Privacy Policy

ICFC Pte Ltd, UEN 201402439E. Singapore. Draft for legal review before publication.

1. Who we are

This Privacy Policy explains how ICFC Pte Ltd (UEN 201402439E), referred to as ICFC, we or us, collects, uses, discloses and protects personal data through icfc.com.sg and its language versions, our learning platform at icfc.digital, our chat and messaging channels, and our audit, consulting and training services. We follow the Personal Data Protection Act 2012 of Singapore (PDPA), including its Do Not Call provisions, and the Spam Control Act 2007.

2. Our Data Protection Officer

You can contact our Data Protection Officer at nandhan@icfc.com.sg about this policy, your personal data, or any request or complaint. We acknowledge requests within [3] working days.

3. Personal data we collect

Contact details you give us, such as name, job title, organisation, email address, phone number and country.

Enquiry and engagement details, such as the services you ask about and messages you send through our forms, email, WhatsApp, Telegram, WeChat or our AI chat assistant.

Learner details, such as course bookings, attendance, assessment results and certificates of completion.

Identification numbers. We do not collect NRIC, FIN or passport numbers, or copies of identity documents, unless the law requires it, a funding agency requires it for a claim you ask us to make, or we need to verify identity to a high degree of fidelity. We tell you the reason when we ask.

Recruitment details you submit when you apply for a role or register as an associate consultant.

Technical data, such as IP address, device and browser type, pages visited and cookie identifiers, according to your cookie choices.

4. Why we use personal data

• To respond to enquiries and prepare proposals and quotations.
• To deliver audits, consulting and training, including scheduling, records and certificates of completion.
• To prepare documents you ask for to support a grant or funding application that you submit yourself.
• To run, secure and improve our website, learning platform and chat services.
• To send marketing messages, only on the channels you have agreed to, or where the law otherwise allows.
• To recruit staff and associate consultants.
• To meet legal, regulatory, audit and accounting obligations.

5. Consent and other legal grounds

We collect, use and disclose personal data with your consent, after telling you the purposes. Where the PDPA allows, we may also rely on deemed consent, for example where you give us your details to receive a service, or on an exception such as legitimate interests or business improvement. If we rely on legitimate interests, we assess the effect on you first and you can ask us about that assessment.

We do not make consent to marketing a condition of providing a service.

6. Withdrawing consent

You can withdraw consent at any time by writing to our Data Protection Officer or, for marketing, by using the unsubscribe link or replying STOP. We will tell you about any likely consequences, such as being unable to complete a course, and we give effect to withdrawals within a reasonable time, normally within 10 business days. Withdrawal does not affect data we must keep by law.

7. Marketing messages and the Do Not Call Registry

Email: we send marketing emails only to people who opted in. Every email identifies ICFC, includes a working contact address and an unsubscribe link, and we remove you within 10 business days of your request.

Calls and messages to Singapore numbers: ICFC does not check numbers against the Do Not Call Registry. We therefore send marketing calls, SMS, or messages on apps such as WhatsApp, Telegram or WeChat to Singapore numbers only if you have given clear and unambiguous consent, recorded in writing or another accessible form. Messages identify ICFC and give a contact that works for at least 30 days, and we never hide our calling number.

Messages that only answer your enquiry, confirm a booking or give service updates are not marketing messages.

We do not buy contact lists, use address-harvesting or dictionary-attack tools, or send messages to numbers generated at random.

8. Who we share personal data with

• Accredited certification bodies or scheme owners, when you engage an audit, assessment or certification pathway.
• Funding agencies, when you ask us to provide documents for your application or a course funding claim.
• Partners and associate consultants in Malaysia, China, Hong Kong and India, when they help deliver your engagement.
• Service providers that host or support our website, learning platform, email, chat, analytics and payments, under contracts that require them to protect the data and use it only for our purposes.
• Authorities, where the law requires.
• We do not sell personal data.

9. Transfers outside Singapore

Some providers and partners store or access data outside Singapore. Before transferring personal data overseas, we make sure the recipient is bound to protect it to a standard comparable to the PDPA, for example by contract, binding corporate rules, or a recognised certification such as the Global or APEC CBPR or PRP systems.

10. Cookies and similar technologies

Only strictly necessary cookies are set without your choice. Functional, performance and targeting cookies are used only if you allow them, and you can change your choice at any time through Cookie settings in the footer. Our Cookie Notice lists the cookies we use.

11. AI chat assistant

Our website chat assistant is an automated AI system, not a person. It loads only if you choose to start a chat and allow Functional cookies. Please do not share sensitive personal data in the chat. Chat transcripts are kept for [x] days to answer your query and improve the service, then deleted.

12. Access and correction

You can ask for a copy of your personal data in our possession or control, and for information about how it has been used or disclosed in the past year. We respond as soon as reasonably possible and within 30 days, or tell you within that time when we will respond. We may charge a reasonable fee for access and will tell you the amount first.

You can ask us to correct an error or omission. We correct it as soon as practicable and, unless you agree otherwise, send the corrected data to organisations we disclosed it to in the past year where they need it.

13. Accuracy, protection and retention

We take reasonable steps to keep personal data accurate and complete, and protect it with administrative, physical and technical safeguards, including access controls and encryption where appropriate.

We keep personal data only while needed for the purposes collected or for legal or business reasons, then delete or anonymise it. For example, we keep accounting records for at least 5 years as the law requires, training records as long as funding agencies require, and enquiries that do not lead to an engagement for [x] years.

14. Data breaches

If a data breach occurs, we act quickly to contain it and assess it. Where a breach is notifiable under the PDPA, we notify the Personal Data Protection Commission as soon as practicable and no later than 3 calendar days after assessing it as notifiable, and notify affected individuals where required.

15. Children

Our services are meant for organisations and working adults. If a learner is under 18, we take extra care, and for anyone under 13 we obtain consent from a parent or guardian.

16. Other websites

Our pages link to official and third-party websites. Their privacy practices are their own; please read their policies.

17. Changes and complaints

We may update this policy and will show the effective date of the latest version. If you are not satisfied with how we handle your personal data, please contact our Data Protection Officer first. You may also contact the Personal Data Protection Commission.

Effective date: [effective date to be set on publication].