Privacy Notice
Version 3.0 · Effective date: 2 September 2026 · Supersedes the policy dated 12 July 2026, last updated 19 August 2026
Updated 2 September 2026. This notice replaces our previous privacy policy following the introduction of consent-based website analytics. A summary of what changed is in section 19.
In brief
- Luenya Solutions Pte. Ltd., trading as Proofdatum, is the controller of personal data collected through this website and in our dealings with clients, prospective clients and specialists.
- We collect only the personal data you give us through our enquiry, white-paper and specialist-network forms, plus limited technical data needed to run and protect the site and, with your consent, Google Analytics 4 measurement data.
- We do not sell personal data, we do not run advertising or social-media tracking, we do not profile you and we make no automated decisions about you.
- Analytics cookies are set only if you accept them; you can change your choice at any time using the "Cookies" control on every page.
- You can ask us to access, correct or delete your data, or object to how we use it, by writing to privacy@proofdatum.com. Response times and your escalation routes are set out in sections 13 and 17.
Contents
1. About this notice and who we are · 2. Who and what this notice covers · 3. Personal data we collect · 4. Where we get personal data from · 5. Why we use personal data and our legal basis · 6. What we do not do · 7. If you do not provide personal data · 8. Who we share personal data with · 9. International transfers · 10. How long we keep personal data · 11. Security · 12. Cookies and analytics · 13. Your rights · 14. Children · 15. Recruitment and specialist-network candidates · 16. Third-party links and platforms · 17. Complaints and how to escalate · 18. Contact details, Data Protection Officer and representatives · 19. Changes to this notice · Supplement A: Singapore (PDPA) · Supplement B: European Economic Area and United Kingdom (GDPR and UK GDPR) · Supplement C: other jurisdictions
1. About this notice and who we are
This privacy notice explains how Luenya Solutions Pte. Ltd. (Singapore UEN 202446064N), a company incorporated in Singapore with its registered office at 152 Beach Road, #23-01 Gateway East, Singapore 189721, collects, uses, discloses, transfers and protects personal data. Luenya Solutions Pte. Ltd. operates the Proofdatum completion assurance practice and the website at proofdatum.com. In this notice “Proofdatum”, “we”, “us” and “our” mean Luenya Solutions Pte. Ltd.
We are the controller (in Singapore terms, the organisation responsible) for the personal data described in this notice. We comply with the Singapore Personal Data Protection Act 2012 (PDPA) as our home law and, where they apply to you, the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and the data protection laws of the other countries in which we serve clients. Where these laws set different standards, we apply the higher standard to everyone.
This notice is written in plain language and is organised so that you can read the summary above, then go directly to the section you need. Jurisdiction-specific information is collected in the supplements at the end.
2. Who and what this notice covers
This notice covers personal data about the following people: visitors to proofdatum.com; people who contact us or request a Rapid Completion Assessment or other services through the site, by email, by telephone or by WhatsApp; people who request a white paper; people who apply to join our specialist network or otherwise apply to work with us; and individual contacts at our clients, prospective clients, partners and suppliers.
It does not cover project data, engineering records, completion dossiers or personnel information that a client provides to us under an engagement. For that information we act on the client’s instructions as a data intermediary (in GDPR terms, a processor) and the engagement contract governs how it is handled. Questions about that data should be directed to the client concerned.
Links to LinkedIn, WhatsApp, Google Maps and other third-party services lead to platforms that we do not control. Their own privacy notices apply once you leave our site (see section 16).
3. Personal data we collect
We collect personal data in five situations. The table shows what we collect in each.
| Situation | Personal data collected | Required or optional |
|---|---|---|
| Enquiry form (/contact/) or direct contact by email, phone or WhatsApp | Name, company, email address, phone or WhatsApp number, project or facility type, enquiry type, your message and any project information you include; our correspondence with you | Name, company, email, enquiry type and message are required to respond; phone and facility type are optional |
| White-paper request | Name, company, work email address, the paper requested; the fact and date of the request | All fields required to send the paper |
| Specialist-network application (/careers/) | Name, email address, phone number or LinkedIn profile, role interest and specialism, availability, years of completions experience, indicative day rate and currency, your message and the curriculum vitae you upload; our assessment notes and correspondence | CV, name, email, contact, role interest, availability, experience and message are required to assess you; day-rate fields are optional |
| Client, prospect, partner and supplier contacts | Business contact details (name, role, employer, work email, work phone), correspondence, meeting notes, engagement and billing records | Provided in the course of the business relationship |
| Website use | Technical data recorded by our hosting platform for security and operation (IP address, browser and device type, pages requested, timestamps, referring page); if you accept analytics cookies, Google Analytics 4 measurement data (see section 12); your cookie choice and a consent record (see section 12) | Technical data is generated automatically; analytics data only with your consent |
We do not ask for, and ask you not to send us, special categories of personal data (for example information about health, ethnicity, religion, political opinions, trade-union membership or sexual orientation), criminal-record information or national identification numbers. Please remove such information from any curriculum vitae before you upload it. If you include it anyway, we will treat it as provided with your explicit consent for the sole purpose of considering your application, and we will delete it as soon as it is not needed.
4. Where we get personal data from
Most of the personal data we hold comes directly from you, through the forms on this website or in correspondence and meetings. We also obtain limited business contact information from other sources:
- from your employer or colleagues, when they introduce you as a contact for a project or engagement;
- from publicly available professional sources, such as LinkedIn profiles, company websites and conference materials, when we identify people who are relevant to a project or who may be suitable specialists for our network;
- from referrals by members of our specialist network or by clients;
- from our service providers, which generate technical and analytics data as described in section 12.
Where we obtain personal data about you from a source other than you, we will tell you within a reasonable period, and at the latest when we first contact you, unless you already have the information or providing it would involve disproportionate effort.
5. Why we use personal data and our legal basis
The table sets out each purpose for which we use personal data, the legal basis we rely on where the GDPR or UK GDPR applies to you, and the corresponding position under the Singapore PDPA. Where we rely on legitimate interests we have considered and balanced those interests against your rights and freedoms; you can ask us for a summary of that assessment.
| Purpose | Personal data used | GDPR / UK GDPR legal basis | Singapore PDPA position |
|---|---|---|---|
| Responding to enquiries and requests for a Rapid Completion Assessment or other services | Enquiry data and correspondence | Legitimate interests (Art. 6(1)(f)): responding to a request you have made; where you are the prospective client, steps at your request before entering into a contract (Art. 6(1)(b)) | Consent given when you submit the form; where you act for a company, deemed consent by conduct and the legitimate interests exception (First Schedule, Part 3), on which we rely |
| Scoping, contracting, delivering, managing and invoicing engagements | Client and prospect contact data, engagement and billing records | Contract (Art. 6(1)(b)) with individual clients; legitimate interests (Art. 6(1)(f)) in serving corporate clients; legal obligation (Art. 6(1)(c)) for accounting records | Deemed consent by contractual necessity (s. 15(3)); legitimate interests exception; legal obligations |
| Sending a white paper you have requested and following up once on whether it was useful | White-paper request data | Legitimate interests (Art. 6(1)(f)): providing content you asked for and a single, relevant follow-up; you may object at any time | Consent given when you submit the request; legitimate interests exception for the follow-up |
| Assessing applications to our specialist network and maintaining the network | Application data, CV, assessment notes | Steps at your request before entering into a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in building a qualified network; explicit consent (Art. 9(2)(a)) for any special-category data you choose to include | Consent given when you submit the application; legitimate interests exception for assessment |
| Keeping your application on file for future opportunities beyond the standard retention period | Application data, CV | Consent (Art. 6(1)(a)), which you may withdraw at any time | Consent |
| Operating, securing and improving the website; detecting spam, abuse and attacks | Technical data; form submissions screened for spam | Legitimate interests (Art. 6(1)(f)) in a secure, reliable website; PECR / ePrivacy strictly necessary exemption for essential cookies | Legitimate interests exception; business improvement exception (First Schedule, Part 5) |
| Measuring how the website is used so that we can improve it (Google Analytics 4) | Analytics data as described in section 12 | Consent (Art. 6(1)(a)) obtained through the cookie banner, in line with Art. 5(3) of the ePrivacy Directive and PECR reg. 6 | Consent obtained through the cookie banner |
| Recording your cookie choice so that we can honour it and demonstrate compliance | Consent record (see section 12) | Legal obligation (Art. 6(1)(c), Art. 7(1)) and legitimate interests (Art. 6(1)(f)) | Legitimate interests exception |
| Complying with legal, regulatory, audit and professional obligations, and establishing, exercising or defending legal claims | Any of the above as relevant | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) | Required or authorised by law; legitimate interests exception |
| Keeping in touch with existing clients and specialists about our services, insights and events | Business contact data | Legitimate interests (Art. 6(1)(f)) in maintaining business relationships; you may object at any time and we honour every request | Deemed consent within an existing business relationship; we do not send marketing messages to Singapore telephone numbers and we do not operate marketing lists |
6. What we do not do
- We do not sell, rent or trade personal data, and we do not share it with anyone for their own marketing.
