How ENGIC handles personal data and confidential submissions.

ENGIC (PTE.) LTD. is responsible for personal data collected through engic.ltd and related business communications. This policy explains what we collect, why we use it, where it is processed, how long it is kept, and how individuals may exercise their rights under Singapore's Personal Data Protection Act 2012 (PDPA).

The website supports business enquiries, RFQs, document requests, supplier and partner onboarding, recruitment, investor communications, ethics reports, and project-related submissions. Technical or commercially sensitive documents should be limited to what ENGIC needs to assess the request.

This policy applies to personal data submitted or generated through:

→Contact and RFQ forms
→Pre-qualification and vendor registration
→Supplier and partner enquiries
→Investor enquiries
→Careers and recruitment
→Ethics and compliance reports
→Document and resource requests
→Email and business communications
→Uploaded technical or commercial documents
→Website security and administration

Effective: 23 September 2026
Last reviewed: 23 September 2026
Primary jurisdiction: Singapore

01Data we collect

Information you provide and limited technical records.

Identity and business contact data

→Name, employer, job title, business email, telephone number, country, and business address
→Company registration, ownership, website, professional profile, and authorised-representative details
→Supplier, customer, partner, investor, candidate, or other relationship information

Enquiry, project, and commercial data

→RFQs, MTOs, schedules, specifications, drawings, datasheets, bills of materials, and scope descriptions
→Project, end-client, delivery, Incoterms, inspection, certification, documentation, and timeline requirements
→Quotation, tender, due-diligence, compliance, source-of-funds, and contractual information where relevant

Recruitment and reporting data

→CVs, qualifications, employment history, references, availability, and application correspondence
→Ethics-report details, supporting evidence, persons involved, and contact details when supplied

Technical and security data

→IP address, user agent, request time, pages or routes requested, security outcome, and rate-limit state
→Cloudflare Turnstile challenge signals and tokens used to prevent automated abuse
→Authorised administrator sign-in, session, access, and audit records

02Purposes

We use data for stated business and compliance purposes.

→Respond to enquiries and take steps requested before a contract
→Assess requirements, prepare quotations, and coordinate project, procurement, manufacturing, inspection, logistics, and after-sales work
→Evaluate suppliers, partners, candidates, investors, and pre-qualification requests
→Administer contracts and maintain business, project, quality, HSE, and compliance records
→Conduct proportionate sanctions, export-control, anti-bribery, fraud, and due-diligence checks
→Protect forms, systems, users, confidential information, and ENGIC's legal rights
→Investigate ethics reports, safety concerns, suspected misconduct, or legal claims
→Meet legal, regulatory, audit, tax, employment, and reporting obligations
→Improve website reliability and business processes using operational information rather than advertising profiles

03Authority to use data

Consent, deemed consent, legitimate interests, and legal obligations.

ENGIC collects, uses, or discloses personal data with consent, deemed consent, or another basis permitted by the PDPA. Depending on the context, processing may be necessary to respond to a request, enter into or perform a contract, protect legitimate interests after assessing likely impact, respond to an emergency, investigate wrongdoing, establish or defend legal claims, or comply with law.

Business contact information may be handled under the PDPA provisions applicable to information used solely for business purposes. ENGIC still limits its use to relevant professional communications and does not treat a business address as permission for unrelated mass marketing.

04Systems and recipients

Where website submissions are processed.

Website requests are processed on Cloudflare infrastructure. Structured form records are stored in Cloudflare D1, uploaded files in Cloudflare R2, and limited security or short-lived workflow state in Cloudflare KV. Cloudflare Turnstile verifies public form submissions. Submission notifications are sent through ENGIC's configured SMTP relay.

Access may be provided, on a need-to-know basis, to:

→Authorised ENGIC personnel and professional advisers
→Cloud, security, email, and other service providers acting for ENGIC
→Manufacturers, suppliers, contractors, inspection bodies, logistics providers, and project partners where needed for the request
→Clients, end users, banks, insurers, auditors, regulators, courts, or public authorities where authorised or required
→A successor or transaction counterparty subject to appropriate confidentiality and data-protection measures

ENGIC does not sell personal data and does not use website submissions for third-party behavioural advertising.

