Privacy Policy

1. Organisation responsible for this Policy

Elix Law LLC (UEN: 202610002K), a Singapore entity with its principal office at 2 Central Boulevard, #32-00, Singapore 018916 (the "Firm", "we", "us" or "our"), respects the privacy of individuals and is committed to handling personal data responsibly and in accordance with the Personal Data Protection Act 2012 of Singapore (the "PDPA") and other laws that apply to us.

This Privacy Policy explains how we collect, use, disclose, protect, retain and otherwise process personal data when you visit www.elixlaw.com (the "Website"), communicate or deal with us, attend our events, receive our updates, apply to work with us, or when we handle personal data in the course of our business and legal services.

This Policy should be read together with any notice given at the point of collection and any engagement letter, recruitment notice, event notice, form notice or other terms that apply to your relationship with us. A more specific notice prevails for the processing that it expressly covers. This Policy does not override legal professional privilege, professional duties, confidentiality obligations or any requirement of applicable law. If this Policy conflicts with applicable law, the law prevails.

2. Personal Data

In this Policy, "personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data together with other information to which we have or are likely to have access. References to processing personal data include collecting, recording, organising, storing, using, disclosing, transferring, anonymising and deleting it.

Parts 3 to 6A of the PDPA generally do not apply to "business contact information" as defined in the PDPA. Where that exception applies, references in this Policy to rights and obligations under those Parts are subject to it, although we may still handle that information for the purposes described here.

3. Personal data we may collect

Depending on how you interact with us and the nature of the matter, we may collect:

• identity and contact information, such as your name, title, organisation, job title, postal address, email address and telephone number;

• identification, verification and compliance information, such as nationality, date of birth, beneficial ownership information, source-of-funds information and records required for conflicts, know-your-client, anti-money laundering or sanctions checks. We collect, use or disclose national identification numbers and copies of identification documents only where required by law or necessary to establish or verify identity to a high degree of accuracy;

• client, matter and professional information, including instructions, correspondence, documents, transaction or dispute information, opinions, evidence and information about clients, counterparties, witnesses, experts, advisers and other persons connected with a matter;

• financial and administrative information, such as bank and payment details, billing records, invoices, tax information and transaction history;

• communications and relationship information, including enquiries, feedback, complaints, meeting notes, call records, interests, preferences and your history of dealings with us;

• event and marketing information, such as registrations, attendance, dietary or accessibility requirements, subscription choices and interactions with our publications or messages;

• recruitment information, such as qualifications, employment history, references, right-to-work information and information collected during an application or assessment;

• Website and technical information, such as IP address, browser and device type, operating system, referring pages, pages visited, dates and times, security logs, cookie identifiers and similar usage information; and

• other personal data that you choose to provide, or that we collect for a purpose notified to you or otherwise permitted by law.

4. How we collect personal data

We may collect personal data:

• directly from you, including through email, telephone calls, meetings, forms, subscriptions, event registrations, job applications and use of the Website;

• from clients and persons connected with a client or matter, including officers, employees, counterparties, witnesses, experts, co-counsel and other professional advisers;

• from our personnel, business partners, service providers, professional advisers, insurers and other persons with whom we deal;

• from publicly available and subscription sources, including corporate and land registers, court records, regulatory databases, professional directories, news sources, sanctions lists and social media;

• from public authorities, courts, tribunals, law enforcement or regulatory bodies where permitted; and

• automatically through the Website, its hosting and security infrastructure, and any cookies or similar technologies that are actually deployed.

If you provide personal data about another individual, you should be authorised to do so and, where required, have informed that person. This does not transfer our obligations under the PDPA to you; we will provide any notice, or rely on an applicable exception, as required.

5. Purposes for which we may use or disclose personal data

We may collect, use or disclose personal data for purposes including:

• considering whether to accept an engagement, conducting conflict and client-acceptance checks, opening and administering matters and providing legal or related services;

• communicating with clients and other persons, responding to enquiries, arranging meetings and managing our relationships;

• carrying out identity, know-your-client, anti-money laundering, counter-terrorist financing, sanctions, fraud-prevention and other legal or regulatory checks;

• handling transactions, disputes, investigations, court or tribunal proceedings and other matters, including working with counterparties, advisers, experts, witnesses, authorities and service providers;

• managing our business operations, including billing, payments, accounts, audits, insurance, records, knowledge management, document management, quality assurance and business continuity;

• administering and securing the Website, diagnosing faults, preventing misuse or attacks, maintaining access logs and improving the Website and our services;

• organising seminars, webinars and events, administering attendance and communicating with participants;

• sending legal updates, invitations and other business-development communications where permitted and after obtaining any consent required by law, recording preferences and enabling recipients to unsubscribe;

• recruiting and assessing candidates, checking references, conducting background checks where lawful and managing internships or employment applications;

• complying with laws, professional rules, court orders, regulatory requirements and requests from competent authorities, and establishing, exercising or defending legal rights;

• protecting individuals, our systems, premises, property and legal rights, including detecting or preventing fraud, misuse and security incidents;

• evaluating or carrying out a reorganisation, merger, transfer or other transaction involving all or part of our practice, where the disclosure is reasonably necessary, subject to applicable confidentiality duties, the PDPA's business-asset conditions and other appropriate safeguards; and

• any other purpose that we notify to you and for which we obtain any consent required by law.

6. Consent and other permitted processing

• We collect, use or disclose personal data only for purposes that a reasonable person would consider appropriate in the circumstances. Where the PDPA requires notification, we will inform you of the relevant purposes on or before collection and of any new purpose before using or disclosing the data for that new purpose. This Policy is not itself a request for blanket consent.

• We obtain consent where required, may rely on deemed consent only where the statutory conditions are met, and may collect, use or disclose personal data without consent only where authorised or required by the PDPA or other written law. Where we rely on deemed consent by notification or the legitimate-interests exception, we conduct and document the required assessment, implement reasonable measures to address adverse effects, and give the notice or disclosure required by the PDPA.

• We will not, as a condition of providing a product or service, require consent to the collection, use or disclosure of personal data beyond what is reasonable to provide that product or service. We may provide more specific notices or choices where the context requires them.

7. Disclosure of personal data

We disclose personal data only as reasonably necessary for the purposes stated in section 5 or as permitted or required by law, and subject to applicable duties of confidentiality, legal professional privilege and professional conduct. Recipients may include:

• our partners, directors, employees, consultants and other personnel who need the information for their work;

• clients and persons connected with a matter, including counterparties, co-counsel, foreign counsel, barristers, experts, witnesses, mediators, arbitrators, process agents and other professional advisers;

• providers of hosting, cloud, cybersecurity, communications, document management, e-discovery, legal technology, payment, accounting, printing, archiving, marketing, event and other support services;

• banks, auditors, accountants, insurers, brokers and our own legal or professional advisers;

• courts, tribunals, regulators, tax authorities, law enforcement bodies, professional bodies and other public authorities;

• a proposed or actual successor, purchaser, merger partner or other transaction counterparty and its advisers, subject to appropriate safeguards; and

• any other person where you have authorised the disclosure or where disclosure is permitted or required by law.

We engage service providers under written arrangements that define their role and permitted processing and require safeguards appropriate to the data and service, including requirements relating to confidentiality, security, retention, incident reporting and overseas transfers. Some recipients determine their own purposes and are independently responsible for their processing. Using a service provider does not relieve us of obligations that remain ours under the PDPA.

Nothing in this Policy authorises disclosure contrary to client confidentiality, legal professional privilege or our professional duties. References to privilege do not mean that every Website communication is privileged or that submitting an enquiry creates a solicitor-client relationship; that depends on the circumstances and applicable law.

8. Transfers outside Singapore

Personal data may be stored in or accessed from countries outside Singapore. Before a transfer, we take appropriate steps to ascertain and ensure that the overseas recipient is bound by legally enforceable obligations, or a certification recognised under the PDPA regulations, to provide protection at least comparable to that under the PDPA, or we rely on another transfer route permitted by the PDPA. Due diligence and security measures supplement, but do not replace, the applicable transfer mechanism.

9. Website, cookies and third-party services

• Technical and security data

  When you request a page from the Website, our servers and service providers may receive technical information needed to deliver the page, keep the Website secure, diagnose problems and maintain records of access. This may include your IP address, device and browser details, requested page, referring page and date and time of access. Security logs may be retained for longer where reasonably necessary to investigate an incident or protect legal rights.

• Cookies and similar technologies

  We use cookies and similar technologies that are reasonably necessary to operate and secure the Website and to provide functions that you request. These technologies may collect technical information such as your IP address, browser and device information, the pages requested and the date and time of access. We do not currently use advertising cookies or other non-essential cookies that collect personal data. You may block or delete cookies through your browser settings, although doing so may affect the operation of the Website. We do not treat a failure to change browser settings as consent to any collection, use or disclosure of personal data for which consent is required.

