PDPA Compliance

The data protection contact for EnneaDate is Stanley Ang. All PDPA requests, questions, and complaints go to admin@enneagramsingapore.org with the subject line "PDPA request".

Acknowledgement within one business day; substantive response within 30 days, as the Act requires.

• Consent — collected separately for each purpose, in plain language, and withdrawable at any time. See Consent & Data Use.
• Purpose limitation — data is used only for delivering coaching, following up, agreed agency summaries, consented testimonials, and statutory record-keeping.
• Notification — purposes are stated before collection, on the form itself.
• Access and correction — you may request a copy of your personal data or ask for a correction at any time.
• Accuracy — records are updated as you tell me things have changed; nothing is inferred and stored as fact.
• Protection — access limited to the founder, credentials held in a password manager, transport encryption on all forms, and no personal data kept on unmanaged devices.
• Retention limitation — data is deleted once the purpose is served, on the schedule published in the Privacy policy.
• Transfer limitation — overseas processors are used only on terms providing comparable protection.
• Accountability — one named person is responsible, and these notes are the published record of practice.

EnneaDate does not run telemarketing. Singapore mobile numbers are collected only for scheduling and session logistics relating to an engagement you have entered into, and are not used for marketing messages.

If a breach occurs that is likely to result in significant harm, or that meets the notifiable threshold, affected individuals and the Personal Data Protection Commission are notified without undue delay and within the timeframes set by the Act.

Being small does not lower the standard. It only means the chain of responsibility is short — the person who would tell you is the same person who coaches you.

EnneaDate operates under the founder's Singapore-registered practice. ACRA registration details are provided in full on any written service agreement, proposal, or invoice before payment or onboarding.

A plain, non-technical summary of what is collected, why, where it goes, who can access it, and the retention principle is on Trust & Due Diligence. Agencies should also read the sharing boundaries on the partners page, and can send a request through the enquiry form.

Raise it with me first — most matters are resolved in a single conversation. If you remain unsatisfied, you may bring the matter to the Personal Data Protection Commission of Singapore, which is your right under the Act.