- We do not use advertising, retargeting or social-media tracking cookies or pixels, and we do not use Google Signals or advertising features in Google Analytics.
- We do not profile you or make decisions about you by automated means that produce legal or similarly significant effects. Every enquiry and every application is read and assessed by a person.
- We do not operate mailing lists or send unsolicited marketing, and we do not send marketing messages to Singapore telephone numbers within the scope of the Do Not Call provisions of the PDPA.
- We do not knowingly collect personal data from children (see section 14).
- We do not use personal data collected through this website to train artificial-intelligence models.
7. If you do not provide personal data
You can browse every page of this website, read our insights and view our capability descriptions without giving us any personal data. Personal data is needed only when you ask us to do something: respond to an enquiry, send a white paper or consider an application. The fields marked as required on each form are the minimum we need to act on your request; if you leave them blank we will not be able to respond. Optional fields help us respond more precisely but may be left empty.
8. Who we share personal data with
We share personal data only where necessary for the purposes in section 5, and only with the following categories of recipient. Our service providers act on our documented instructions, may use personal data only to provide their services to us and are contractually required to protect it.
| Recipient | Role | What they process | Location |
|---|---|---|---|
| Automattic Inc. (WordPress.com hosting, Jetpack, Akismet) | Website hosting, security, backups, form storage, spam screening and consent-record storage | All website data, form submissions, consent records and technical data | United States and global data centres; transfers covered by the EU and UK Standard Contractual Clauses |
| Google Ireland Limited / Google LLC (Google Analytics 4) | Website analytics, only if you accept analytics cookies | Analytics measurement data (section 12) | European Union and United States; Google LLC is certified under the EU-US Data Privacy Framework and its UK Extension |
| Elementor Ltd. (Elementor and Elementor Cookie Consent) | Website forms and cookie-consent software; cookie scanning of our public pages | Form submissions and consent records are stored on our website (hosted by Automattic); Elementor’s scanning service reads our public pages only | Israel, which the EU and the UK recognise as providing adequate protection |
| Microsoft Corporation and affiliates (Microsoft 365) | Email, calendar, document storage and collaboration | Correspondence, enquiry notifications, applications, engagement records | Microsoft’s global network; Microsoft Corporation is certified under the EU-US Data Privacy Framework and its UK Extension |
| Professional advisers (lawyers, accountants, auditors, insurers) | Advice, audit and insurance | Records relevant to the advice sought | Singapore and, where relevant, the country concerned |
| Members of our specialist network and associates engaged on a project | Delivery of an engagement, under confidentiality obligations | Client contact data needed to perform the work | Country of the project |
| Regulators, courts, law-enforcement and other public authorities | Where disclosure is required or authorised by law | Whatever the lawful demand requires | Country of the authority |
| A buyer or successor of our business | In the event of a merger, acquisition or reorganisation, under confidentiality obligations | Business records including contact data | Singapore |
We do not share personal data with any other third party. If we appoint a new service provider that handles personal data we will update this table.
9. International transfers
We are based in Singapore and our clients and specialists are in Europe, Africa and Asia, so personal data is transferred across borders as a normal part of our operations. Our website, email and analytics providers store and process data in the locations shown in section 8, principally the United States and the European Union.
Transfers out of Singapore. Before we transfer personal data outside Singapore we take the steps required by section 26 of the PDPA and the Personal Data Protection Regulations 2021 to ensure that the recipient is bound by legally enforceable obligations to protect the data to a standard at least comparable to the PDPA, through contract terms, the recipient’s own data protection law, or recognised certifications.
Transfers out of the European Economic Area and the United Kingdom. Where the GDPR or UK GDPR applies, we transfer personal data to countries outside the EEA or the UK only where one of the following applies: the European Commission or the UK Government has decided that the destination provides adequate protection (including transfers to Google LLC and Microsoft Corporation, which are certified under the EU-US Data Privacy Framework and the UK Extension to it, and transfers to Israel, where Elementor Ltd. is based); we have put in place the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, supported by a transfer risk assessment (this is the mechanism that covers our hosting provider, Automattic); or a specific legal exception applies to an occasional transfer. Singapore itself is not the subject of an EU or UK adequacy decision, so transfers to us from the EEA or the UK are covered by the Standard Contractual Clauses or the UK Addendum in our engagement terms.
You may ask us for a copy of the safeguards we rely on for a particular transfer by contacting us at the address in section 18.
10. How long we keep personal data
We keep personal data only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. The periods below are our standard retention periods; we may keep records for longer where they are needed for a legal claim, an audit or a regulatory obligation, and we will tell you if that applies to you.
| Record | Standard retention period | Then |
|---|---|---|
| Enquiries and related correspondence that do not lead to an engagement | 24 months after our last contact with you | Deleted |
| White-paper requests | 24 months after the request | Deleted |
| Specialist-network applications that do not lead to an engagement | 12 months after our decision, or 24 months if you consent to us keeping your details for future opportunities | Deleted; you may ask us to delete earlier at any time |
| Specialist-network members and associates | For the duration of your participation in the network and 24 months after it ends | Deleted, except records required for tax or legal purposes |
| Client, engagement, contract and billing records | 7 years after the end of the engagement, in line with Singapore accounting and limitation requirements | Deleted or anonymised |
| Cookie-consent records | 12 months from the date of your choice | Deleted |
| Google Analytics 4 event-level and user-level data | Event data 2 months; user-level data 14 months, after which only aggregated reports remain | Automatically deleted by Google |
| Website technical and security logs held by our hosting provider | A short period, normally no more than 30 days, or longer where an incident is under investigation | Deleted |
Anonymised information that can no longer be linked to you, such as aggregated website statistics, is not personal data and may be kept indefinitely.
11. Security
We protect personal data with administrative, technical and physical safeguards appropriate to its sensitivity. These include encrypted connections (TLS) for all traffic to this website and for our email; access controls so that only people who need personal data for the purposes in this notice can reach it, with multi-factor authentication on our systems; managed hosting with continuous security monitoring, daily backups and web-application firewalling; spam and abuse screening on all forms; and contractual security obligations on every service provider in section 8.
If a personal data breach occurs that is likely to cause significant harm to you, we will notify you and the relevant authorities without undue delay and within the timeframes the law requires: the Personal Data Protection Commission within three calendar days of assessing the breach as notifiable, and the competent EU or UK supervisory authority within 72 hours where the GDPR or UK GDPR applies.
12. Cookies and analytics
Cookies are small text files stored on your device by your browser. This website uses only two categories of cookie: strictly necessary cookies, which are required for the site to work and to record your cookie choice, and analytics cookies, which are set only if you accept them. We do not use functional, advertising or social-media cookies.
| Cookie | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
| cookiez-user-consent | proofdatum.com (Elementor Cookie Consent) | Strictly necessary | Stores the cookie choice you made so that we can honour it on every page and do not ask you again | 180 days |
| _ga | proofdatum.com (Google Analytics 4) | Analytics, only with your consent | Distinguishes one browser from another with a random identifier so that visits and page views can be counted | Up to 2 years |
| _ga_8TCWRGFNTJ | proofdatum.com (Google Analytics 4) | Analytics, only with your consent | Keeps the state of the current visit for our Google Analytics property | Up to 2 years |
How consent works on this site. When you first visit, a banner asks you to accept or decline analytics cookies; declining is as easy as accepting and takes one click. Until you accept, no analytics cookie is set and no measurement data is sent to Google: our consent tool holds the Google Analytics script inactive and signals “denied” to Google through Google Consent Mode v2 for analytics storage, advertising storage, advertising user data and advertising personalisation. If you accept, the script is released and the cookies above are set. Your choice is kept for 180 days, after which we ask again. You can change or withdraw your choice at any time by selecting the floating “Cookies” control on every page, and withdrawal takes effect immediately for future page views. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a decision to decline analytics cookies. Declining does not affect your ability to use any part of this website.
What Google Analytics 4 collects if you accept. Pages viewed, the pages that referred you to us, approximate location derived from your IP address at country and city level, device and browser type, screen size, and interactions such as form submissions and white-paper requests. Google Analytics 4 does not log or store your IP address. We have not enabled Google Signals, advertising features or any link to Google Ads, and Google retains event-level data for 2 months and user-level data for no more than 14 months on our behalf. Google processes this data as our processor under the Google Ads Data Processing Terms; information about how Google uses data from sites that use its services is available at policies.google.com/technologies/partner-sites.
Consent records. To honour your choice and to demonstrate that consent was obtained, our consent tool records a random consent identifier, your country, the categories you accepted or declined and the date and time. It does not record your name or your IP address. These records are stored in our website database and are kept for 12 months.
Website statistics without cookies. Our hosting platform (WordPress.com, operated by Automattic) provides us with aggregated visitor statistics derived from server logs. These statistics do not use cookies for visitors, are not combined with any other data about you and do not identify you.
13. Your rights
You have rights over your personal data. Which rights apply depends on the law that protects you, but we will consider every request on its merits whoever you are and wherever you live.
| Right | What it means | Singapore PDPA | GDPR / UK GDPR |
|---|---|---|---|
| Access | Obtain a copy of the personal data we hold about you and information about how we have used and disclosed it in the past year | Yes (s. 21) | Yes (Art. 15) |
| Correction (rectification) | Have inaccurate or incomplete data corrected | Yes (s. 22) | Yes (Art. 16) |
| Withdraw consent | Withdraw any consent you have given, with effect for the future; we will tell you the likely consequences | Yes (s. 16) | Yes (Art. 7(3)) |
| Erasure | Have your data deleted where it is no longer needed or where you withdraw consent or object | Through withdrawal of consent and our retention obligations (s. 25) | Yes (Art. 17) |
| Restriction | Ask us to limit how we use your data while a dispute or verification is resolved | Not a statutory right; honoured in practice | Yes (Art. 18) |
| Objection | Object to processing based on legitimate interests, including to any contact from us about our services | Not a statutory right; honoured in practice | Yes (Art. 21) |
| Data portability | Receive the data you gave us in a structured, machine-readable format | Provisions enacted but not yet in force; honoured in practice on request | Yes (Art. 20) |
| Automated decisions | Not to be subject to a decision based solely on automated processing that significantly affects you | Not applicable: we make no such decisions | Yes (Art. 22); not applicable in practice |
| Complain to a regulator | Raise a complaint with the data protection authority | Personal Data Protection Commission | Your local supervisory authority, or the Information Commissioner’s Office in the UK |
How to exercise your rights. Write to privacy@proofdatum.com or to the postal address in section 18, stating which right you wish to exercise. We may ask you to confirm your identity so that we do not disclose data to the wrong person. We will respond within 30 days; if a request is complex we may take up to a further 60 days under the GDPR and will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive, in which case we will tell you the fee before we proceed. If we cannot comply with a request we will explain the reason and your options.
14. Children
Our services are provided to businesses and to experienced professionals. This website is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, please contact us and we will delete it.
15. Recruitment and specialist-network candidates
If you apply to join our specialist network we use your application and CV to assess your experience and suitability for completions, commissioning and handover assignments, to contact you about opportunities that match your profile and, if we engage you, to contract with you and manage the assignment. We may verify the professional history and credentials you give us, and we may contact the referees you nominate; we will not contact your current employer without your agreement.
We assess applications manually; no automated screening or scoring is used. Interview and assessment notes form part of your application record. If your application is unsuccessful we keep it for 12 months so that we can reconsider you if a suitable assignment arises and respond to any query about our decision, unless you consent to a longer period or ask us to delete it sooner. You may withdraw your application at any time.
16. Third-party links and platforms
This website links to LinkedIn (our company page and the profiles of our people), WhatsApp (to message us), Google Maps (our office location) and other external sites. When you follow a link, the operator of that service becomes responsible for your personal data under its own privacy notice. We do not embed social-media plug-ins, share buttons or third-party pixels that transfer data to those platforms while you remain on our site.
If you contact us through WhatsApp, LinkedIn or email, that platform processes the message under its own terms; we then process the content of your message under this notice.
17. Complaints and how to escalate
If you have a concern about how we handle your personal data, please tell us first. Write to privacy@proofdatum.com with “Data protection complaint” in the subject line, or to our Data Protection Officer at the postal address in section 18. We will acknowledge your complaint within 7 days, investigate it and give you a substantive response within 30 days; if we need longer we will explain why and keep you informed.
If you are not satisfied with our response, or you would prefer to go directly to a regulator, you may complain to the Personal Data Protection Commission of Singapore (pdpc.gov.sg/complaints); if you are in the EEA, to the supervisory authority of the country where you live, work or where the alleged infringement took place (a list is at edpb.europa.eu/about-edpb/about-edpb/members); if you are in the United Kingdom, to the Information Commissioner’s Office (ico.org.uk/make-a-complaint); and elsewhere, to the data protection authority of your country.
18. Contact details, Data Protection Officer and representatives
Controller and Data Protection Officer:
- Luenya Solutions Pte. Ltd. (trading as Proofdatum), Singapore UEN 202446064N
- 152 Beach Road, #23-01 Gateway East, Singapore 189721
- Data Protection Officer: privacy@proofdatum.com (business contact for all data protection matters under section 11 of the PDPA; general enquiries remain at contact@proofdatum.com)
- Telephone: +65 8818 4195
Representatives in the European Union and the United Kingdom: see Supplement B.
19. Changes to this notice
We review this notice at least annually and whenever our processing changes. The version number and effective date at the top show the current version. Material changes will be announced on this page for 30 days before they take effect and, where we hold your contact details and the change affects you, by email. Earlier versions are available on request.
| Version | Date | Change |
|---|---|---|
| 1.0 | 12 July 2026 | First issue |
| 2.0 | 19 August 2026 | GDPR and UK GDPR additions; retention periods; legal bases; benchmarked wording |
| 3.0 | 2 September 2026 | Full restructure to a layered multi-jurisdiction notice; purpose and legal-basis table; named recipients and transfer mechanisms; cookie table and consent mechanism following the introduction of Google Analytics 4 behind an opt-in banner; expanded rights, complaints and recruitment sections; Singapore, EEA/UK and other-jurisdiction supplements |
Supplement A: Singapore (PDPA)
This supplement applies to everyone whose personal data we collect, use or disclose in Singapore, which in practice means all personal data we hold.
- Consent and deemed consent. Where we rely on your consent, you give it by submitting a form after reading the notice on it or by voluntarily providing personal data for a stated purpose (deemed consent under section 15). Where we rely instead on the legitimate interests exception or the business improvement exception in the First Schedule, we say so in section 5, as the PDPA requires.
- Withdrawal. You may withdraw consent by notifying us at privacy@proofdatum.com. We will act on your withdrawal within 10 business days and tell you the likely consequences; we may continue to hold data we are legally required to keep.
- Access and correction. We respond to access and correction requests within 30 days. Where we cannot respond in that time we will tell you when we will. A reasonable fee may apply to access requests only where the PDPA permits; we will tell you the fee before proceeding.
- Transfer limitation. Section 9 describes the steps we take under section 26 before transferring personal data outside Singapore.
- Do Not Call. We do not send specified messages to Singapore telephone numbers for marketing purposes. Any message we send you relates to an enquiry, application or engagement you are involved in.
- Data breach notification. We assess suspected breaches within 30 days and notify the Personal Data Protection Commission within three calendar days of assessing a breach as notifiable, and affected individuals thereafter, in accordance with Part 6A of the PDPA.
- Data Protection Officer. Our DPO can be reached at the business contact details in section 18.
Supplement B: European Economic Area and United Kingdom (GDPR and UK GDPR)
This supplement applies where the GDPR or the UK GDPR applies to our processing of your personal data, which is the case where we offer our services to you in the EEA or the UK or where we measure your use of our website there.
- Controller. Luenya Solutions Pte. Ltd. is the controller. We have no establishment in the EEA or the UK.
- Representatives. We are established in Singapore and do not currently have an establishment in the EEA or the United Kingdom. We have assessed our activities against Article 27 of the GDPR and the UK GDPR and, because we do not currently offer services to individuals in those territories or monitor their behaviour beyond consent-based website analytics, we have not appointed a representative there at this time. We keep this under review and will appoint representatives, and publish their details in this supplement, if our activities change. If you are in the EEA or the United Kingdom you may contact us directly at privacy@proofdatum.com on any matter relating to our processing of your personal data, and you retain the right to lodge a complaint with your local supervisory authority.
- Legal bases and legitimate interests. Section 5 sets out the legal basis for each purpose. Where we rely on legitimate interests you may object under Article 21 at any time and we will stop unless we can show compelling legitimate grounds.
- Your rights. Section 13 lists your rights under Articles 15 to 22. We respond within one month, extendable by two further months for complex requests.
- Transfers. Section 9 sets out the transfer mechanisms we use under Chapter V of the GDPR and UK GDPR.
- Automated decision-making. We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you.
- Cookies. Section 12 describes how we comply with Article 5(3) of the ePrivacy Directive and regulation 6 of the UK Privacy and Electronic Communications Regulations. Non-essential cookies are never set before you choose.
- Complaints. You have the right to lodge a complaint with a supervisory authority, without prejudice to any other remedy; section 17 explains how. In the UK we also acknowledge complaints within 30 days, as required by the Data (Use and Access) Act 2025.
Supplement C: other jurisdictions
We serve clients wherever complex assets are engineered, fabricated, integrated and commissioned. That includes fabrication and integration yards and project locations in, among other countries, China, South Korea, Malaysia, Indonesia, Singapore, Vietnam, the United Arab Emirates, Norway, Brazil, Nigeria, Ghana and Angola. Where the data protection law of one of these countries applies to our processing of your personal data, for example the laws of Malaysia, Hong Kong, Japan, Thailand, Indonesia, India, South Korea, Vietnam, the United Arab Emirates, Nigeria, Ghana, Angola or South Africa, we apply the rights and protections in this notice as a minimum and comply with any additional requirement of that law, including any additional right to access, correct, delete or port your data, any additional restriction on cross-border transfers, any local-representative requirement and any requirement to notify you or a regulator of a breach.
People’s Republic of China. If we provide services to a client in mainland China, or otherwise process the personal information of people in mainland China in a way that brings the Personal Information Protection Law (PIPL) into play, we will: tell you the purpose, method and scope of processing before we begin; obtain your separate consent before transferring your personal information outside mainland China, before providing it to another organisation and before processing any sensitive personal information; use a mechanism recognised by the Cyberspace Administration of China for any transfer outside mainland China, such as the CAC standard contract; and honour your rights under Chapter IV of the PIPL to access, copy, correct, delete and port your personal information and to withdraw consent. Until such an engagement arises, our processing of personal data from mainland China is limited to enquiries you choose to send us and, only if you accept analytics cookies, website measurement data.
If you are in a country whose law requires us to appoint a local representative and you wish to contact one, please write to privacy@proofdatum.com and we will tell you the position for your country.