STIDE Pte. Ltd. · SGT Private Client
Privacy Policy
Last updated: 22 July 2026
Who we are and scope of this Policy
This Privacy Policy explains how STIDE Pte. Ltd. (“STIDE”, “SGT”, “SGT Private Client”, “we”, “us” or “our”) collects, uses, discloses, transfers, stores, protects and otherwise processes personal data.
This Policy applies to sgtprivateclient.com, its subdomains, client portals, forms, newsletters, publications, RSS-related functionality, events, communications and services operated by or on behalf of STIDE.
This Policy should be read together with our Website Disclaimer and Regulatory Notice, Terms of Use, Cookie Notice, engagement agreements, service-specific notices and any consent or collection notice presented when personal data is collected.
Our role in relation to personal data
STIDE generally acts as the organisation responsible for determining the purposes and means of processing personal data collected for its own enquiries, client acceptance, service delivery, administration, compliance, security and business operations.
In limited circumstances, STIDE may process personal data solely on behalf of another organisation and may then act as a data intermediary. The written agreement with that organisation will govern the relevant processing.
Banks, law firms, tax advisers, corporate service providers, immigration professionals, trustees, insurers, aviation operators, security providers, property professionals, healthcare providers and public authorities may process personal data independently for their own legal, regulatory or professional purposes. Their privacy notices and legal obligations apply to their processing.
Meaning of personal data
Personal data generally means data, whether true or not, about an individual who can be identified from that data alone or from that data together with other information to which an organisation has or is likely to have access.
Data that has been irreversibly anonymised so that no individual can reasonably be identified is not treated as personal data. Pseudonymised or coded data may remain personal data where re-identification remains reasonably possible.
Personal data we may collect
Depending on your relationship with us and the services involved, we may collect:
- identity and contact information, including name, nationality, date of birth, address, telephone number and email address;
- government-issued identification information, passport details, residence and immigration records, travel history and supporting documents;
- family, dependant, matrimonial, succession, education, healthcare and household information relevant to a client mandate;
- employment, professional, directorship, business ownership and corporate information;
- beneficial ownership, control, authority, trust, foundation, partnership and entity-structure information;
- financial information, banking details, assets, liabilities, income, investment holdings and transaction records;
- source-of-wealth and source-of-funds information, including supporting contracts, statements, corporate records and transaction evidence;
- tax residence, tax identification, reporting classification and related compliance information;
- sanctions, politically exposed person, adverse-media, litigation, regulatory, criminal or reputational information obtained lawfully;
- communications, meeting notes, call records, instructions, consents, complaints and service history;
- payment, invoicing and accounting information;
- website, device, browser, IP-address, log, cookie and usage information; and
- any other personal data reasonably required for the stated purpose or provided voluntarily.
Higher-risk data and identification documents
Some client mandates may require personal data that could create greater harm if misused, including identity documents, financial records, family information, health information, criminal or regulatory records, tax information and source-of-wealth evidence.
We seek to collect such information only where reasonably necessary for a legitimate and notified purpose, where required by law, or where necessary to verify identity or facts to an appropriate degree of accuracy.
You should not submit passwords, one-time passwords, private cryptographic keys, complete payment-card security codes or unnecessary identity-document copies through ordinary website forms or unsecured email.
STIDE does not use full or partial NRIC, FIN, passport or similar identification numbers as passwords or routine authentication credentials.
How we collect personal data
We may collect personal data:
- directly from you through forms, enquiries, applications, interviews, meetings, calls, correspondence, portals and document submissions;
- from a family member, employer, authorised representative, adviser, trustee, company, family office or other person acting with appropriate authority;
- from independent service providers, banks, professional advisers, institutions and counterparties involved in a mandate;
- from corporate registries, court records, sanctions lists, government publications, public databases, professional directories, public websites and other lawfully available sources;
- through screening, verification, fraud-prevention, cybersecurity and compliance tools;
- through website cookies, server logs, analytics tools and similar technologies; and
- from events, professional networks, referrals, publications, social-media interactions and business-development activities.
Personal data concerning other individuals
Where you provide personal data concerning another individual, including a family member, dependant, shareholder, director, employee, trustee, beneficiary, adviser or representative, you represent that you are authorised to provide the information and that the individual has been appropriately notified where required.
You must not provide personal data concerning another person in breach of confidence, privacy, employment, fiduciary, banking, professional or other legal obligations.
We may require evidence of authority before acting on instructions or disclosing personal data to a representative.
