Privacy Notice

01About this notice

Jeffrey Tan (陈盛辉) operates jeffreytsf.com personally from Singapore and is responsible for personal data handled through this personal website. Saibergard and RECASYS are mentioned as professional affiliations; neither is presented as the operator of this site.

This notice explains how personal data is handled under Singapore’s Personal Data Protection Act 2012 (PDPA) and, where applicable, the EU General Data Protection Regulation (GDPR). Enquiries sent through the contact form are delivered by email to Jeffrey Tan’s business inbox.

02What is collected

The actual contact form has three fields: name, email address and message. There is no company field; company information is received only if you choose to include it in your message. Please provide only what is needed for your enquiry, and do not send identity documents, financial details, health information, passwords or sensitive client material.

Cloudflare Pages provides the site’s hosting. Cloudflare may process request and security data, such as IP addresses and browser information, to deliver and protect the site. When enabled for the form, Turnstile processes technical browser signals for anti-bot checks. Cloudflare Web Analytics, a privacy-friendly, cookieless service, counts visits without cookies, cross-site tracking or fingerprinting.

03Why data is used and legal bases

Enquiry data is used to understand and answer your request, arrange follow-up you ask for, and keep relevant correspondence. Security data is used to prevent spam, abuse and unauthorised access. Data may also be used where needed to comply with law or establish, exercise or defend legal claims. No newsletter, advertising, sale of personal data or cross-site tracking is operated on this site. Cloudflare Web Analytics is used only to count visits, without cookies.

Under the PDPA, data is handled with the consent required for the notified purposes, or under a lawful exception where applicable. Where the GDPR applies, the relevant basis is legitimate interests in responding to enquiries and protecting the site (balanced against your rights), steps you request before a contract where applicable, compliance with legal obligations, or consent for any optional activity that requires it. Browsing alone is not treated as consent to optional tracking.

04Who receives data

When enabled, the form delivers your enquiry to Jeffrey Tan’s business email inbox through server-side delivery. The inbox address is not published or embedded in client-side code. Cloudflare provides hosting and security services; email delivery and inbox providers process enquiries as needed to deliver and store correspondence.

Data is disclosed only as needed for these purposes, to advisers subject to confidentiality where necessary, or where law requires it. It is not automatically passed to the businesses mentioned on this personal site merely because you visit it. External websites, including LinkedIn, have their own privacy practices.

05International transfers

Cloudflare and the email providers may process data outside Singapore through global infrastructure. Overseas transfers are subject to safeguards providing protection comparable to the PDPA. Where GDPR applies, transfers require a valid mechanism, such as an applicable adequacy decision or standard contractual clauses with any necessary supplementary measures. You may request details of the safeguards through contact form.

06Retention and security

Enquiry records, including copies in the business email inbox, are retained for 24 months from the last contact, then deleted or anonymised unless a longer period is required by law. Security and provider logs are kept only as long as needed for security, service operation and applicable legal requirements. Privacy-request records are kept as long as needed to handle the request and meet applicable legal obligations.

Appropriate access controls, secure delivery, provider terms and deletion procedures are applied when handling personal data. No internet transmission or storage method is completely secure. Security incidents are assessed and notified where applicable law requires.

07Cookies and browser storage

The site uses the first-party localStorage key jeffreytsf-consent-v1. It stores the consent version, Accept/Reject choice, Necessary=true, Analytics=false and a timestamp; it contains no enquiry text or contact details. The choice is valid for 182 days, then removed and requested again on a later visit. Browser storage otherwise remains until cleared by the site or your browser.

Necessary storage is always on for remembering your choice and, once configured, security. Cloudflare Web Analytics is cookieless and stores nothing on your device, so it does not depend on this choice. Accept and Reject both leave cookie-based analytics off; no advertising or cookie-based tracking script is loaded under either choice. You can reopen Cookie settings at any time.

The contact form uses Cloudflare Turnstile, which uses technical signals such as IP address, browser/user-agent information and site origin for bot prevention, not the content of your form fields. Its standard result is a single-use token requiring server-side verification. Cloudflare documents that cookies or browser storage can be involved in challenge operation. The optional cf_clearance cookie is added only with pre-clearance enabled; that feature is not currently enabled here. Security-storage duration depends on the applicable service configuration.

Read Cloudflare’s Turnstile Privacy Addendum for its security processing. Deleting or blocking necessary storage may cause the banner to reappear or affect future form security. This site has no analytics or advertising cookies, pixels or cross-site tracking scripts.

08Your choices and PDPA rights

You may withdraw consent with reasonable notice, request access to personal data held about you and information about relevant use or disclosure, and request correction, subject to PDPA exceptions. Withdrawal may mean that an enquiry cannot be followed up; it does not affect lawful processing already carried out or retention the law permits. Submit a privacy request through contact form. Reasonable identity checks may be needed; do not send identity documents unless a secure process is specifically agreed.

Requests will be handled within applicable statutory time limits. If your concern is unresolved, you may contact Singapore’s Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

09GDPR rights where applicable

Subject to the legal conditions and exceptions, you may request access, rectification, erasure, restriction of processing and data portability; object to processing based on legitimate interests; and withdraw consent at any time without affecting earlier lawful processing. You may complain to a competent supervisory authority, including in the EU country where you live, work or consider that an infringement occurred.

Requests may be made through contact form. GDPR requests are normally answered without undue delay and within one month; legally permitted extensions and reasons will be explained when relevant. This site does not make decisions based solely on automated processing that have legal or similarly significant effects on you.

10Contact and updates

For privacy questions, withdrawal, access/correction or other rights requests, use contact form and start your message with “Privacy request”. Requests go to Jeffrey Tan’s business email inbox. Material changes will be reflected in this notice and optional-processing consent will be renewed where needed.