Data Protection Notice

1. Who we are

VIVOS PTE. LTD. (UEN 202416468C), 14B Stanley Street, Singapore 068733(“we”, “us”) is a corporate service provider. This notice covers personal data in VOS, our corporate secretarial system, and on the forms and links we send you. It applies to our clients and their contacts, and to company officers, directors, shareholders, controllers and beneficial owners.

2. Personal data we collect

• Identity: full name, NRIC, FIN or passport number, nationality, country of birth, date of birth
• Contact: residential and contact addresses, email, phone
• Corporate roles: directorships, shareholdings, controllers and beneficial ownership
• Due diligence: identity documents, politically exposed person (PEP) status, source of funds and wealth, screening results, and our customer risk rating
• Identity checks, when we ask you to complete one: a photo of your ID document, a selfie video and a facial comparison between them
• Communications: where a mailbox is connected, client email (sender, recipient, subject, content and attachments)
• Technical: the IP address an online form was submitted from, and staff sign-in details

We get this from you, from the person or company engaging us, from ACRA and other public registers, and from our screening provider.

3. Why we use it

To provide corporate secretarial services, including incorporation and filings with ACRA and keeping statutory registers, and to carry out the customer due diligence required of us under the Corporate Service Providers Act 2024 and anti-money-laundering law. We use personal data with your consent, or without it where the law requires or allows.

We collect NRIC and FIN numbers only where the law requires them or where we need to verify identity to a high degree of fidelity, in line with the PDPC’s Advisory Guidelines on the NRIC.

AI helps staff read uploaded forms, and staff check what it reads before saving. Screening results are reviewed by staff, and a person decides each customer’s risk rating.

4. Who we share it with

ACRA, regulators and law enforcement, where the law requires or allows, and these service providers, who process data for us. We do not sell personal data.

Didit handles identity and screening data under its own privacy policy.

5. Transfers outside Singapore

Our system, database and uploaded files are hosted in Singapore on Google Cloud. The providers marked above as outside Singapore may receive personal data overseas. Before transferring it, we take the steps the PDPA requires so that it keeps a standard of protection comparable to the PDPA, including contractual commitments from the provider.

6. How we protect it

• Staff must sign in. A client form or identity check opens only through its own private link.
• Data is encrypted in transit and at rest.
• ID numbers are masked on screen, showing only the last four characters. Staff who can edit records can reveal one, and each reveal is logged.
• Changes to records are kept in an audit log, without the ID numbers themselves.
• Connected mailboxes sign in through OAuth, so we never see the password. Their tokens are encrypted (AES-256-GCM) with a key held outside the database, and are deleted when the mailbox is disconnected.

7. How long we keep it

We keep customer due diligence records for 5 years after we stop providing services to the customer, as the Corporate Service Providers Regulations 2025 require. We keep statutory registers and filings for as long as the law requires, and other personal data only while we need it for the purposes above. We review what we hold at least once a year and then delete what we no longer need, or anonymise it.

8. Your rights

You can ask for access to your personal data and how it has been used or disclosed in the past year, ask us to correct it, or withdraw your consent, by contacting our Data Protection Officer. We respond as soon as we reasonably can. If we need more than 30 days, we will tell you in writing when you can expect an answer. We may charge a reasonable fee for access, and will tell you the amount first.

If you withdraw consent, we may no longer be able to act for you, and we will tell you what that means before we act on it. We must still keep records the law requires, including the due diligence records above.

If you are not satisfied with our answer, you can contact the Personal Data Protection Commission.

9. Data Protection Officer

Email contact@vivos.com.sg, or write to the Data Protection Officer, VIVOS PTE. LTD., 14B Stanley Street, Singapore 068733.