Purposes for which we process personal data
We may collect, use and disclose personal data for reasonable purposes including:
- responding to enquiries and communicating with prospective, current and former clients;
- conducting eligibility, suitability, risk, conflict, integrity and engagement-acceptance assessments;
- verifying identity, authority, beneficial ownership, source of wealth and source of funds;
- conducting sanctions, politically exposed person, adverse-media, fraud and other compliance screening;
- preparing proposals, engagement documents, mandates, workplans and service records;
- providing immigration, residence, relocation, evidence, private-banking onboarding, governance-readiness, compliance-readiness, project-management and concierge workstreams described in a written engagement;
- coordinating applications, submissions, professional advice, provider appointments, institutional onboarding, Q&A processes and implementation activities;
- supporting corporate, family-office, banking, fiduciary, tax, property, aviation, security, healthcare, education and lifestyle requirements through appropriately authorised providers;
- administering client portals, document rooms, communications, meetings, records, invoicing and payments;
- maintaining service quality, business continuity, audit trails, records and internal controls;
- detecting, preventing and investigating fraud, misuse, security incidents, unlawful activity and breaches of contract;
- complying with legal, regulatory, tax, accounting, reporting, record-keeping, court, enforcement and professional obligations;
- establishing, exercising or defending legal rights and claims;
- conducting research, analytics, service improvement, quality assurance and business planning using appropriately minimised, aggregated or anonymised information where practicable;
- sending publications, event information and marketing communications in accordance with applicable law and your preferences; and
- any other purpose notified to you or permitted or required by law.
Consent and other permitted bases
Where consent is required, we will seek consent through an appropriate notice, form, agreement, electronic action or other method permitted by law.
Consent may also be deemed in circumstances recognised by the Personal Data Protection Act 2012 (“PDPA”), including where you voluntarily provide personal data for an obvious purpose or where disclosure is reasonably necessary to perform a contract involving you.
We may collect, use or disclose personal data without consent where an exception under applicable law permits or requires us to do so, including for legitimate interests, business improvement, investigations, emergencies, legal claims, compliance with law or other authorised purposes. Any required assessment or safeguard will be applied.
This Policy does not itself require you to consent to purposes beyond those that are reasonable and notified in the circumstances.
Information required to provide services
Certain personal data may be required to assess an enquiry, satisfy due diligence, comply with law, verify authority, appoint a provider or perform an engagement.
Where required information is not provided, is materially incomplete, cannot be verified or must no longer be used following withdrawal of consent, we may be unable to accept or continue an engagement, submit an application, coordinate a provider, complete an onboarding process or provide a requested service.
We will explain material consequences of refusing or withdrawing necessary information where reasonably practicable.
Due diligence, screening and verification
STIDE may conduct identity, beneficial-ownership, sanctions, politically exposed person, adverse-media, fraud, litigation, regulatory and other risk checks where reasonably necessary for client acceptance, provider onboarding, institutional readiness, legal compliance or protection of legitimate interests.
Screening may use information supplied by you, public records, commercial databases and independent providers. Screening results may contain errors, false positives or incomplete information and may require human review and clarification.
A screening result does not constitute a legal conclusion, criminal finding, regulatory decision or guarantee that another institution will accept a person or transaction.
Disclosure to service providers and recipients
We may disclose personal data, on a need-to-know basis, to:
- STIDE personnel, contractors and authorised representatives;
- hosting, cloud, email, document-management, cybersecurity, communications, analytics, payment, accounting and technology providers;
- lawyers, tax advisers, accountants, auditors, corporate service providers, immigration professionals, trustees and fiduciaries;
- banks, financial institutions, insurers, fund managers, custodians and other regulated institutions;
- aviation operators, travel providers, chauffeur providers, security providers, property professionals, schools, healthcare providers and lifestyle suppliers;
- employers, companies, family offices, trustees, authorised family representatives and counterparties involved in a mandate;
- government departments, regulators, courts, law-enforcement bodies, tax authorities and other public authorities;
- professional indemnity insurers, legal advisers, auditors and persons involved in a complaint, dispute, investigation, restructuring or transaction; and
- other persons authorised by you or permitted or required by law.
Independent providers and separate privacy responsibility
Independent providers may collect personal data directly from you or receive it from STIDE for their own due diligence, professional, regulatory, contractual or service purposes.
Such providers may determine their own purposes and means of processing and may be separately responsible for compliance with applicable privacy law.
STIDE does not control an independent provider’s internal systems, statutory records, professional files, regulatory reporting or retention requirements. You should review the provider’s privacy notice before supplying information.
Overseas transfers and international processing
SGT serves internationally mobile clients and may engage providers, institutions, cloud platforms and professional advisers located outside Singapore.
