Privacy Policy & PDPA Notice

1. Who we are

This Privacy Policy is issued by Infracom Consultancy Integration Pte Ltd ("Infracom", "we", "us", or "our"), a private limited company incorporated in Singapore.

Registered office: 506 Chai Chee Lane, Singapore 469026
Website: https://infracom.com.sg
Primary contact for data matters: security@infracom.com.sg

Infracom provides IT and cybersecurity consulting services — including Governance, Risk & Compliance (GRC), Vulnerability Assessment & Penetration Testing (VAPT), Suitably Qualified & Experienced Personnel (SQEP) staffing, and managed services — primarily to clients in Singapore, with expansion into Australia from 2026.

2. What personal data we collect

We collect different categories of personal data depending on how you interact with us:

We do not knowingly collect personal data from children under the age of 13 through this website. If you believe we have inadvertently done so, please contact our DPO and we will delete the data promptly.

3. Why we collect it

We collect, use, and disclose personal data only for purposes that a reasonable person would consider appropriate in the circumstances and that you have been notified of, in line with PDPA Section 18.

Our purposes include:

• Responding to enquiries — to reply to your contact-form submission, schedule a call, or provide a proposal.
• Service delivery — to perform the cybersecurity, GRC, VAPT, SQEP, or managed services we are engaged for.
• Sales follow-up & relationship management — to keep in touch with prospects and existing clients about relevant services and updates.
• Security & fraud prevention — to protect our website and clients from spam, abuse, and unauthorised access.
• Legal & regulatory compliance — including tax, accounting, anti-money-laundering, and any obligations under applicable laws.
• Recruitment — to evaluate candidates for employment or contractor engagements.
• Service improvement — to analyse aggregated, non-identifying usage patterns and improve our website and services.

We will not use your personal data for purposes materially different from those listed without first obtaining your fresh consent, unless an exception under the PDPA applies.

4. Legal basis under PDPA

Under the Singapore Personal Data Protection Act 2012, we rely on one or more of the following bases for processing your personal data:

← Swipe to compare →

5. Who we share data with

We share personal data only where necessary, and only with parties we have assessed for security and privacy practices. We do not sell, rent, or trade your personal data.

Third-party service providers

To run our website and business operations, we use trusted third-party service providers in categories such as:

• Web hosting and email delivery — to serve our website, store form submissions, and deliver transactional emails.
• Anti-spam and bot protection — to prevent automated abuse of our forms.
• Performance and analytics — to monitor site performance and understand aggregated usage patterns.
• Mapping services — to display our office location.
• Productivity, communications, and security tooling — to support day-to-day operations.

All such providers are bound by contractual confidentiality and data-protection obligations. The personal data they process is limited to what is necessary for the service they provide. A current list of providers is available on request to security@infracom.com.sg.

Disclosure required by law

We may disclose personal data when required by Singapore law, regulatory authority, valid court order, or to protect our legal rights — and we will limit such disclosure to what is strictly necessary.

6. International data transfers

Our primary data storage and processing takes place in Singapore. However, some of our third-party service providers operate from servers outside Singapore.

Where personal data is transferred outside Singapore, we ensure that the receiving party provides a standard of protection comparable to the PDPA, and — where personal data of individuals located in the European Economic Area (EEA), the United Kingdom, or other jurisdictions covered by the EU General Data Protection Regulation (GDPR) is involved — to a standard comparable to the GDPR.

We achieve this through one or more of:

• Binding contractual provisions imposing PDPA-equivalent and, where relevant, GDPR-equivalent safeguards on the recipient (including Standard Contractual Clauses where applicable).
• Reliance on the recipient's certifications under recognised cross-border privacy frameworks — for example, the APEC Cross-Border Privacy Rules (CBPR), the EU-U.S. Data Privacy Framework, and the UK Extension to that Framework.
• Specific consent from you, where required.

This satisfies our obligations under PDPA Section 26 (Transfer Limitation Obligation) and aligns with the international baseline set by the GDPR for cross-border data transfers, even where a transfer is not strictly subject to GDPR.

7. How long we keep your data

We retain personal data only for as long as it is reasonably necessary for the purpose it was collected for, or as required by applicable law. After that, we securely delete or anonymise it.

As a general rule, personal data we collect through our website (including contact form submissions, email correspondence, and recruitment applications) is retained for a maximum of 12 months, after which it is securely deleted.

← Swipe to compare →

Where the law requires us to keep certain records longer (for example, statutory accounting and tax records), we will do so — but we will continue to apply appropriate access and security controls during the extended retention period.

8. How we protect your data

Under PDPA Section 24, we are required to make reasonable security arrangements to protect personal data in our possession or under our control. We take this obligation seriously and have implemented:

Administrative safeguards

• Documented information security policies and procedures, reviewed regularly.
• Staff training on data protection and confidentiality.
• Confidentiality and data-protection clauses in contracts with employees, contractors, and service providers.
• Designated Data Protection Officer responsible for PDPA compliance.

Technical safeguards

• Encryption in transit (TLS) for all website traffic, email, and form submissions.
• Role-based access controls — staff can access only the data they need to perform their role.
• Multi-factor authentication on administrative accounts.
• Anti-spam and bot-prevention controls on web forms.
• Regular security patching and vulnerability monitoring.

Physical safeguards

• Office access controls at our registered premises.
• Secure disposal of physical documents containing personal data.

Despite these measures, no method of internet transmission or electronic storage is 100% secure. If we become aware of a personal data breach that is likely to result in significant harm to affected individuals or involves 500 or more individuals, we will notify the Personal Data Protection Commission (PDPC) and affected individuals as required under the PDPA's mandatory data breach notification framework.

9. Your rights under PDPA

Under the Personal Data Protection Act 2012, you have the following rights with respect to your personal data:

To exercise any of these rights, send a written request to security@infracom.com.sg. We will respond within 30 days, or notify you within that period if we need an extension. We may require you to verify your identity before fulfilling the request, and may charge a reasonable fee for access requests as permitted under the PDPA.

Withdrawing consent: Note that withdrawing consent may affect our ability to continue providing certain services to you. We will inform you of any such consequences before processing the withdrawal.

10. Cookies and tracking technologies

Our website uses cookies and similar technologies for essential functionality, performance, and aggregated analytics. We do not use cookies for advertising or cross-site tracking.

Categories of cookies we use

← Swipe to compare →

Most modern browsers let you block, delete, or set notifications for cookies. Disabling cookies may affect parts of the website but does not prevent you from contacting us.

11. Data Protection Officer

In compliance with PDPA Section 11(3), Infracom has designated a Data Protection Officer (DPO) responsible for ensuring compliance with the PDPA.

You may also write to our DPO by post at our registered office: 506 Chai Chee Lane, Singapore 469026, marked "Attention: Data Protection Officer".

12. Complaints & PDPC escalation

We encourage you to contact us first at security@infracom.com.sg if you have any concern about how we have handled your personal data. We will investigate and respond within 30 days.

If you are not satisfied with our response, you have the right to escalate the matter to the Personal Data Protection Commission Singapore (PDPC), which is the regulator for the PDPA:

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, technology, legal requirements, or other factors. For material changes, we will provide more prominent notice (such as a banner on our website or, where appropriate, direct notification). The current version is always available at https://infracom.com.sg/privacy-policy/.

Your continued use of our website or services after an updated policy is published constitutes acceptance of the changes (where the law permits).