Privacy Policy

1. Who we are

This website, amadeoconsulting.com, is operated by Amadeo Consulting Pte. Ltd. (UEN 201623325N), a company registered in Singapore, with its registered office at 138 Robinson Road, #26-01, Oxley Tower, Singapore 068906. Our Data Protection Officer can be reached at tobie@amadeoconsulting.com.

This policy covers the website and the enquiries you send us through it. Personal data we handle while carrying out a project for a client is also subject to the agreement with that client. Section 13 covers the data handled by our internal Google Ads tool.

2. What data we collect

• Contact form: your name, your email address, the services you are interested in, and your message.
• Email and WhatsApp: when you contact us this way, we receive your address or number and what you tell us.
• Usage data: Google Analytics records the pages you view, how you reached them, your device and browser type, and your approximate location.
• Technical data: our server and the services in front of it record your IP address, browser type and the pages requested, for security and to keep the site running. If our contact form refuses a message as spam, we keep the IP address, the details entered and the reason, among our 50 most recent refusals.

We do not ask for your NRIC or passport number, bank details, or health information through this website.

3. How we collect it

Directly from you, when you fill in the contact form, email us or message us on WhatsApp. Automatically, through the server and security logs described in section 2, Google Analytics, Cloudflare Web Analytics, and the Google reCAPTCHA check on our contact form, which looks at how the form is used to tell people from spam robots.

4. Why we use it

• To reply to your enquiry, including the confirmation email our form sends you, and to prepare a proposal if you ask for one.
• To understand which pages are useful and improve this website.
• To keep the website secure and available, and to block spam.
• To meet our legal obligations in Singapore.

We do not add you to a mailing list when you use our contact form.

5. Who we share it with

We share personal data only with our team and the service providers that run this website and our communications, and only for the purposes above:

• Google: our email runs on Google Workspace, so form submissions and emails to us pass through Google’s mail servers. Google Analytics measures use of this website. Google reCAPTCHA screens our contact form for spam, and the site’s fonts load from Google Fonts; both receive your IP address when a page loads.
• Cloudflare: the site is delivered through Cloudflare’s network, which filters attacks, caches pages and provides visitor statistics. Cloudflare sees the IP address of every request.
• Our web hosting provider: the website is hosted on servers located in Singapore. Backup copies are also stored with Cloudflare.
• Meta (WhatsApp): if you message us on WhatsApp, the conversation is handled by WhatsApp under Meta’s own privacy terms.

We do not sell personal data, and we do not share it with advertisers. We will disclose personal data where the law requires it, for example to a regulator or a court in Singapore.

6. Cookies and similar technologies

• Analytics cookies: Google Analytics sets the cookies _ga and _ga_CSD4HLBTBX to tell one visit from another. They last up to two years. You can turn them off with Google’s opt-out add-on.
• Security cookies: Google reCAPTCHA may set its own cookie to tell people from automated traffic, and Cloudflare may set one to filter malicious traffic.
• Login cookies: these are set only for our own staff when they sign in to manage the site.

Cloudflare Web Analytics does not use cookies. Our Google Analytics setup has Google Signals switched off and is not linked to any advertising account. You can manage or delete cookies in your browser settings: Chrome, Safari, Firefox, Edge.

If your browser sends a Global Privacy Control signal, we treat it as a request not to sell or share your personal data, which we do not do in any case.

7. International transfers

Our website servers are in Singapore. Some of our team work outside Singapore, including in Indonesia, and the service providers named in section 5 may process data in other countries, including the United States. Where personal data leaves Singapore, the Personal Data Protection Act 2012 (PDPA) requires us to make sure it receives a standard of protection comparable to the PDPA, and we rely on those providers’ contractual data protection commitments for that.

8. Your rights

If you are in Singapore

Under the PDPA you can ask us for access to the personal data we hold about you and how we have used or disclosed it in the past year, ask us to correct an error or omission, and withdraw any consent you have given, with reasonable notice. Write to tobie@amadeoconsulting.com. We respond to access requests within 30 calendar days; if we need longer, we tell you within that time when you can expect our reply. We may ask you to confirm your identity first. If you are not satisfied with our response, you can contact the Personal Data Protection Commission at pdpc.gov.sg.

If you are in California

The California Consumer Privacy Act gives California residents the right to know what personal information a business collects and how it is used, the right to delete it, the right to correct it, the right to opt out of its sale or sharing, and the right not to be discriminated against for exercising these rights. We honour these requests whether or not the Act applies to a company of our size. We do not sell or share personal information. To make a request, email tobie@amadeoconsulting.com; we respond within 45 days and tell you if we need an extension.

If you are in another US state with a comprehensive privacy law

You have broadly similar rights of access, correction, deletion and portability, and the right to opt out of sale, targeted advertising and profiling. Use the same email address; we honour these requests whichever state you are in.

9. Data retention

We keep personal data for as long as it is needed for the purposes described above, or as long as the law requires. Google Analytics keeps event data for 2 months and user-level data for 14 months from a visitor’s last activity. Website backups are deleted automatically after 7 days. Records of client work and invoices are kept for the period Singapore’s tax and company rules require.

10. Children

This website is directed at businesses and is not directed at children under 13. We do not knowingly collect personal data from them through it.

11. Security

The website is served over HTTPS only, so everything you type into the contact form is encrypted on its way to us. The server sits behind Cloudflare, which filters malicious traffic before it reaches the site, repeated failed logins are locked out, and the site is backed up daily. No website can be guaranteed completely secure, so please do not send passwords or payment details through the contact form.

12. Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects on you.

13. Google user data

Our internal tool, Amadeo Consulting Ads Tools, connects to Google Ads through the Google Ads API with the permission of the account holder.

• What it accesses and how it is used: the tool reads and manages Google Ads account, campaign and keyword planning data, only to run advertising for us and our clients.
• Storage: this data is stored only on our own systems and in our private backups.
• Sharing: we do not sell this data. We share it only with the client whose account it is and with the service providers we use to operate the tool.

14. Changes to this policy

When we change this policy we update the date at the top of this page. The current version is always the one published here.

15. Contact us

Amadeo Consulting Pte. Ltd., 138 Robinson Road, #26-01, Oxley Tower, Singapore 068906. Data Protection Officer: tobie@amadeoconsulting.com.