Personal data may therefore be transferred to, stored in or accessed from jurisdictions whose privacy laws differ from Singapore law.
Where the PDPA applies, STIDE will take appropriate steps to ensure that overseas recipients are bound to provide a standard of protection comparable to that required under the PDPA, unless an exception applies. Measures may include contractual protections, due diligence, recognised certifications, internal policies and technical safeguards.
An overseas authority, bank, court or regulated provider may process information under the laws of its own jurisdiction, including mandatory disclosure and retention requirements.
Website, server and device information
When you access our website or portals, our systems and service providers may automatically record information including IP address, browser type, device type, operating system, referring page, pages visited, access time, error logs, security events and approximate location inferred from technical data.
We may use such information to operate the website, maintain security, diagnose faults, measure performance, understand usage, prevent abuse and improve services.
Technical information may be combined with other data where reasonably necessary for security, authentication, fraud prevention, service administration or analytics.
Cookies and similar technologies
The website may use cookies, local storage, pixels, tags and similar technologies to support essential functions, remember preferences, maintain security, measure performance and understand website usage.
Cookies may be session-based or persistent and may be placed by STIDE or by technology providers supporting the website.
Where required by applicable law, we will seek consent before using non-essential cookies. You may also control cookies through your browser or device settings, although disabling essential cookies may affect website functionality.
Further details should be set out in a separate Cookie Notice or cookie-management interface reflecting the technologies actually enabled on the website.
Analytics, embedded content and third-party platforms
The website may use analytics, video, map, social-media, scheduling, payment, form, anti-spam, content-delivery or other third-party services.
When such content is loaded or used, the provider may receive technical data and may place its own cookies or similar technologies in accordance with its privacy notice.
STIDE does not control the privacy practices of an independent third-party platform. Users should review the relevant provider’s notices and settings.
RSS feeds, external publications and news content
SGT Insights may display headlines, summaries, publication dates and links obtained from RSS, Atom or other external sources.
The original publisher remains responsible for its content and any personal data collected when you visit the publisher’s website.
The SGT RSS plugin may retrieve and cache feed content on the WordPress server. It should not be used to collect unnecessary reader-identifying information, and imported content should be sanitised before display.
Clicking an external article link takes you to a third-party website governed by that publisher’s privacy practices.
Artificial intelligence and automated tools
STIDE may use artificial intelligence, document extraction, screening, categorisation, summarisation, workflow automation, scoring or similar tools to support research, administration, quality control and client work.
Personal data submitted to an automated tool should be limited to what is reasonably necessary and processed under appropriate contractual, access and security controls.
Automated outputs may be incomplete or inaccurate and are subject to human review where they may materially affect a person or client mandate.
STIDE does not rely solely on automated output to make an official immigration, banking, legal, tax, medical, security or regulatory decision, because STIDE does not control those decisions.
Marketing, newsletters and events
We may use your business contact information or contact details, where permitted, to send publications, service updates, event invitations and other communications that may be relevant to your relationship with STIDE.
You may unsubscribe from marketing email by using the unsubscribe facility in the message or contacting us. Service, legal, security and transactional messages may still be sent where necessary.
For marketing to Singapore telephone numbers, STIDE will comply with the applicable Do Not Call provisions, including consent, registry-checking, identification and opt-out requirements where they apply.
For unsolicited commercial electronic messages in bulk, STIDE will comply with applicable requirements under the Spam Control Act 2007, including functional unsubscribe facilities and cessation within the statutory period.
Withdrawal of consent and communication preferences
You may withdraw consent to the collection, use or disclosure of personal data by giving reasonable notice to our Data Protection Officer.
Before processing the withdrawal, we may verify your identity and explain the likely consequences. Withdrawal does not affect processing already lawfully carried out and does not require us to delete information that must be retained for legal, regulatory, contractual, evidential, security or dispute-resolution purposes.
After a valid withdrawal, we will cease the affected processing within a reasonable period unless continued processing is permitted or required by law.
Children and minors
Our public website and services are directed primarily at adults, family offices, businesses and professional representatives.
A relocation, education, healthcare, succession or family mandate may require personal data concerning a child or other minor. In those circumstances, we will seek to collect only information reasonably necessary for the purpose and may require authority from a parent, guardian or other authorised person.
Users should not permit a child to submit sensitive personal data directly through a public website form without appropriate adult involvement.
Accuracy and updating of personal data
We may rely on personal data supplied by you, your authorised representatives and independent sources.
You should ensure that information provided to STIDE is accurate, complete and current, particularly where it may affect an application, institutional decision, legal obligation, risk assessment or service outcome.
