1. Scope of this policy
This policy applies to personal data that we collect and handle in the course of running the hold desk and this website. It covers visitors who read the pages, prospective clients who send an enquiry, clients who engage the desk for register or term administration, and individuals who are named in documents that clients send to us for safekeeping or review.
The policy does not cover data that a client keeps in its own systems. Where a client sends us a register extract or a term sheet, the client remains responsible for the accuracy of that document and for its own privacy obligations towards the people named in it. We handle the document as a service provider and only for the purposes described below.
The policy also does not cover the practices of custodians, administrators, auditors or advisers that we deal with on a client behalf. Those organisations maintain their own privacy notices, and we encourage you to read them.
Where this policy refers to Singapore law, it means the laws of Singapore as they stand at the date shown at the foot of this page. Where a client is established in another jurisdiction, we will discuss any additional local requirement at the intake meeting and, if necessary, supplement this policy with a short schedule.
2. Who controls your data
The data controller is JTR HOLDINGS PTE. LTD., a company with its registered office at 15 MOHAMED SULTAN ROAD, #02-01, 238964, Singapore (SG). The hold desk is the internal team that operates the website and the administrative services, and it is the first point of contact for any privacy question.
The developer JTR Holdings built and maintains the website, including the forms and the page content. The developer acts on the instructions of the Company and does not use personal data for any purpose of its own. Where the developer needs access to a server log or a mailbox in order to keep the site running, that access is limited to what the task requires and is logged.
If you have a question about the identity of the controller for a specific record, write to office@jtrholdings.buzz and state the record you are asking about. The desk will confirm the position in writing.
3. Personal data we collect
We collect only what the work requires. The categories below describe the data that most often reaches the desk.
Identity and contact data
Your name, job title, organisation, postal address, email address and telephone number. For a corporate client we may also hold the names of directors, company secretaries and authorised signatories, together with the evidence of their authority.
Correspondence data
The content of emails, letters, call notes and meeting notes, including attachments that you choose to send. Where a call is noted for the file, the note records the date, the participants, the subject and the actions agreed.
Register and term data
Instrument descriptions, account references, custodian names, statement dates, renewal dates, notice windows and the identity of the people who sign or approve each document. This category may contain personal data where an individual is named as a holder, a signatory or a contact.
Website technical data
The pages you request, the date and time of the request, the browser type you use, the referring page and the approximate region from which the request came. This data is generated by the web server as a routine part of serving a page.
Form data
The name, email address, subject and message that you enter into the contact form. The form on this site prepares an email in your own mail program rather than sending the content to a server side store, so the message reaches us in the same way as any other email you send.
We do not ask for identity card numbers, passport numbers, bank account numbers or health data through this website. If a client needs to send such a document for a legitimate administrative reason, the desk will arrange a secure channel and will advise on the minimum data required.
4. Sources of personal data
Most of the personal data we hold comes directly from the person concerned. You give us your details when you send an enquiry, when you attend an intake meeting, when you sign a document or when you correspond with the desk.
Some data comes from the client organisation. A company may give us the names and contact details of its directors and signatories so that we can prepare board papers and route documents for signature.
Some data comes from custodians, administrators and advisers. A custodian statement may name an authorised contact, and a term sheet may name the individuals who signed the original agreement. We record those names because the register would be incomplete without them.
A small amount of data is generated automatically when you visit the site, as described in the technical data section above. We do not buy personal data from list brokers, and we do not enrich our records from social media profiles.
5. Purposes of processing
We process personal data for the following purposes, each of which is tied to a specific part of the service.
- To answer an enquiry sent through the contact form, by email or by telephone.
- To arrange an intake meeting and to record what was discussed.
- To maintain the asset register and to reconcile each entry against a custodian statement.
- To review term sheets, to track renewal dates and to note notice windows.
- To liaise with custodians and administrators and to keep an open query log.
- To administer the dividend timetable and to reconcile amounts after payment.
- To prepare board papers and to file signed resolutions against the relevant register entry.
- To prepare and lodge statutory or regulatory filings and to keep evidence of lodgement.
- To keep the website secure, to diagnose faults and to understand which pages are used.
- To meet our own accounting, audit and record keeping obligations.
- To respond to a legal request, a court order or a regulatory enquiry.
- To send a service message about a document, a date or a decision that affects the client.
We do not process personal data for automated decision making that produces legal effects, and we do not build behavioural profiles for advertising. The desk exists to keep records legible, not to monetise the people named in them.
6. Our lawful bases
Under Singapore law we rely on consent, on the performance of a contract, and on the legitimate interests of the Company in running a documented administrative service. Where consent is the basis, we ask for it in plain language and we keep a record of when it was given.
Where the performance of a contract is the basis, the processing is necessary to deliver the service that the client has engaged. Examples include preparing a board pack, issuing a timetable or lodging a filing.
