This Privacy Policy explains how Difgen Holdings Pte. Ltd. collects, uses, stores and protects personal information in the course of running its holding company administration desk. The policy is published by Difgen Holdings Pte. Ltd., a company registered in Singapore with its office at 10 Bukit Batok Crescent #10-05B The Spire, Singapore - 658079, Singapore (SG).
The developer and operator of this website is Difgen Holdings. This policy applies to every page of this website, to every message sent to the desk by email or telephone, and to every document that a director, officer or counterparty shares with the desk in connection with holding administration work.
We have written this policy in plain language on purpose. If any part of it is unclear, write to office@difgenholdings.buzz or call +15676998908 and we will explain the point directly.
1. Who We Are
Difgen Holdings Pte. Ltd. is a private holding company that administers its own corporate records and the records of the group entities under its care. The company is registered in Singapore and works from a single desk at The Spire. For the purposes of Singapore personal data protection law and, where applicable, comparable laws in other jurisdictions, Difgen Holdings Pte. Ltd. is the organisation responsible for the personal information described in this policy.
The company does not sell personal information. It does not operate an advertising network. It does not build behavioural profiles of visitors to this website for commercial gain. The information described here is collected because a holding administration desk cannot function without knowing who its directors are, which entity a document belongs to, and how to reach the person who asked a question.
Where the company acts on the instruction of a group entity, that entity may also be responsible for the same information under its own policies. In those cases the company acts as a processor for the entity, and the entity remains the party that answers to the individual concerned. We explain this distinction in the section on corporate records below.
2. Scope of This Policy
This policy covers personal information collected through this website, through email and telephone contact with the desk, and through the administration of corporate records. It applies to directors, officers, shareholders, employees of group entities, professional advisers, counterparties and visitors to the website.
This policy does not cover the practices of third parties whose websites are linked from this site, nor does it cover information held by a bank, notary, auditor or law firm in its own right. Those parties publish their own privacy notices, and we encourage you to read them before sharing information with them.
This policy also does not cover anonymous information that cannot be linked to an individual, or aggregated information about how the website is used in general. Such information may be used for operational and security purposes without restriction.
3. Information We Collect
We collect only the information that a desk of this kind needs. The categories are as follows.
Identity and contact information
This includes a name, job title, company or entity name, email address, telephone number, postal address and, where relevant, identification details provided for vault access or signing. We collect this when you write to the desk, call the office line, submit the contact form or attend an appointment at The Spire.
Correspondence
We keep the content of emails, letters, contact form messages and notes taken during telephone calls. We keep these records because a holding administration desk has to be able to show what was asked, what was answered and when.
Corporate and statutory information
This includes the names of directors and officers, shareholding details, dates of appointment and resignation, resolutions, meeting attendance and the content of statutory registers. Much of this information is required by law to be kept, and some of it is filed with public authorities.
Financial information relating to entities
In the course of intercompany invoice reviews and return cycles we handle entity level financial information such as invoice amounts, agreement references, ledger entries and period dates. This is business information about companies, but it may include the names of individuals who approved a payment or signed an invoice.
Website technical information
Our web server records the internet protocol address of visitors, the browser type, the pages requested and the time of the request. These records are used for security, for diagnosing faults and for understanding which pages are useful. We do not use them to identify individual visitors unless there is a security incident that requires investigation.
Information you choose to give us
You may choose to give us additional information in a message, for example a description of a family structure, a history of a company or a note about a missing document. We use that information for the purpose for which you sent it and for the administration work that follows.
4. Sources of Information
Most of the information we hold comes directly from the individual concerned. A director writes to the desk, a counterparty sends a signed agreement, a shareholder provides identification for a transfer. In those cases the individual knows what has been shared and why.
Some information comes from the entity rather than from the individual. A group company may provide a register of directors, an attendance schedule or a list of authorised signatories. Where an entity provides information about an individual, we rely on that entity to have given the individual the notice required by law.
A smaller amount of information comes from public sources. We may check a public company register to confirm a director appointment, a filing date or a registered address. We may also receive information from professional advisers such as auditors, notaries and lawyers who are working on the same matter.
Website technical information is generated automatically when a browser requests a page from our server.
5. Why We Use Information
We use personal information for the following purposes, each of which is connected to the administration of a holding structure.
- To answer enquiries sent to the desk by email, telephone or contact form.
- To prepare board papers, resolutions and attendance schedules for meetings.
- To prepare and lodge subsidiary returns and to keep the supporting resolutions together with them.
- To reconcile vault files against the register and to record the release and return of originals.
- To review intercompany invoices against agreements and ledger entries.
- To bind minutes into volumes and to keep the index accurate.
- To maintain the annual filing calendar and to warn directors of approaching dates.
- To meet obligations under company law, tax law and anti money laundering law.
- To protect the security of the office, the vault and the website.
- To keep records of the work done so that the desk can answer questions years later.
We do not use personal information for automated decision making that produces legal effects for an individual. We do not use personal information to train external artificial intelligence models, and we do not sell or rent personal information to any third party.
6. Legal Basis for Processing
Where the law requires a legal basis for processing, we rely on one or more of the following.
Consent
We rely on consent when you send us a message through the contact form or ask to receive information from the desk. You may withdraw consent at any time by writing to office@difgenholdings.buzz. Withdrawal does not affect work that was already carried out lawfully before the withdrawal.
Contract
We rely on contract when processing is necessary to provide administration services to a group entity or to take steps at the request of that entity before a service arrangement is confirmed.
Legal obligation
We rely on legal obligation when we keep statutory registers, file returns, retain records for a minimum period or respond to a lawful request from a public authority.
Legitimate interests
We rely on legitimate interests when we protect the security of the office and the website, when we keep correspondence for the purpose of answering later questions, and when we maintain the accuracy of the annual filing calendar. Where we rely on legitimate interests we balance those interests against the rights of the individual and we limit the processing to what is needed.
7. Corporate Records and Vault Files
A holding administration desk keeps records that belong, in law, to the entities it serves. Those records often contain personal information: the names of directors, the signatures on resolutions, the identity documents attached to a share transfer. We hold this information in the vault and in the minute books on behalf of the entity concerned.
When we act on behalf of a group entity in this way, the entity decides what is kept and for how long, subject to the minimum periods required by law. We follow the entity instruction, keep the records secure, and do not use them for our own purposes. If you are a director of such an entity and wish to exercise a right over a corporate record, the entity is the party that can act on your request, and we will assist it.
Where the company itself is the entity that owns the record, for example a record of its own board or its own shareholders, the company is directly responsible for the information, and this policy applies in full.
Original documents are released from the vault only against a recorded request. We keep the name of the person who collected the document, the date of release and, where a courier is used, the tracking reference. That record is itself personal information, and it is kept for the same period as the vault register.
9. Website Analytics
We review server logs to understand which pages are visited, which browsers are used and whether any page is failing to load. The logs contain internet protocol addresses, and we treat those addresses as personal information even though we do not attempt to identify visitors from them.
We do not use third party analytics that build cross site profiles. We do not use fingerprinting techniques. We do not track visitors across other websites. If we ever adopt a measurement tool, it will be configured to avoid collecting more than the aggregate counts we need, and this policy will be updated before the tool goes live.
Log records are kept for a short operational period and then deleted or anonymised, unless they are needed for a security investigation or a legal claim.
11. Service Providers
We use a small number of service providers to run the website and the office. These include a hosting provider, an email provider and a records storage provider. Each provider is chosen for reliability and security, and each is bound by a written agreement that limits its use of personal information to the service it provides to us.
Service providers are not permitted to use our information for their own marketing, to sell it, or to combine it with information from other clients. Where a provider processes information outside Singapore, we require appropriate safeguards and we assess the legal environment of the destination before any transfer.
We review our service providers periodically. If a provider fails to meet the standard set out in its agreement, we take steps to remedy the failure or to replace the provider.
12. International Transfers
Difgen Holdings Pte. Ltd. works from Singapore, and most of the information we hold stays in Singapore. Some service providers operate servers in other countries, and some group entities are registered outside Singapore. In those cases personal information may be transferred across a border.
Before any transfer we confirm that the receiving party is bound by contractual terms that provide a standard of protection comparable to the standard applied in Singapore. We consider the nature of the information, the purpose of the transfer and the legal environment of the destination. Where the destination does not offer adequate protection and no appropriate safeguard is available, we do not make the transfer.
If you would like to know whether your information has been transferred outside Singapore, write to the desk and we will explain the position for your matter.
13. Retention of Records
We keep personal information only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. Retention periods differ by category.
- Enquiries that do not lead to an engagement are deleted within twelve months.
- Correspondence about an active engagement is kept for the life of the engagement and for seven years after it ends.
- Statutory registers and minute books are kept permanently, because company law and the needs of the entity require it.
- Vault release records are kept for the same period as the vault register itself.
- Server logs are kept for a short operational period and then deleted.
- Financial records relating to entity transactions are kept for the period required by tax law.
When a retention period ends, the information is deleted or, where deletion is not practical because it is bound into a physical volume, the volume is retained as an archive with access limited to the desk. We do not keep personal information indefinitely merely because storage is inexpensive.
14. Security Measures
The office at The Spire has a controlled entrance, a locked vault and a record of every person who signs in. Paper records are kept in locked cabinets when the desk is unattended, and the vault is opened only by a named member of the team.
Digital records are held on systems protected by strong passwords, multi factor authentication and encryption in transit. Access is granted by role, so that a person who works on return cycles does not automatically have access to the vault register. Access is reviewed when a team member leaves or changes role.
We train the team on handling personal information, on recognising fraudulent requests, and on the steps to take if a document is lost. We test our backups so that a record can be recovered if a system fails. No system is perfect, and we do not claim otherwise, but we do take the ordinary and extraordinary steps that a careful desk should take.
If you receive a message that appears to come from Difgen Holdings Pte. Ltd. but asks for credentials, payment or a change of bank details, do not respond. Call the office line on +15676998908 to confirm before you act.
15. Your Rights
Subject to the law that applies to you, you may have the following rights over your personal information.
Access
You may ask for a copy of the personal information we hold about you and for an explanation of how it has been used.
Correction
You may ask us to correct information that is inaccurate, incomplete or out of date. Where a statutory register is corrected, the correction must follow the procedure set by company law, and we will explain that procedure.
Deletion
You may ask us to delete information that we no longer have a lawful reason to keep. We cannot delete information that we are required to keep by law or that is bound into a minute book, and we will tell you plainly when that is the case.
Objection and restriction
You may object to processing based on legitimate interests, or ask us to restrict processing while a question about accuracy is resolved.
Portability
Where the law provides a right to portability, we will provide the relevant information in a structured and commonly used format.
Withdrawal of consent
Where we rely on consent, you may withdraw it at any time. We will stop the processing that relied on consent, though we may continue to hold the information where another legal basis or a retention obligation applies.
To exercise any right, write to office@difgenholdings.buzz with enough detail for us to identify you and the information concerned. We will respond within the period set by law, normally within thirty days, and we will explain any delay. We do not charge for a first request unless the request is manifestly unfounded or repetitive.
16. Privacy for Children
This website and the services of Difgen Holdings Pte. Ltd. are intended for companies, directors and professional advisers. They are not directed at children, and we do not knowingly collect personal information from anyone under the age of eighteen.
If we learn that we have collected information from a child, we will delete it promptly unless we are required by law to keep it. If you believe that a child has sent information to the desk, write to office@difgenholdings.buzz and we will act on the message.
17. Marketing Communications
The desk does not run a newsletter and does not send promotional email to a purchased list. If we send an update about a service, it is because you asked for it or because you are a director of an entity the desk serves and the update concerns that entity.
You may ask to stop receiving any update at any time by replying to the message or writing to office@difgenholdings.buzz. We will remove you from the list within a reasonable period and will keep only the minimum record needed to honour your request.
We do not use personal information obtained through the vault or through statutory filings for marketing purposes.
18. Third Party Links
This website contains a small number of links to other pages, such as the services page and the terms of service. It may also, from time to time, link to the website of a professional body or a public register. Those sites are not under our control, and their privacy practices are their own.
We check links before publishing them, but we do not monitor the content of third party sites. If you follow a link and are asked for personal information, read the privacy notice of that site before you proceed.
19. Data Breach Response
If we become aware of a breach involving personal information, the desk follows a written response plan. The plan begins with containing the breach, then assessing what was affected and who may be harmed, then notifying the appropriate authority and the individuals concerned where the law requires it.
Where a breach involves a physical document, the response includes a search of the office, a review of the vault release record and, where needed, contact with the courier. Where a breach involves a digital system, the response includes revoking access, restoring from a clean backup and reviewing how the access was obtained.
We keep a record of every breach and every step taken in response. That record is reviewed by the desk so that the same failure does not happen twice. If you believe that information about you has been compromised, contact the desk immediately on +15676998908.
20. Changes to This Policy
We review this policy at least once a year and whenever we change a system, a service provider or a practice that affects personal information. The effective date at the top of the page tells you when the current version took effect.
Where a change materially affects how personal information is used, we will give notice on this page before the change takes effect and, where we have an email address for you in connection with an active matter, we will write to that address. Continuing to use the website or the desk after a change takes effect means that the updated policy applies.
Previous versions are kept with the desk records and can be provided on request.
21. Complaints and Contacts
If you are unhappy with how we have handled personal information, please tell us first. Most concerns can be resolved quickly by a conversation with the desk. Write to office@difgenholdings.buzz, call +15676998908, or send a letter to the address below.
Difgen Holdings Pte. Ltd.
10 Bukit Batok Crescent #10-05B The Spire, Singapore - 658079, Singapore (SG)
Email: office@difgenholdings.buzz
Phone: +15676998908
We will acknowledge a complaint within five business days and give a substantive reply within thirty days. If you are not satisfied with the reply, you may refer the matter to the personal data protection authority in Singapore or, where the law of your own country gives you that right, to the authority there.
This policy is published by Difgen Holdings Pte. Ltd. and applies to the website at www.difgenholdings.buzz and to the desk at The Spire.