage us for, including filings with ACRA, IRAS and CPF Board | Performing our contract with you, and consent |
| Billing, payments and collecting fees | Performing our contract |
| Keeping records and meeting regulatory and tax requirements | Legal obligation |
| Security, fraud prevention and improving our services | Legitimate interests and business improvement, as the PDPA allows |
| Newsletters and updates on rule changes | Your consent only; you can withdraw it at any time |
| Recruitment | Your consent, given when you apply |
6. Who we share it with
We share personal data only when the purpose needs it:
- Government agencies such as ACRA, IRAS, CPF Board and the Ministry of Manpower, when we file for you. Some details filed with ACRA, such as officers' names and nationalities, appear on its public register.
- Banks, when you ask us to help open or maintain an account.
- Licensed firms we introduce, such as auditors, lawyers or fund managers, with your agreement.
- Service providers that host data or run systems for us: cloud hosting, email, our client portal, e-signature, payment processing and screening. Our website is hosted by Cloudflare, enquiry forms are delivered to our inbox by Web3Forms, and our email runs on Google Workspace. They act on our instructions under written contracts and must protect the data.
- Regulators, courts and law enforcement, when the law requires.
- A buyer or successor, if all or part of our business is transferred, on the same protections.
We do not sell personal data, and we do not share it with others for their own marketing.
7. Transfers outside Singapore
Some service providers store data on servers outside Singapore, and some engagements involve group companies or advisers in other countries, such as India. Before transferring, we make sure the data will be protected to a standard comparable to the PDPA, usually through contract terms. Preparation work for some engagements, such as bookkeeping, is carried out at our shared services centre in Gurugram, India, which we operate with a professional partner under a written agreement that protects your data to a standard comparable to the PDPA. We will tell you on request which countries are involved in your engagement.
8. How long we keep it
| Record | How long |
|---|---|
| Customer due diligence records | At least five years after we stop providing services to you, as the Corporate Service Providers Act requires |
| Accounting, tax and engagement records | At least five years after the end of the relevant financial year or engagement, or longer if the law requires |
| Enquiries that do not become engagements | Two years from our last contact |
| Job applications | One year, unless you agree to longer |
| Online application in progress | Stored only on your device until you submit or clear it |
When we no longer need data, we delete it securely or make it anonymous.
9. How we protect it
- Access only for people who need it, with two-factor sign-in on our systems.
- Encryption in transit, and at rest where our providers support it.
- Identity documents through a secure portal, never by email.
- Confidentiality obligations for everyone who works with us.
- A breach response plan. If a data breach is notifiable, we notify the Personal Data Protection Commission within three days of assessing it as notifiable, and tell affected people where the law requires. Where India's rules apply, we also inform the Data Protection Board of India and affected people as those rules require.
10. Your rights
You can ask us to:
- Access the personal data we hold about you and how it has been used in the past year.
- Correct data that is wrong or incomplete.
- Withdraw consent. We will explain what that means for any service, and stop processing that relies on consent. We may still keep records the law requires.
- Delete data we no longer need to keep.
If you are in India, under the DPDP Act you can also ask for a summary of your data and of who we have shared it with, ask us to complete or update it, nominate someone to act for you, and raise a grievance. We resolve grievances within 90 days, and you may then complain to the Data Protection Board of India.
If the EU or UK data protection laws apply to you, you have the rights those laws give, including objection and portability.
Write to [email protected]. We may need to verify your identity first. We reply within 30 days, or tell you within that time when we will. If you are not satisfied, you can complain to the Personal Data Protection Commission in Singapore.
11. Marketing
We send newsletters and updates only if you ask for them. Every email has an unsubscribe link. Before sending marketing messages to a Singapore phone number, we check the Do Not Call Registry as the law requires, unless you have given us clear consent.
12. Use of AI tools
We may use AI tools to help draft, check and summarise work. A qualified person reviews every output before it reaches you or an authority, and no decision about you is made by a machine alone. We use tools whose terms do not allow your data to train public models.
13. Children
Our services are for businesses and adults. Company directors must be at least 18. We do not knowingly collect personal data from children, except where a client gives us a minor's details as a shareholder, with a parent's or guardian's consent.
14. Changes to this policy
We will update this policy when our practices or the law change, and show the date and version at the top. For significant changes affecting clients, we will tell them directly.
Version 1.0, 1 November 2026: first published. Version 1.1, 12 November 2026: named our website host and form delivery service.