Where legitimate interests is the basis, we have carried out a balancing assessment and concluded that the interest does not override the rights of the individual. Examples include keeping server logs for security, maintaining an audit trail of signed documents, and answering a query that a director has raised about a register entry.
We may also process data to comply with a legal obligation, for example where a filing requires us to state a director name or where a regulator asks for a record. Where we rely on a legal obligation, we process only the data that the obligation requires.
8. Contact forms and email
The contact form on this website collects a name, an email address, a subject and a message. When you submit the form, the page prepares an email in your own mail program and opens it for you to send. The content is not transmitted to a server side database by the script itself.
Once the email reaches the office, it is stored in the desk mailbox and, where it relates to a live matter, it is filed against the relevant client record. Emails that do not relate to a live matter are kept in the general correspondence folder for the retention period described below and are then deleted.
If your mail program does not open, the page shows the office address so that you can write to us directly. The address is office@jtrholdings.buzz and the telephone number is +12344463752.
Please do not send sensitive documents by ordinary email. If you need to send a document that contains identity numbers or financial account details, contact the desk first and we will arrange a secure transfer.
9. Register and term records
The asset register and the term wall are the core records of the service. They contain information about holdings and agreements, and they may name individuals as holders, contacts or signatories. We treat the whole record as confidential business information and apply the same care to the personal data inside it.
Register entries are reconciled against custodian statements each quarter. Where a statement names an individual, the name is recorded exactly as the custodian has written it, together with the date of the statement, so that a later reader can see the source.
Term sheets are reviewed against the last signed version. Where a term sheet is subject to a confidentiality clause, we do not disclose its content outside the circle of people who need it for the review, and we do not quote it in a public document.
On the closure of an engagement, we return the source documents to the client or destroy them according to the client written instruction, subject to the retention obligations described below. A short closing note records what was returned and what was retained.
10. Custodian and adviser data
We hold contact details for the relationship managers, operations teams and escalation contacts at the custodians and administrators that a client uses. This data is business contact information, and we use it only to progress a query, obtain a statement or route a document.
Where an adviser, an auditor or a lawyer is named in a term sheet or a board paper, we hold the name and the contact details that appear in the document. We do not build a separate marketing list from these records.
If you are a contact at a custodian or an adviser and you would like us to update or remove your details, write to office@jtrholdings.buzz and the desk will action the request within a reasonable period, subject to any record that we must keep for an audit trail.
12. International transfers
The Company is established in Singapore and the office is at 15 MOHAMED SULTAN ROAD, #02-01, 238964, Singapore (SG). Some service providers, such as a hosting platform or an email provider, may store data on servers located outside Singapore.
Where data is transferred outside Singapore, we take reasonable steps to ensure that the recipient is bound by standards that are comparable to those in Singapore. Those steps include a written data processing agreement, a confidentiality obligation and, where appropriate, a recognised contractual framework for cross border transfers.
We keep a short transfer register that records the provider, the location of the servers, the categories of data transferred and the safeguard relied upon. The register is reviewed at the annual service review and updated when a provider changes.
If you would like to know whether a specific record is stored outside Singapore, write to the desk and we will confirm the position for that record.
13. Retention periods
We keep personal data only for as long as the purpose requires, and we apply the following periods as a general rule.
- Enquiries that do not lead to an engagement are kept for twelve months and then deleted.
- Correspondence on a live matter is kept for the duration of the engagement and for seven years afterwards.
- Register entries and term review sheets are kept for seven years after the closing of the engagement.
- Board papers and signed resolutions are kept for seven years after the sitting.
- Filings and evidence of lodgement are kept for the period required by the relevant regulator.
- Server logs are kept for ninety days and then deleted on a rolling basis.
- Accounting records are kept for five years after the end of the financial year to which they relate.
Where a legal hold applies, for example because a dispute is anticipated or a regulator has asked for records, the relevant data is preserved until the hold is lifted. We notify the client when a hold is placed and when it is released.
At the end of a retention period, data is deleted from the active systems and from the backup cycle in the ordinary course. A short deletion note records the date and the category of data removed.
14. How we protect data
We apply administrative, technical and physical safeguards that are proportionate to the sensitivity of the data. The measures below describe the standard that the desk works to.
- Access to a client file is limited to the members of the desk who work on that client.
- Accounts are protected by strong passwords and by a second factor where the platform supports it.
- Documents are stored in an environment that is separate from the public website files.
- Email is used for correspondence but not for documents that contain identity numbers.
- Paper records are kept in a locked cabinet in the office at Mohamed Sultan Road.
- Backups are taken regularly and are tested for restoration at least once a year.
- Staff receive an annual briefing on confidentiality and on the handling of personal data.
- A supplier that handles data on our behalf must accept a written confidentiality obligation.
No system is perfect. If a security incident affects personal data, we follow the incident response process described below and we notify the affected parties where the law requires it.
15. Your rights and choices
Subject to the law that applies to you, you may have the right to be informed about how your data is used, to request access to the data we hold, to ask for a correction, to ask for deletion, to restrict or object to processing, and to receive a portable copy of data that you have provided.
