Latch

Privacy Notice

Last updated: 13 August 2026

This Privacy Notice explains how Promo Nest Vault Pte. Ltd. ("we", "us", "our") collects, uses, discloses and protects personal data in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA"). By using this website or contacting us, you acknowledge that you have read and understood this notice.

1. Data controller

The data controller responsible for your personal data is:

Promo Nest Vault Pte. Ltd.
18 Teck Lim Road, #02-03
Singapore 088387
Email: [email protected]

2. Personal data we collect

We may collect the following categories of personal data depending on how you interact with us:

  • Contact data: name, email address, telephone number, job title and organisation name when you write to us at [email protected] or [email protected].
  • Communication data: the content of messages you send us, including attachments such as briefs, brand materials and positioning documents shared for the purpose of evaluating or conducting an engagement.
  • Technical data: IP address, browser type, device type, operating system, referring URL and pages visited, collected automatically when you browse this website.
  • Cookie data: preferences stored through our cookie consent mechanism, including your choices regarding functional and analytics cookies. See our Cookie Notice for details.
  • Engagement data: if you become a client, we collect information necessary to perform our services, including stakeholder names, interview notes and project records.

We do not collect sensitive personal data through this website. We do not knowingly collect data from individuals under eighteen years of age.

3. How we collect personal data

We collect personal data through the following channels:

  • Direct correspondence via email or telephone when you contact us.
  • Automatic collection through server logs and cookies when you visit this website.
  • Third-party services embedded on this site, including Google Maps, which may collect data according to their own privacy policies.
  • Professional interactions during engagements, including stakeholder interviews and workshop participation.

4. Purposes of collection, use and disclosure

We collect and use personal data for the following purposes:

  • To respond to enquiries about our brand strategy and editorial services.
  • To evaluate whether an engagement is appropriate for both parties.
  • To perform services under agreed scope, including positioning work, narrative development and editorial programmes.
  • To maintain project records and deliver written documents to clients.
  • To comply with legal and regulatory obligations in Singapore.
  • To improve this website's functionality and user experience, where you have consented to functional or analytics cookies.
  • To protect our legitimate interests, including fraud prevention and security monitoring.

We do not sell personal data. We do not use personal data for automated decision-making or profiling.

5. Legal basis for processing

Under the PDPA, we rely on the following bases for processing personal data:

  • Consent: where you have provided consent, such as for optional cookies or for receiving follow-up communications.
  • Contractual necessity: where processing is necessary to evaluate or perform a service agreement.
  • Legitimate interests: where processing is necessary for our legitimate business interests, such as responding to enquiries or maintaining website security, provided these interests are not overridden by your rights.
  • Legal obligation: where processing is required to comply with applicable law.

6. Disclosure of personal data

We may disclose personal data to the following categories of recipients:

  • Service providers who assist with hosting, email delivery and technical infrastructure, bound by confidentiality obligations.
  • Professional advisers including legal counsel and accountants, where necessary.
  • Government authorities or regulators when required by law or legal process.
  • Collaborators engaged on specific client projects, with client consent where required.

We require all third parties to respect the security of personal data and to process it in accordance with applicable law. We do not permit third-party service providers to use personal data for their own marketing purposes.

7. International transfers

Personal data is primarily stored and processed in Singapore. Where data is transferred outside Singapore, we ensure appropriate safeguards are in place as required by the PDPA, including contractual protections with receiving parties.

8. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Enquiry correspondence: up to twenty-four months after last contact, unless an engagement begins.
  • Client project records: duration of engagement plus seven years for professional record-keeping.
  • Technical and cookie data: as specified in our Cookie Notice, typically up to one hundred and eighty days for consent records.
  • Server logs: up to ninety days unless required for security investigation.

After retention periods expire, data is securely deleted or anonymised.

9. Your rights under the PDPA

Subject to exceptions under the PDPA, you have the following rights:

  • Access: request access to personal data we hold about you.
  • Correction: request correction of inaccurate or incomplete personal data.
  • Withdrawal of consent: withdraw consent for processing that relies on consent, without affecting the lawfulness of prior processing.
  • Portability: where applicable, request a copy of your data in a commonly used format.

To exercise these rights, write to [email protected]. We will respond within thirty days. We may request verification of identity before processing requests.

10. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These measures include encrypted connections (HTTPS), access controls, secure storage and staff training on data handling practices.

No method of transmission over the internet is completely secure. While we strive to protect personal data, we cannot guarantee absolute security.

11. Third-party links and embeds

This website contains embedded Google Maps on every page. When you interact with the map, Google may collect data including IP address and device information according to Google's Privacy Policy. We embed maps to show our studio location and do not control Google's data practices.

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy notices.

12. Changes to this notice

We may update this Privacy Notice from time to time. Changes will be posted on this page with a revised "Last updated" date. Material changes will be communicated where required by law.

13. Children

This website is intended for business professionals and is not directed at individuals under eighteen years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

14. Marketing communications

We do not send unsolicited marketing emails. If you contact us through [email protected], we may respond with information relevant to your enquiry. We will not add your address to a mailing list without explicit consent. You may opt out of follow-up communications at any time by replying to the message or writing to [email protected].

15. Do Not Track signals

Some browsers offer a Do Not Track (DNT) setting. There is no universal standard for responding to DNT signals. We do not currently alter our data practices in response to DNT headers. You may manage cookies through our consent banner or your browser settings as described in our Cookie Notice.

16. Data breach notification

In the event of a data breach that is likely to result in significant harm or affect a significant number of individuals, we will notify the Personal Data Protection Commission of Singapore and affected individuals as required under the PDPA. Our internal incident response procedure includes containment, assessment, notification and remediation steps.

17. Accuracy of personal data

We take reasonable steps to ensure personal data we hold is accurate and complete. You are responsible for providing accurate information when contacting us. If your contact details change during an engagement, please notify us so records remain current.

18. Third-party processors

Where we engage processors to handle personal data on our behalf, we require contractual terms that mirror PDPA obligations: purpose limitation, security measures, confidentiality, sub-processor controls and deletion upon termination. We maintain a register of processors and review their practices periodically.

19. Contact and complaints

For privacy enquiries, data access requests or complaints, contact:

Email: [email protected]
Post: Promo Nest Vault Pte. Ltd., 18 Teck Lim Road, #02-03, Singapore 088387

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore. We will cooperate fully with any investigation and provide records requested within applicable legal limits.