Please notify us promptly of material changes. We may request updated documents or verification before relying on information.
Security safeguards
STIDE seeks to implement reasonable administrative, physical and technical safeguards appropriate to the nature of the data and risks involved.
Measures may include access controls, least-privilege permissions, authentication controls, encryption where appropriate, secure transfer methods, logging, backups, vendor due diligence, confidentiality obligations, security updates and incident-response procedures.
No website, email, cloud platform, portal or electronic transmission is completely secure. You are responsible for protecting your devices, accounts, passwords and authentication credentials.
Where a secure document channel is provided, sensitive documents should be transmitted through that channel rather than ordinary email or public forms.
Retention and disposal
STIDE retains personal data only for as long as reasonably necessary for the purposes for which it was collected, or for a legitimate business, legal, regulatory, tax, accounting, professional, evidential, security or dispute-resolution purpose.
Retention periods vary according to the data, relationship, service, jurisdiction, contractual requirements, limitation periods, provider obligations and likelihood of a legal or regulatory need.
When personal data is no longer required, we will take reasonable steps to delete, anonymise, destroy or otherwise cease retention, subject to lawful archival, backup and legal-hold requirements.
Access to personal data
Subject to applicable exceptions, you may request access to personal data in STIDE’s possession or control and information about how it was used or disclosed during the period prescribed by law.
We may require sufficient information to identify you, locate the requested data and verify authority where a request is made through a representative.
STIDE may charge a reasonable fee permitted by law and will provide an estimate before processing where applicable.
We may refuse, limit or redact access where an exception or prohibition applies, including where disclosure would reveal another person’s data, confidential commercial information, evaluative information, legal privilege or information that must not be disclosed.
Correction of personal data
You may request correction of an error or omission in personal data in STIDE’s possession or control.
Where required, we will correct the data as soon as practicable and may transmit the correction to organisations to which the data was disclosed within the applicable period, subject to legal exceptions and your instructions where permitted.
A correction request does not require STIDE to alter a professional opinion, evaluative record, screening result, legal position or document that accurately records the information or view held at the relevant time.
Response time for requests
We will respond to an access or correction request as soon as reasonably possible and within the timeframe required by applicable law.
Where we cannot complete the response within 30 calendar days, we may notify you in writing of the additional time reasonably required, as permitted by law.
Requests should be sufficiently specific and sent to the Data Protection Officer using the contact details below.
Data incidents and breach notification
If STIDE becomes aware of a suspected data incident, we may investigate, contain, remediate and assess the incident in accordance with our legal obligations and incident-response procedures.
Where a breach is notifiable under the PDPA, STIDE will notify the Personal Data Protection Commission as soon as practicable and no later than the statutory deadline after determining that notification is required.
Affected individuals will be notified as soon as practicable where required by law, subject to applicable exceptions or directions.
A notification may include recommended protective steps. You should act promptly on security notices relating to passwords, accounts, identity documents or financial information.
Legal disclosures, investigations and business transactions
STIDE may preserve, use or disclose personal data where reasonably necessary to comply with law, court orders, regulatory requests, investigations, sanctions, tax requirements, fraud prevention, professional obligations or the establishment, exercise or defence of legal claims.
Personal data may also be disclosed in connection with a proposed or completed merger, acquisition, financing, restructuring, sale of business or assets, insolvency, transfer of service operations or similar transaction, subject to appropriate confidentiality and legal safeguards.
Complaints and concerns
If you have a question or concern about how STIDE handles personal data, please contact our Data Protection Officer first so that we can review and respond.
Please provide your name, contact details, a description of the concern, relevant dates and supporting information. Do not send unnecessary identity documents unless requested through a secure channel.
Nothing in this Policy prevents an individual from exercising any right to contact the Personal Data Protection Commission or another competent authority where applicable.
Additional rights under other laws
A mandatory privacy law of another jurisdiction may apply to a particular individual, service or processing activity and may provide additional rights or obligations.
Nothing in this Policy limits a right that cannot lawfully be excluded. STIDE may issue a jurisdiction-specific notice or apply additional procedures where required.
The statutory data-portability obligation under Singapore law will apply only when and to the extent that the relevant provisions and regulations are brought into force.
Changes to this Privacy Policy
STIDE may update this Policy to reflect changes in law, regulatory guidance, services, technologies, providers or business operations.
The current version will be published on the website with its effective date. Material changes may also be communicated through an appropriate additional notice.
A change to this Policy does not retrospectively authorise a new use of personal data where fresh notification or consent is required by law.
Contact and Data Protection Officer
Questions, access requests, correction requests, consent withdrawals and complaints may be directed to: