Mon–Fri 10:00–18:30 SGT · Smith Street, Chinatown
ClickCraft Nest

Privacy

Privacy notice

Last updated: 14 August 2026

ClickCraft Nest Pte. Ltd. ("ClickCraft Nest", "we", "us") respects your privacy. This notice explains how we collect, use, disclose, and protect personal data when you visit clickcraftnest.life, contact us by email or telephone, or engage our composing services. It is written in accordance with the Personal Data Protection Act 2012 (PDPA) of Singapore.

Data controller

ClickCraft Nest Pte. Ltd., 18 Smith Street, #03-01, Singapore 058934. Privacy contact: [email protected].

What we collect

Website technical data: When you browse this site, our hosting provider may log IP address, browser type, pages visited, and timestamps. These logs are used for security and troubleshooting.

Cookie and consent data: If you interact with our cookie banner, we store your category choices in a cookie (ccn_consent) and localStorage mirror for up to 180 days. See Cookies.

Google Maps: Every page embeds Google Maps. Google may collect data according to its own policies when the map loads. We disclose this on our cookie page.

Contact data: If you email or telephone us, we collect your name, organisation, email address, phone number, and the content of your message.

Engagement data: If you become a client, we collect brief materials, correspondence, approval records, and billing contact details necessary to perform our services.

Purposes of use

Legal basis

We process personal data on the basis of consent (cookie choices, marketing contact where applicable), contractual necessity (client engagements), and legitimate interests (security logging, responding to unsolicited enquiries).

Disclosure

We do not sell personal data. We may disclose data to:

International transfers

Some service providers may process data outside Singapore. Where this occurs, we require appropriate contractual protections consistent with PDPA requirements.

Retention

Enquiry emails are retained for up to twenty-four months unless an engagement follows. Client project records are retained for seven years after project close for legal and business purposes. Cookie consent records follow the period stated on our cookie page. Server logs are rotated within ninety days.

Security

We use organisational and technical measures appropriate to the data we hold: access controls, encrypted transport (HTTPS), and limited staff access. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

Your rights under PDPA

You may request access to, correction of, or withdrawal of consent for your personal data, subject to legal exceptions. Contact [email protected]. We respond within thirty days. You may also lodge a complaint with the Personal Data Protection Commission of Singapore.

Children

This site is not directed at children under thirteen. We do not knowingly collect data from children.

Changes

We may update this notice. The "Last updated" date will change. Material changes will be noted on this page.

Contact

[email protected] · ClickCraft Nest Pte. Ltd., 18 Smith Street, #03-01, Singapore 058934

Collection from third parties

We may receive your contact details when a colleague introduces us, or when you register for an event where we speak. In those cases, we use data only for the purpose explained at collection.

Do Not Call Registry

We honour Singapore Do Not Call preferences for marketing voice and text messages. Service-related contact about an active engagement is excluded from marketing rules.

Automated decision-making

We do not make decisions with legal or similarly significant effects solely by automated means.

Data breach notification

If a breach likely to cause significant harm occurs, we will notify affected individuals and the Personal Data Protection Commission as required by PDPA.

Records of consent

Where we rely on consent, we maintain records of when and how consent was given, and honour withdrawals promptly.

Access procedure

To request access, email [email protected] with sufficient detail to locate your records. We may request verification of identity. A reasonable fee may apply for manifestly unfounded or excessive requests as permitted by law.

Correction procedure

If personal data we hold is inaccurate, email us with corrections. We will update records within thirty days where appropriate.

Marketing communications

We do not send bulk marketing email without consent. Enquiry replies and engagement correspondence are service communications, not marketing.

Photographs on this site

Photographs on clickcraftnest.life are studio and street documentation. They do not depict client work or identifiable client personnel unless separately agreed in writing.

Personal data of employees and contractors

We hold employment and contractor records separately from client data under internal HR policies. Those individuals may contact [email protected] for access requests relating to their employment data.

Project materials

Briefs and drafts may contain personal data about your customers or employees that you control. We process such data only as processor under your instructions and our engagement letter. We return or delete project copies according to the lockup unless law requires retention.

Aggregated analytics

We may derive aggregated, non-identifying statistics from server logs for capacity planning. Aggregates cannot reasonably identify individuals.

Complaints handling

Privacy complaints are acknowledged within five business days and investigated promptly. We document outcomes and remedial steps.

Version history

Previous privacy notices are available on request. Material changes are summarised at the top of this page when they occur.

Definitions

"Personal data" follows the PDPA definition. "Processing" includes collection, use, disclosure, and storage. "Client" means an organisation with a signed engagement letter.

Supervisory authority

Personal Data Protection Commission, Singapore. Website: pdpc.gov.sg

Processing activity record

We maintain an internal record of processing activities covering website hosting, client engagements, and HR. Summaries are available to regulators on request.

Vendor management

Hosting and email providers are selected for reliability and PDPA alignment. Contracts include confidentiality and security clauses where appropriate.

Minimisation principle

We collect only data needed for stated purposes. Briefs should not include unnecessary personal data; we return excess data or request redaction.

Accuracy obligation

We take reasonable steps to ensure personal data is accurate and complete for its purpose. Clients must notify us of corrections to contact details.

Protection obligation

Access to client folders is limited to staff on the engagement. Passwords are unique; devices are encrypted where supported.

Retention schedule summary

Enquiries: 24 months. Client projects: 7 years. Cookie consent: 180 days. Server logs: 90 days rotation.

Cross-border clients

Regional clients remain data controllers for their customer data in briefs. We act as processor and document flows in engagement letters.

Data portability

Where applicable, we provide project copies in common formats upon request at engagement close.

Anonymous data

We do not attempt to re-identify anonymised aggregates.

Training data

Client materials are not used to train machine learning models.

Physical records

Marked galleys and signed sheets may exist on paper in the studio. Paper is stored locked and shredded when retention expires.

Contacting the PDPC

If you remain unsatisfied after contacting us, you may approach the Personal Data Protection Commission with your complaint reference.

Consent for photography

Studio portraits on this site depict staff who consented to publication. Client work is never photographed without written agreement.

Email security

Email is not encrypted end-to-end. Do not send highly sensitive personal data by email unless you accept that risk.

Retention schedules

Contact correspondence is retained for the duration of the engagement and up to seven years thereafter for legal and accounting purposes unless a shorter period is agreed. Cookie consent records are retained for one hundred and eighty days from the date of choice, then refreshed on next visit. Map embeds may process data under Google's policies independently of our retention.

You may request access, correction, or withdrawal of consent by writing to [email protected]. We respond within thirty days unless complexity requires extension under the PDPA.

We do not sell personal data. We do not use automated decision-making with legal effect on individuals. Cross-border transfer may occur when you correspond from outside Singapore; we apply reasonable safeguards consistent with the PDPA.

Privacy · Smith Street office

Data processors: hosting and mail infrastructure may process personal data on our behalf under contract. Processors are selected for reasonable security practices and data handling aligned with the PDPA. We review processors periodically and update this notice when material changes occur.