Privacy Policy

1. Introduction

Persana ("we", "us", "our") is committed to protecting the personal data of individuals who interact with our services and website. This Privacy Policy explains how we collect, use, store, and disclose personal data in connection with our HR and AI consulting engagements and our website at persananes.live.

This policy is governed by the Singapore Personal Data Protection Act 2012 (PDPA). If you have questions, contact us at [email protected].

2. Data We Collect

We collect personal data in the following circumstances:

• Contact enquiries: Name, email address, phone number, and the content of your message when you submit our contact form
• Client engagement data: Information you provide during the course of an engagement, which may include HR data files, organisational information, and related documentation — handled under a separate data processing agreement
• Website usage data: Analytics data collected via cookies (subject to your consent) including pages visited, browser type, and approximate location
• Communications: Email and phone correspondence related to enquiries and engagements

3. Legal Basis and Purpose of Processing

We process personal data on the following bases under the PDPA:

• Consent: Analytics cookies and optional communications are processed with your consent
• Contract performance: Data necessary to deliver engagement services to clients
• Legitimate interests: Responding to enquiries, managing our business operations, and improving our services

We use the data we collect to: respond to contact enquiries; deliver and administer consulting engagements; improve our website; comply with legal obligations; and communicate with you about your engagement or follow-up matters.

4. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Contact form submissions: up to 24 months from the date of submission
• Engagement data: retained for the duration of the engagement plus 12 months, then securely deleted unless a longer retention period is agreed in writing
• Analytics data: up to 26 months, in line with standard analytics retention practices

5. Data Sharing

We do not sell your personal data. We may share personal data with:

• Service providers: Third-party providers who assist with website hosting, email delivery, and analytics — subject to appropriate data processing agreements
• Legal requirements: Where disclosure is required by law, regulation, or a lawful order from a regulatory authority

We do not share client engagement data with third parties except as required by law or as expressly agreed with the client in writing.

6. Data Protection Measures

We apply appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction. These include:

• Secure, encrypted storage for data files shared during engagements
• Access restricted to practitioners directly involved in the relevant engagement
• Secure deletion of engagement data at the end of the retention period
• Regular review of data handling practices

7. Cookies

Our website uses cookies to understand how visitors use the site and to improve the experience. You can manage your cookie preferences at any time via our Cookie Policy page. Essential cookies are required for the site to function and cannot be disabled.

8. Your Rights Under the PDPA

Under the Singapore PDPA, you have the right to:

• Request access to personal data we hold about you
• Request correction of inaccurate or incomplete personal data
• Withdraw consent to the processing of your personal data (where processing is based on consent)
• Request that we cease using your personal data for marketing purposes

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal data.

10. Children's Privacy

Our services are directed at HR professionals and business stakeholders. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Policy Updates

We may update this Privacy Policy from time to time. Significant changes will be communicated via email or a notice on our website. Continued use of our services following notification of changes constitutes acceptance of the updated policy.

12. Contact Information

For privacy-related questions or to exercise your rights under the PDPA:

• Email: [email protected]
• Address: 138 Market Street, #26-03, CapitaGreen, Singapore 048946
• Phone: +65 6463 7218

For disputes that cannot be resolved directly, you may contact the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.