Privacy

Privacy & Data Protection Policy

1. Introduction

Surgo Asset Partners Pte. Ltd. (“SAPPL”, “Surgo”, “we”, “us” or “our”) respects the privacy of individuals and is committed to protecting personal data in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”).

This Privacy & Data Protection Policy (“Policy”) explains how Surgo collects, uses, discloses, processes, protects and retains personal data in connection with our business activities, operations, websites, digital platforms, services and interactions with individuals and organisations.

This Policy generally applies to customers, clients, business contacts, representatives of corporate customers and organisations, suppliers, vendors, contractors, consultants, service providers, website visitors and other individuals who interact with Surgo.

Specific businesses, properties, projects, facilities or services managed or operated by Surgo may have additional privacy or data protection notices that supplement this Policy.

By providing personal data to us or interacting with us, you acknowledge that you have read and understood this Policy.

Where you provide us with personal data relating to another individual, you represent that you are authorised to provide such personal data to us and, where required, have obtained the individual’s consent for us to collect, use and disclose the personal data for the relevant purposes.

2. What Is Personal Data?

“Personal data” generally refers to data about an individual who can be identified from that data, or from that data together with other information to which we have or are likely to have access.

Depending on the nature of your relationship or interaction with Surgo, the personal data we may collect may include:

• name;
• contact number;
• email address;
• residential, mailing or business address;
• identification information where reasonably required;
• company, employment, designation and professional information;
• payment, billing and transaction information;
• information relating to contracts, quotations, projects, bookings or services;
• correspondence, enquiries, requests, feedback and complaints;
• records of meetings, communications and business interactions;
• photographs, video recordings or CCTV images where applicable;
• technical information relating to the use of our websites and digital platforms, including IP addresses, browser information, device information and cookies; and
• any other information voluntarily provided to us in connection with our business activities, operations or services.

We endeavour to collect only personal data that is reasonably necessary for the relevant purpose.

3. How We Collect Personal Data

We may collect personal data when you:

• visit or interact with our website or digital platforms;
• complete or submit an online form;
• contact or communicate with us;
• request information, quotations or proposals;
• make a booking, order or purchase where applicable;
• enter into or discuss a commercial relationship with us;
• engage or purchase our services;
• enter into an agreement, contract or other arrangement with us;
• correspond with us by email, telephone, messaging applications, social media or other communication channels;
• attend meetings, events, programmes or activities organised or managed by us;
• visit premises, properties or facilities managed or operated by us;
• participate in tenders, procurement exercises or vendor registration processes;
• provide products or services to us;
• interact with our employees, representatives, consultants or service providers; or
• otherwise voluntarily provide personal data to us.

We may also receive personal data from corporate customers, business partners, authorised representatives, service providers, government agencies, publicly available sources or other third parties where permitted by applicable law.

4. Purposes for Collection, Use and Disclosure

We may collect, use or disclose personal data for purposes including:

• establishing, managing and maintaining business relationships;
• responding to enquiries, requests and feedback;
• preparing and administering quotations, proposals, tenders and contracts;
• providing and administering our services;
• processing bookings, orders, transactions, invoices and payments;
• managing projects, properties, facilities and operations;
• communicating with customers, clients, vendors, contractors, consultants and business partners;
• performing customer, vendor, contractor and business-partner administration;
• evaluating and managing suppliers, vendors, consultants and contractors;
• managing procurement and tender activities;
• administering events, meetings, programmes and activities;
• facilitating access to premises, properties or facilities;
• maintaining safety and security;
• investigating incidents, complaints, disputes or suspected misconduct;
• maintaining business, accounting, tax, transaction and operational records;
• performing internal administration, analysis, reporting, auditing and business planning;
• improving our services, operations, systems, websites and customer experience;
• managing insurance matters, claims and risks;
• preventing, detecting or investigating fraud, security incidents or unlawful activities;
• establishing, exercising or defending legal rights or claims;
• complying with applicable laws, regulations, court orders and requirements of government, regulatory, law-enforcement or other competent authorities; and
• any other purpose reasonably related to the purposes stated above.

Where we wish to use personal data for a purpose that is materially different from the purpose for which it was originally collected, we will obtain consent where required by applicable law.