05International transfers

Global projects require controlled cross-border processing.

Cloud infrastructure, email delivery, suppliers, manufacturers, project partners, and recipients may be located outside Singapore. Before transferring personal data, ENGIC uses contractual, organisational, technical, or other legally recognised measures intended to provide a standard of protection comparable to the PDPA, unless an applicable exception permits the transfer.

Project documents should not contain export-controlled technology, state secrets, passwords, payment-card data, or unnecessary sensitive personal data. Contact ENGIC before transmitting unusually sensitive or regulated material.

06Retention

Kept only while there is a legal or business purpose.

ENGIC retains personal data only while it is needed for the purpose collected or a related legal or business purpose. The period depends on the type of record, active relationship, project or tender lifecycle, contractual limitation periods, quality and traceability requirements, tax and audit duties, employment obligations, disputes, investigations, legal holds, and backup cycles.

When retention is no longer necessary, ENGIC deletes, anonymises, or makes the data inaccessible using processes appropriate to the system and record. Closing a submission in the portal does not by itself delete records that ENGIC must retain.

07Security

Layered technical and organisational safeguards.

→Transport encryption over HTTPS
→Cloudflare edge security, Turnstile verification, and server-side rate limits
→Role-based administrator access and cryptographically protected session tokens
→Restricted access to D1 records and R2 uploads
→Input validation, file-type and upload-size controls, and audit records
→Incident assessment, containment, and notification procedures

No transmission or storage system can be guaranteed completely secure. Notify ENGIC promptly if you suspect misuse or an unauthorised disclosure.

08Your choices and rights

Access, correction, withdrawal, and complaints.

Subject to PDPA exceptions, an individual may ask for access to personal data in ENGIC's possession or control and information about its use or disclosure during the preceding year, or ask ENGIC to correct an error or omission. ENGIC may need to verify identity and clarify the request. A reasonable access fee may apply where permitted, and the amount will be communicated in advance.

ENGIC aims to respond within 30 calendar days. If more time is reasonably required, ENGIC will notify the requester in writing within that period and state when a response is expected.

Consent may be withdrawn with reasonable notice. ENGIC will explain likely consequences and will stop the affected collection, use, or disclosure unless continued processing is required or authorised by law. Withdrawal does not invalidate earlier lawful processing.

09Security incidents

Assessment and notification under the PDPA.

ENGIC assesses suspected personal-data breaches promptly. Where a breach is notifiable under the PDPA, ENGIC will notify the Personal Data Protection Commission as soon as practicable and no later than three calendar days after determining that notification is required, and will notify affected individuals as soon as practicable where the law requires it.

10Children and consequential decisions

A business website for professional users.

The website is not directed to children. A person submitting information about a minor must have lawful authority and should provide only what is necessary.

The site may use automated tools to route or summarise enquiries for internal review. ENGIC does not use the public website to make solely automated decisions that produce legal or similarly significant effects about individuals.

11Data protection contact

Contact ENGIC before approaching the regulator.

Send access, correction, withdrawal, complaint, or data-protection enquiries to contact@engic.ltd with the subject line ‘Data Protection — for the attention of the DPO’. Include enough information to identify the relevant interaction, but do not email passwords or unnecessary sensitive documents.

If a concern is not resolved, individuals may contact Singapore's Personal Data Protection Commission through its official channels.

12Changes

The published date identifies the current version.

ENGIC may revise this policy when systems, business processes, legal requirements, or service providers change. Material changes will be reflected on this page with a new effective or review date. The policy in force when data is handled applies, subject to applicable law.

Legal framework

This policy was reviewed against Singapore's Personal Data Protection Act 2012, the Personal Data Protection Regulations, and current guidance of the Personal Data Protection Commission as at 23 September 2026.

This public policy describes ENGIC's website and business-data practices. A signed NDA, employment agreement, supplier agreement, project contract, or mandatory law may impose additional or more specific obligations.