You also have the right to withdraw consent where consent is the basis for processing, and the right to lodge a complaint with a data protection authority. In Singapore the authority is the Personal Data Protection Commission.
To exercise a right, write to office@jtrholdings.buzz with enough detail for us to identify the record and the right you wish to exercise. We may ask for evidence of identity before we act, because we do not want to disclose a client record to the wrong person.
We answer a request within thirty days in most cases. Where the request is complex or where we need to retrieve an archived file, we will tell you within that period when the answer will follow.
16. Access and correction requests
An access request should state the record you are interested in and, where possible, the period during which it was created. The clearer the request, the faster the desk can locate the file.
We will provide a copy of the personal data in a form that is readable, together with a short explanation of how it has been used and to whom it has been disclosed. Where a document also contains the personal data of another person, we may redact that part before release.
A correction request should identify the entry that is wrong and the correct value. Where we agree, we will correct the record and, if the record has been disclosed to a third party, we will notify that party of the correction.
Where we decline a request, we will explain the reason in writing, note the legal basis for the refusal and tell you how to raise the matter with the relevant authority.
17. Withdrawal of consent
Where we rely on consent, you may withdraw it at any time by writing to the desk. Withdrawal does not affect processing that took place before the request, and it does not affect processing that relies on another lawful basis.
If you withdraw consent for a communication that is part of a service you have engaged, we will explain the consequence before we action the request. In some cases the desk cannot deliver the service without the relevant consent, and we will say so plainly.
A withdrawal is recorded in the contact record with the date and the scope of the request, so that the desk can demonstrate that it has been honoured.
18. Privacy for Children
This website and the hold desk service are intended for companies, their directors, their advisers and their authorised representatives. They are not directed at children, and we do not knowingly collect personal data from a child.
If you believe that a child has sent personal data to the desk, write to office@jtrholdings.buzz and we will delete the record without delay. We will confirm the deletion in writing.
Where a document that a client sends to us happens to name a child, for example as a beneficiary of a family holding, we handle that data with the same care as any other personal data and we do not use it for any purpose beyond the administration of the document.
We do not use children data for marketing, and we do not permit a third party to do so through this site.
19. Marketing and messages
The desk sends service messages about documents, dates and decisions that affect a client. These messages are part of the service and are not marketing.
We send a short seasonal note to current clients twice a year, describing the review calendar for the coming quarter. You can opt out of that note at any time by writing to the desk or by using the unsubscribe line at the foot of the message.
We do not send marketing to addresses that were collected only through a general enquiry, and we do not share an address with a marketing partner. If you receive a message that appears to come from us but does not match this description, please forward it to office@jtrholdings.buzz so that the desk can investigate.
20. Incident response
An incident is any event that threatens the confidentiality, integrity or availability of personal data. Examples include a lost device, a misdirected email, an unauthorised access attempt and a supplier outage that prevents access to a record.
When an incident is detected, the desk logs the time, the nature of the event and the systems affected. The matter is contained, the impact is assessed, and a decision is taken on notification within seventy two hours. Where the incident is likely to result in significant harm, we notify the affected individuals and the relevant authority without undue delay.
After the incident is closed, we write a short review that records the cause, the actions taken and the changes made to prevent a recurrence. The review is discussed at the next service meeting and, where a client is affected, a copy is offered to the client.
21. Third party sites
This website may link to the site of a custodian, an adviser or a public authority. Those sites are operated by other organisations and are governed by their own privacy notices.
We do not control the content of a third party site and we are not responsible for the way it handles personal data. We recommend that you read the privacy notice of any site you visit before you submit personal data.
A link from this site does not imply that we endorse the practices of the linked organisation. If you find a link that is broken or that leads to unexpected content, please tell the desk and we will review it.
22. Changes to this policy
We review this policy at least once a year and whenever a material change is made to the service, to our suppliers or to the law. The date at the foot of the page shows when the current version took effect.
Where a change is material, we will publish a short summary at the top of this page and, for current clients, send a note to the main contact address. The summary will describe what changed and why.
A previous version of the policy can be requested from the desk. We keep an archive of prior versions for six years so that a reader can compare the current text with the text that applied at an earlier date.
23. How to reach us
The hold desk handles privacy questions directly. Write to office@jtrholdings.buzz or call +12344463752 during office hours, Monday to Friday from 09:00 to 18:00 Singapore time.
You may also write to the office at JTR HOLDINGS PTE. LTD., 15 MOHAMED SULTAN ROAD, #02-01, 238964, Singapore (SG). Mark the envelope for the attention of the hold desk and state that the letter concerns a privacy matter.
If your concern is about the way this website is built or maintained, the developer JTR Holdings will be asked to assist the desk with the technical review. The response will still come from the Company, and the Company remains accountable for the outcome.
We would rather hear about a concern early than discover it at a later stage. If something in this policy does not match what you have experienced, tell us and we will look at it properly.