Privacy notice

1. About this notice

Astana Group respects your personal data. This notice explains how the member firms of Astana Group (listed in our Terms of use) collect, use, disclose and protect personal data, in line with Singapore's Personal Data Protection Act 2012 (PDPA). It covers personal data we collect through www.astana.sg and in the course of providing our services.

Each member firm is responsible for the personal data it collects for the services it provides. Where we provide services to you, your engagement letter names the member firm responsible. Immigration enquiries are handled by Goldcrest Meridian Pte. Ltd., our affiliated company, which follows this notice for data it receives through our website.

2. Personal data we collect

Depending on how you deal with us, we may collect:

• Contact details: your name, company, job title, email address and phone number;
• Enquiry details: the service you are interested in, deadlines and anything you write in our enquiry or proposal form;
• Newsletter details: your email address, if you subscribe;
• Recruitment information: your CV, qualifications, employment history and other details you send when applying for a role;
• Client due diligence information: identity documents, nationality, residential address, date of birth, and information about directors, shareholders and beneficial owners. We are required by law to collect this as an ACRA-registered corporate service provider and as a public accounting firm, for anti-money laundering, counter-terrorism financing, conflict and independence checks; and
• Technical information: your IP address, browser type, device information and pages visited, collected when you use the website (see our Cookie notice).

3. How we collect personal data

We collect personal data when you give it to us directly, for example through our forms, by email or in meetings; from your organisation when it engages us; from public sources such as ACRA's BizFile+ register; and automatically when you use the website.

4. Why we use your personal data

We use personal data to:

• respond to your enquiries and prepare proposals;
• provide our services under an engagement letter, including audit, accounting, tax, corporate secretarial, advisory and immigration services;
• carry out customer due diligence, anti-money laundering and counter-terrorism financing checks, and conflict and independence checks;
• meet our legal, regulatory and professional obligations, including those under the Companies Act 1967, the Accountants Act 2004, the Corporate Service Providers Act 2024 and tax laws;
• assess job applications;
• send you our insights and event invitations, if you have asked to receive them; and
• operate, secure and improve the website.

5. Consent and withdrawal of consent

By submitting your personal data to us, you consent to our collecting, using and disclosing it for the purposes above, or for purposes the law allows without consent. You may withdraw your consent at any time by contacting our Data Protection Officer (section 13). We will process your request within a reasonable time and tell you of any consequences: for example, we may be unable to continue providing services, or may need to keep data the law requires us to keep. You can unsubscribe from our emails at any time using the link in each email.

6. Who we share personal data with

We do not sell personal data. We may share it with:

• other Astana Group member firms and our affiliate Goldcrest Meridian Pte. Ltd., where needed to respond to you or provide the services you ask for;
• service providers who support our operations, such as IT, cloud hosting, email, form-handling, mailing-list and accounting software providers, under obligations to protect the data;
• regulators, government agencies and law enforcement, including ACRA, IRAS and the Ministry of Manpower, where required or permitted by law; and
• our professional advisers, such as lawyers and insurers.

7. Transfers outside Singapore

Some of our service providers store data outside Singapore, and our teams in Malaysia and Nigeria may handle personal data to support our work. When we transfer personal data outside Singapore, we take steps to ensure it receives a standard of protection comparable to the PDPA, as the PDPA requires.

8. How we protect personal data

We use reasonable security arrangements to protect personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal and loss. These include access controls, encrypted connections and confidentiality obligations on our staff and service providers.

9. How long we keep personal data

We keep personal data only for as long as it is needed for the purposes for which it was collected, or as required by law. Some records must be kept for set periods; for example, customer due diligence records are generally kept for at least five years after a business relationship ends. When personal data is no longer needed, we delete it or make it anonymous.

10. Access and correction

You may ask us for access to the personal data we hold about you and how it has been used or disclosed in the past year, or ask us to correct it. Please write to our Data Protection Officer. We will respond as soon as reasonably possible, and usually within 30 days. We may charge a reasonable fee for an access request; if so, we will tell you the fee before processing it.

11. Keeping your data accurate

Please let us know if your personal data changes, so that we can keep our records accurate and complete.

12. Data breaches and marketing messages

If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as the PDPA requires. We do not send marketing messages to Singapore telephone numbers unless you have given clear consent or we have checked the Do Not Call Registry.

13. Contact our Data Protection Officer

For questions, access or correction requests, or to withdraw consent, please contact:

Data Protection Officer, Astana Group
18 Kaki Bukit Road 3, #03-14, Entrepreneur Business Centre, Singapore 415978
Email: nas@astana.sg

14. Changes to this notice

We may update this notice from time to time. The latest version is always on this page, with the date it was last updated.