PRIVACY AND PERSONAL DATA POLICY

Effective date: 27 October 2026

WHO WE ARE

CTAD SINGAPORE PTE LTD (CTAD, we, us), UEN 202643349E, handles personal data in connection with our website, enquiries, training, advisory and related services.

This policy explains how we collect, use, disclose and protect personal data in accordance with Singapore’s Personal Data Protection Act 2012 (PDPA).

OUR DATA PROTECTION CONTACT

For privacy enquiries, complaints, access or correction requests, or withdrawal of consent, please contact our Data Protection Officer through the Contact CTAD form.

 

Contact CTAD form:

Select “Other enquiry” and begin your message with “For the Data Protection Officer”.

Please provide sufficient information for us to understand and respond to your request. Do not include passwords, payment card details or identity documents in an initial enquiry.

PERSONAL DATA WE COLLECT

Depending on your enquiry or the services you use, personal data may include:

• Your name and preferred name for certificates.
• Email address and contact number.
• Organisation and professional information you provide.
• Course selections, requested dates and booking details.
• Billing information, payment status and transaction references.
• Enquiry messages and information you choose to provide.
• Attendance, participation and completion records.

 

Technical information, such as IP addresses, browser information and website activity, may also be collected through our website and its service providers.

If you provide another person’s personal data, ensure you are authorised to do so and make this policy available to them.

Please provide only information relevant to your enquiry or service. We do not routinely request NRIC, FIN or passport numbers for course registration.

WHY WE USE PERSONAL DATA

We collect, use and disclose personal data for reasonable purposes connected with our services, including:

• Responding to enquiries about courses, advisory, digital solutions, partnerships and other CTAD services.
• Understanding your requirements and preparing proposals or quotations.
• Managing registrations, bookings and service arrangements.
• Processing payments, invoices, cancellations and refunds.
• Sending joining instructions, reminders and service updates.
• Delivering training and maintaining attendance, completion and certificate records.
• Administering agreed advisory projects and partnerships.
• Maintaining necessary business records, resolving disputes, protecting our services and meeting legal obligations.

 

We obtain consent where required by law or rely on another basis permitted under the PDPA.

We do not make consent to unnecessary collection, use or disclosure a condition of receiving a service. If we intend to use personal data for a new purpose, we will provide the required notification and obtain consent where required.

OPTIONAL MARKETING

Marketing permission is separate from enquiries, course registration and service delivery. Making an enquiry or booking a course does not automatically enrol you in marketing communications.

​

If we invite you to receive promotional updates, we will explain the communication channels and purposes when requesting your permission.

You may unsubscribe using the method provided in a marketing message or contact our Data Protection Officer to withdraw consent.

Booking confirmations, joining instructions and other necessary service communications are handled separately from marketing.

Where applicable, marketing communications will comply with Singapore’s Do Not Call requirements and the Spam Control Act.

SHARING PERSONAL DATA

We disclose personal data only where reasonably necessary for the purposes explained in this policy, with your consent where required, or where disclosure is otherwise required or permitted by law.

​

Recipients may include providers supporting website hosting, forms, bookings, payments, email, online training and file storage, as applicable to the service you use.

Service providers may process personal data on our behalf. Where you use a third-party service directly, its own privacy notice may also apply.

​

Where payment is made through a payment provider, payment information is processed according to that provider’s arrangements. CTAD may receive information needed to identify the transaction and administer the booking, invoice or refund.

​

We may disclose relevant information to professional advisers, public authorities or other parties where reasonably necessary to comply with law, resolve a dispute or establish, exercise or defend legal rights.

OVERSEAS PROCESSING

Some service providers may store or process personal data outside Singapore.

Where we transfer personal data overseas, we will take the steps required under the PDPA to ensure that the transferred data receives a standard of protection comparable to that required under the PDPA.

ACCURACY AND SECURITY

Please keep the information you provide accurate and tell us when relevant details change.

We make reasonable efforts to ensure personal data is accurate and complete where it is likely to be used to make a decision affecting you or disclosed to another organisation.

​

We use reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks.

Access is restricted according to work responsibilities. No website, transmission method or storage system can guarantee absolute security. This does not limit our responsibilities under applicable law.

RETENTION

We retain personal data only while it is needed for the purposes for which it was collected or for legal or business purposes.

Retention needs vary according to the information involved. Transaction records may need to be retained for accounting and legal requirements, while attendance and completion records may be needed to administer training and verify certificates.

When retention is no longer necessary, we will cease retaining the personal data or remove the means by which it can be associated with an individual, as appropriate.

ACCESS, CORRECTION AND PRIVACY REQUESTS

You may contact our Data Protection Officer to request access to personal data in our possession or control, information about its use or disclosure as provided by the PDPA, or correction of an error or omission.

​

We may request information reasonably necessary to verify your identity and clarify your request.

Requests are subject to applicable legal requirements and exceptions. We may charge a reasonable fee for an access request where permitted by law and will provide a written estimate before proceeding.

​

We will respond within the applicable legal requirements. If we cannot respond to an access or correction request within 30 days, we will inform you in writing within that period of when we expect to respond.

WITHDRAWING CONSENT

You may withdraw consent by contacting our Data Protection Officer and giving reasonable notice.

We will explain the likely consequences. Depending on the information involved, withdrawal may affect our ability to provide a requested service.

Withdrawal does not affect processing already lawfully carried out or require us to delete information that we are required or permitted by law to retain.

COOKIES AND WEBSITE TECHNOLOGIES

Our website may use cookies and similar technologies to support website operation, security, forms and related functions.

The information collected may include technical details about your device, browser and use of the website.

You can manage or delete cookies through your browser settings. Restricting cookies may affect how parts of the website work.

Where additional technologies collect personal data for purposes requiring notification or consent, we will provide the required information and obtain consent where required.

TRAINING SESSIONS

CTAD does not record training sessions.

Attendance and completion records may still be maintained for training administration and certificates.

Participants must not record, photograph or capture other participants or their contributions without appropriate permission.

PERSONAL DATA INCIDENTS

We will assess suspected personal data breaches and take appropriate steps to contain and address them.

Where a breach is notifiable under the PDPA, we will notify the Personal Data Protection Commission and affected individuals as required by law.

POLICY UPDATES

We may update this policy to reflect changes to our services, practices or legal requirements. The revised policy will show its effective date.

Publishing an updated policy does not, by itself, authorise a new use of personal data that requires further notification or consent.

Nothing in this policy limits rights or obligations that cannot lawfully be excluded.