• External links and embedded services

  Following an external link takes you to a service with its own privacy notice. An embedded service on our pages may send data to its provider when it loads or when you interact with it; we describe such processing and obtain consent before activation where required. Nothing in this paragraph excludes responsibilities that apply to us.

• Children's personal data

  Our general Website is not designed specifically for children. If we knowingly collect personal data from a child through a digital service, we will provide an age-appropriate notice and seek consent from a parent or guardian where required by the PDPA or appropriate in the circumstances. This does not prevent us from handling a minor's personal data where relevant to legal services and permitted by law.

10. Accuracy, security and data breaches

We will make reasonable efforts to keep personal data accurate and complete where it is likely to be used to make a decision affecting an individual or disclosed to another organisation. Please tell us if information you have provided changes or is inaccurate.

We maintain reasonable administrative, physical and technical safeguards designed to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, and the loss of storage media or devices containing personal data. No system is completely secure, and we cannot guarantee absolute security. This statement does not limit our obligation under the PDPA to make reasonable security arrangements.

If we have credible grounds to believe that a data breach has occurred, we will take reasonable and expeditious steps to assess whether it is notifiable. Where it is notifiable, we will notify the Personal Data Protection Commission as soon as practicable and no later than three calendar days after making that determination. Where notification of affected individuals is required, we will notify them as soon as practicable after notifying the Commission, subject to statutory exceptions and any direction of the Commission.

11. Retention

Retention periods vary according to the nature and sensitivity of the data, the purposes for which it is used, and applicable professional, regulatory, tax, accounting, insurance, limitation and dispute requirements. We review retained data periodically. We cease to retain documents containing personal data, or remove the means by which the data can be associated with particular individuals, as soon as it is reasonable to assume both that the collection purpose is no longer served and that retention is no longer necessary for any legal or business purpose.

12. Your requests and choices

Access and correction

Subject to the PDPA and its exceptions, you may make a written request for: (a) access to personal data about you in our possession or under our control and information about the ways in which we used or disclosed it during the one-year period before the request; or (b) correction of an error or omission. Your request must contain sufficient detail to enable us to identify you and the data or correction sought with reasonable effort.

We will respond to an access request as soon as reasonably possible and make a correction as soon as practicable. If we cannot respond within 30 days, we will inform you in writing within that period of the time by which we expect to respond. We may charge a reasonable fee for an access request after giving you a written estimate and written notice of any higher estimate; we do not charge for a correction request. Where required, we will transmit corrected data to organisations to which we disclosed it to during the year before the correction.

We may ask for information to verify your identity and clarify the scope of a request. We may withhold or redact information only where the PDPA requires or permits, including information protected by legal professional privilege or whose disclosure would improperly reveal another person's personal data.

Withdrawal of consent

Where we rely on your consent, you may withdraw it by giving reasonable notice to the Data Protection Officer. Before giving effect to the withdrawal, we will inform you of the likely consequences. We will then cease, and cause our data intermediaries and agents to cease, the relevant collection, use or disclosure unless it is authorised or required without consent under the PDPA or other written law. Withdrawal does not affect processing lawfully carried out before it took effect.

Marketing communications

You may unsubscribe by using the facility in a marketing message or contacting us. For specified marketing messages to Singapore telephone numbers, we comply with the Do Not Call provisions, including applicable register-check or consent, identification, contact or caller-ID and opt-out requirements, and stop such messages within the prescribed period following a valid opt-out. For unsolicited commercial electronic messages sent in bulk, we comply with the Spam Control Act 2007, including applicable labelling, header, contact and unsubscribe requirements, and stop within 10 business days following a valid unsubscribe request. Unsubscribing from marketing does not prevent service, matter or legally required communications.

Contact

If you have a question, wish to make a request, withdraw consent or complain about our handling of personal data, please contact general@elixlaw.com via email.

Please include enough information for us to understand your request. We may verify your identity before acting. We will review complaints and seek to respond within a reasonable time. If you remain dissatisfied, you may contact the Personal Data Protection Commission of Singapore.

Changes to this Policy

We may amend this Policy from time to time to reflect changes in law, technology, our Website or our practices. The current version will be posted on the Website with its effective date and last-updated date, and we retain prior versions in accordance with our records practices. Where appropriate, we may provide additional notice of a material change.

Posting a revised Policy does not by itself authorise a new use or disclosure. Where the PDPA requires, we will notify you of a new purpose before use or disclosure and obtain consent or rely on an applicable exception.

This Policy is primarily intended to explain our practices under the Singapore PDPA. Additional notices may apply to particular services, relationships or jurisdictions and, to the extent of inconsistency, the more specific notice applies.