5. Disclosure of Personal Data

We do not sell personal data.

We may disclose personal data where reasonably necessary for the purposes described in this Policy, including to:

• our directors, employees and authorised personnel;
• related or associated entities where appropriate;
• customers and clients where necessary for the provision of services;
• professional advisers, including lawyers, accountants, auditors and insurers;
• banks, payment processors and financial institutions;
• IT, cloud-hosting, communications and technology service providers;
• consultants, contractors, suppliers and vendors;
• property, facility, security and operational service providers;
• event and programme partners;
• government agencies, regulatory authorities, law-enforcement agencies, courts or other competent authorities where required or permitted by law;
• prospective parties to a corporate transaction, restructuring or transfer of business, subject to appropriate safeguards; and
• any other party where disclosure is authorised or required by applicable law.

Where third-party service providers process personal data on our behalf, we will take reasonable steps appropriate to the circumstances to ensure that personal data is handled and protected appropriately.

6. Consent

Where consent is required under the PDPA, we will obtain consent before collecting, using or disclosing personal data for the relevant purposes.

Depending on the circumstances, consent may be expressly provided or may be deemed to have been provided in accordance with applicable law.

You may withdraw your consent to our continued collection, use or disclosure of your personal data by contacting our Data Protection Officer using the contact details set out below.

Upon receiving a withdrawal request, we will inform you of any likely consequences of withdrawing consent and process the request within a reasonable period.

Withdrawal of consent does not affect our right to continue collecting, using, disclosing or retaining personal data where permitted or required by applicable law.

Depending on the nature and extent of the withdrawal, we may be unable to continue providing certain services or fulfilling certain contractual or operational requirements.

7. Marketing Communications

Where permitted by applicable law, we may use contact information provided to us to communicate information about Surgo’s services, activities, events, projects or other matters that may be relevant to you.

Where consent is required, we will obtain the appropriate consent.

You may request to stop receiving marketing communications from us by using any unsubscribe facility provided in the communication or by contacting us.

Operational, contractual or transactional communications relating to an existing business relationship, enquiry, transaction, contract or service are not marketing communications and may continue to be sent where reasonably necessary.

8. Websites, Cookies and Digital Technologies

Our websites and digital platforms may use cookies and similar technologies to enable functionality, remember preferences, understand how visitors use our websites and improve our online services and user experience.

Cookies are small data files that may be stored on your device when you visit a website.

Depending on the technologies used, cookies may help us to:

• enable essential website functions;
• facilitate forms, enquiries, bookings or transactions;
• remember user preferences;
• understand website traffic and usage;
• analyse website performance; and
• improve our websites, digital services and user experience.

Some cookies or similar technologies may be provided by third-party services integrated with our websites, such as analytics, hosting, payment, booking or embedded-content providers.

You may generally control or disable cookies through your browser settings. However, disabling certain cookies may affect the functionality or availability of parts of our websites.

Where cookies or similar technologies collect personal data, such data will be handled in accordance with this Policy and applicable law.

9. Third-Party Websites and Services

Our websites or digital platforms may contain links to websites, platforms or services operated by third parties.

Those third parties may have their own privacy policies and data-protection practices. We do not control and are not responsible for the privacy practices of third-party websites or services that are not operated by us.

We encourage you to review the applicable privacy policies before providing personal data to third-party websites or services.

10. Accuracy of Personal Data

We will make reasonable efforts to ensure that personal data in our possession or under our control is accurate and complete where the data is likely to be used to make a decision that affects an individual or disclosed to another organisation.

You should ensure that personal data provided to us is accurate, complete and current.

If your personal data changes or you become aware that information held by us is inaccurate, please contact us so that the information can be updated where appropriate.

11. Protection of Personal Data

We take reasonable administrative, physical and technical measures to protect personal data in our possession or under our control against unauthorised access, collection, use, disclosure, copying, modification, loss, disposal or similar risks.

These measures may include, where appropriate:

• restricting access to personal data to authorised personnel;
• implementing password, authentication and access controls;
• maintaining appropriate IT and cybersecurity measures;
• maintaining procedures for handling personal data;
• providing appropriate guidance to personnel who handle personal data; and
• taking reasonable measures in relation to third-party service providers that process personal data on our behalf.

However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Retention of Personal Data

We retain personal data only for as long as it is reasonably necessary to fulfil the purposes for which it was collected or for legitimate business or legal purposes.

The appropriate retention period may depend on factors including:

• the nature of the personal data;
• the purpose for which it was collected;
• contractual and operational requirements;
• accounting, tax, insurance and audit requirements;
• dispute, investigation or claims-management requirements; and
• applicable legal or regulatory requirements.

When personal data is no longer required for business or legal purposes, we will cease retaining it or remove the means by which it can reasonably be associated with an identifiable individual.

13. Access and Correction

Subject to the PDPA and applicable exceptions, an individual may request:

• access to personal data about them that is in our possession or under our control;
• information about how such personal data has been used or disclosed within the applicable period; or
• correction of an error or omission in their personal data.

Requests should be submitted in writing to our Data Protection Officer.

We may require sufficient information to verify your identity and process your request.

Where permitted by law, we may charge a reasonable fee for an access request. If a fee applies, we will inform you of the estimated fee before processing the request.

We will respond to access and correction requests within a reasonable period and in accordance with applicable requirements.

14. Transfer of Personal Data Outside Singapore

Some of our service providers, technology platforms, cloud services or data-storage providers may process or store personal data outside Singapore.

Where personal data is transferred outside Singapore, we will take appropriate steps to ensure that the transfer is carried out in accordance with the PDPA and that the transferred personal data receives a standard of protection comparable to that provided under the PDPA, as required by applicable law.

15. CCTV and Security

CCTV or other security-monitoring systems may operate at Surgo’s offices, managed properties, facilities, projects or other locations where applicable.

Such systems may be used for purposes including safety, security, access control, incident management, crime prevention and protection of individuals and property.

Images or recordings may be used or disclosed where reasonably necessary to investigate incidents, manage claims or disputes, enforce applicable policies, protect individuals or property, or comply with legal and regulatory requirements.

Access to such recordings will be restricted to authorised persons and other parties where disclosure is permitted or required.

16. Personal Data Breaches

We maintain processes for assessing and responding to suspected or confirmed personal data breaches.

Where a data breach is subject to notification requirements under the PDPA, we will notify the Personal Data Protection Commission and/or affected individuals as required by applicable law.

We may also take appropriate measures to contain, investigate and remediate a data breach and reduce the risk of further harm.

17. Specific Businesses, Properties and Operations

Surgo may manage, operate or provide services in relation to businesses, properties, facilities, projects or other operations that collect or process personal data for purposes specific to those activities.

Where appropriate, a separate or supplementary privacy or data protection notice may be provided for such an operation.

Any such notice should be read together with this Policy. Where there is an inconsistency concerning a specific activity or service, the more specific notice will apply to that activity or service to the extent of the inconsistency.

18. Employees, Job Applicants and Internal Personnel

Surgo may collect, use and disclose personal data relating to employees, prospective employees, interns, consultants and other personnel for employment, engagement, human-resource, administrative, payroll, regulatory, security and related purposes.

Additional notices, policies or consent provisions may apply to such individuals and may be provided separately as part of the relevant employment, recruitment or engagement process.

19. Changes to This Policy

We may update this Privacy & Data Protection Policy from time to time to reflect changes in our business activities, operations, websites, technology, legal requirements or data-protection practices.

The latest version may be published on our website or otherwise made available upon request.

Any revised Policy will take effect from the date stated in the updated version unless otherwise specified.

20. Contact and Data Protection Officer

If you have any questions or feedback about this Policy, wish to make an access or correction request, withdraw consent, or raise a concern regarding the handling of your personal data, please contact:

Leonard Chin

Data Protection Officer
Surgo Asset Partners Pte. Ltd.

Address: 100 Tagore Lane, Singapore 787540
Email: dpo@surgo.sg

Please include sufficient information in your request to allow us to identify you and understand the nature of your request.

We will review and respond to data-protection enquiries and complaints within a reasonable period.

Last Updated: May 2026