Privacy
Policy

This Privacy Policy explains how Online Optimization Holdings Pte. Ltd. (UEN 202632024G), a company incorporated in Singapore with its registered office at Level 39, Marina Bay Financial Centre Tower 2, 10 Marina Boulevard, Singapore 018983 (the "Company", "we", "us"), handles personal data.

It applies to personal data we collect through this website (www.online-optimization.com), through enquiries and audit requests, and in the course of providing our services. It forms part of, and should be read together with, our Terms and Conditions.

Under the PDPA, "personal data" means data about an individual who can be identified from that data, or from that data together with other information we have or are likely to have access to.

Business contact information your name, title, business email and business phone number used for business purposes is treated differently under the PDPA and is generally outside its consent requirements. Where you contact us in a business capacity, much of what you provide falls into this category.

We collect only what we need for the purposes in Clause 5:

We do not ask for your NRIC number, and we do not use NRIC numbers for authentication. We ask you not to send us sensitive personal data unless it is necessary for an engagement.

We collect personal data when you submit a form on our website (audit request, strategy call, project enquiry), email or message us, engage us for services, or interact with our website (through cookies and analytics, described in Clause 7). We may also receive business contact details from public professional sources.

We use personal data to:

• respond to your enquiry and run the free visibility audit you request;
• provide, manage and improve our services and deliverables;
• communicate with you about your enquiry, project or account;
• send you marketing about our services where you have consented or where permitted by law (Clause 13);
• maintain our records, and meet legal, tax and regulatory obligations; and
• protect the security and integrity of our website and business.

We use personal data only for purposes that a reasonable person would consider appropriate in the circumstances, and that we have told you about at or before collection.

We collect, use and disclose personal data with your consent, or where the PDPA otherwise permits (for example, under a legitimate interests or business improvement basis, or where the data is business contact information).

When you submit a form and provide your data for a stated purpose, you consent to us using it for that purpose. We do not rely on pre-ticked boxes; any marketing consent is captured by a separate, deliberate action. You can withdraw consent at any time (Clause 12) withdrawal is as easy as giving it.

Our website uses cookies and similar technologies. Strictly necessary cookies keep the site working and do not require consent. Analytics and marketing cookies which may collect personal data such as your IP address are used to understand how the site performs and to measure our campaigns, and are set on the basis of the consent framework in the PDPC's Advisory Guidelines.

You can accept, reject or manage non-essential cookies through our cookie controls, and you can also block or delete cookies in your browser settings. Blocking some cookies may affect how parts of the site work.

We do not sell your personal data. We may disclose it to:

• Service providers who process data on our behalf for example hosting, email, CRM, analytics and advertising platforms under contracts that require them to protect it and use it only for our purposes;
• Professional advisers such as our accountants, auditors and lawyers, where reasonably required; and
• Authorities, where disclosure is required or permitted by law, or to protect our rights.

When we deliver services, we may process personal data contained in a client's systems, accounts or audiences (for example, website and advertising data). In relation to that data we act as a data intermediary under the PDPA: we process it only on the client's documented instructions and for the purposes of the engagement, apply reasonable security arrangements, and do not retain it longer than necessary.

The client remains responsible, as the controlling organisation, for having a valid basis and any required consents for the personal data it provides to us or asks us to process. This mirrors Clause 11 of our Terms and Conditions.

Some of our service providers store or process data outside Singapore. Where we transfer personal data overseas, we take reasonable steps to ensure it receives a standard of protection comparable to that under the PDPA for example through contractual protections with the recipient as required by the PDPA's Transfer Limitation Obligation.

We protect personal data with reasonable administrative, technical and physical security arrangements including encryption in transit (SSL/TLS), access controls, and limiting access to staff who need it. No method of transmission or storage is completely secure, but we work to protect your data and to respond quickly if an issue arises.

We keep personal data only as long as it serves the purpose it was collected for, or as required for legal, tax or accounting reasons. When it is no longer needed, we delete or anonymise it.

Under the PDPA you may, at any time:

• Access ask what personal data we hold about you and how it has been used or disclosed;
• Correct ask us to correct an error or omission in your personal data;
• Withdraw consent withdraw your consent to our use of your personal data, on reasonable notice.

To make a request, contact our Data Protection Officer (Clause 15). We will respond within a reasonable time. If you withdraw consent, we may no longer be able to provide certain services, and we'll tell you if that is the case. We may charge a reasonable fee for an access request, as permitted by the PDPA, and will tell you in advance.

We send marketing messages only where you have consented or where the law allows. Every marketing email includes an unsubscribe option, and you can opt out at any time.

We comply with the Do Not Call provisions of the PDPA. We will not send telemarketing messages (voice, SMS or messaging-app messages) to a Singapore number registered on the Do Not Call registry unless we have your clear consent to do so.

We maintain a process to detect, assess and respond to data breaches. If a breach is likely to result in significant harm to affected individuals, or is of a significant scale, we will notify the PDPC and affected individuals in line with the PDPA's mandatory data breach notification requirements. Where we act as a data intermediary for a client, we will notify that client without undue delay so it can meet its own obligations.

We have appointed a Data Protection Officer (DPO) responsible for overseeing our compliance with the PDPA. For any question, access or correction request, consent withdrawal, or complaint about how we handle personal data, contact:

If we cannot resolve your concern, you may contact the Personal Data Protection Commission (PDPC) of Singapore.

We may update this Privacy Policy from time to time. The current version is always published on this page, and the version in force when you interact with us applies. Material changes will be highlighted on the website.