Privacy Policy

1. Data Controller

tessarls operates as the data controller for all personal data collected through our services and website. Our registered address is 6 Battery Road, #23-05, Singapore 049909. For data-related queries, contact us at [email protected].

2. Personal Data We Collect

We collect personal data that you provide directly or that arises through your use of our services, including:

• Identity information: Full name, NRIC or passport number (where required for notarisation), date of birth.
• Contact information: Email address, phone number, residential or business address.
• Employment and immigration details: Employer name, employment history, qualifications, MOM reference numbers (for work pass matters).
• Commercial information: Contract details, company registration numbers, business correspondence (for contract services).
• Website usage data: IP address, browser type, pages visited, referring URL, collected via cookies and analytics tools.

We collect only what is relevant to the service you have requested. Where submission of certain data is optional, we will indicate this clearly.

3. How We Collect Data

Data is collected through the following channels:

• Contact forms and enquiry submissions on our website
• Direct correspondence by email, phone, or in-person appointment
• Documents you provide in connection with a service engagement
• Cookies and analytics tools (see Section 8 below)
• Third-party sources such as MOM's EP Online portal (for work pass submissions)

4. How We Use Your Data

We use personal data for the following purposes:

• Service delivery: Processing work pass applications, reviewing or drafting contracts, and completing notarisation requests on your behalf.
• Communication: Responding to enquiries, sending service updates, and notifying you of matters relevant to your engagement.
• Compliance: Meeting our obligations under Singapore law, including the Legal Profession Act, PDPA, and anti-money laundering regulations.
• Website improvement: Analysing usage patterns to improve the performance and relevance of our website.
• Records and audit: Maintaining accurate records of legal services provided, as required by professional standards.

We do not use personal data for automated decision-making or profiling that has legal or significant effects on individuals.

5. Legal Basis for Processing

Under the PDPA, we rely on the following grounds for processing personal data:

• Contractual necessity: Processing required to fulfil a service agreement with you.
• Legal obligation: Where we are required by law to collect or retain data.
• Legitimate interests: To improve our services, ensure security, and manage our business operations.
• Consent: For marketing communications and non-essential cookies, where you have opted in.

6. Data Sharing and Disclosure

We do not sell or rent personal data. We may share data with the following categories of recipients when necessary:

• Government agencies: The Ministry of Manpower (MOM), the Immigration and Checkpoints Authority (ICA), or other authorities as required by the nature of the service.
• Professional third parties: Affiliated notaries, solicitors, or legalisation services acting under confidentiality obligations.
• Technology service providers: Hosting providers and analytics platforms operating under data processing agreements.
• Legal and regulatory authorities: Where required by law, court order, or regulatory obligation.

Any third party receiving personal data is required to protect it with standards at least equivalent to those set out in this policy.

7. Data Retention

We retain personal data for as long as is necessary for the purpose it was collected, or as required by law:

• Client matter records: 7 years from the close of the matter, in line with legal professional obligations.
• Website enquiry data: Up to 24 months if no service engagement follows.
• Analytics and cookies data: As specified in our Cookie Policy, typically 13 months or less.

Once the retention period expires, data is securely deleted or anonymised.

8. Cookies

Our website uses cookies to support essential functionality and to understand how visitors navigate the site. For a full explanation of the cookies we use and how to manage your preferences, please see our Cookie Policy. We obtain your consent before placing non-essential cookies on your device.

9. Data Security

We take reasonable steps to protect personal data against unauthorised access, loss, misuse, or alteration, including:

• Encrypted storage for electronic records containing personal data
• Access controls limiting data access to authorised staff only
• Secure transmission protocols (HTTPS) for all website communications
• Regular review of access logs and security procedures

In the event of a data breach that is likely to cause significant harm, we will notify affected individuals and the Personal Data Protection Commission (PDPC) as required under the PDPA's mandatory breach notification provisions.

10. Your Rights Under the PDPA

You have the following rights in relation to your personal data:

• Right of access: Request confirmation of whether we hold your personal data and obtain a copy.
• Right of correction: Request correction of inaccurate or incomplete data.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Right to data portability: Request transfer of your data in a structured format where technically feasible.
• Right to object: Object to processing based on legitimate interests where your interests override ours.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are dissatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission at pdpc.gov.sg.

11. International Data Transfers

In limited circumstances — for example, where a client's work pass application or notarised document requires submission to a foreign authority — personal data may be transferred outside Singapore. Such transfers occur only where necessary for the service and in accordance with PDPA requirements for cross-border data transfers.

12. Third-Party Links

Our website may contain links to external websites, including government portals such as MOM's EP Online. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party websites you visit.

13. Children's Privacy

Our services are directed at individuals aged 18 and above. We do not knowingly collect personal data from persons under 18. If you believe a minor has submitted personal data through our website, please contact us and we will take prompt steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The date at the top of this page will be updated accordingly. Where changes are material, we will take reasonable steps to notify affected individuals directly.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please reach out: