Privacy Policy

1. Who We Are

Nilai is a financial education provider based in Singapore. We offer group and bespoke programmes designed to help adults in their forties and fifties understand their household finances with greater steadiness and clarity.

Our registered address is 91 Bukit Pasoh Road, #03-15, Singapore 089844. You may reach us by telephone at +65 6745 3201 or by electronic mail at [email protected].

For the purposes of Singapore's Personal Data Protection Act 2012 (PDPA), Nilai is the organisation responsible for the personal data you share with us.

2. Personal Data We Collect

We collect personal data only when there is a clear and reasonable purpose for doing so. The personal data we may collect includes:

• Your name and preferred form of address
• Your contact details — telephone number and electronic mail address
• Information you share when completing our contact or registration forms, including any notes about your enquiry
• Records of attendance at our programmes and any written summaries prepared during bespoke sessions
• Correspondence exchanged with our team by any means
• Payment references, where relevant to programme registration

We do not collect sensitive financial data such as account numbers, investment portfolio details, or CPF account information unless you choose to share such material in the course of a bespoke session, and then only with your knowledge and for the purpose of that session.

3. How We Use Your Personal Data

We use the personal data we hold for the following purposes:

• To respond to enquiries you have made about our programmes
• To administer your registration and attendance at a programme
• To send you programme-related materials, including printed readers and written session summaries
• To contact you with information about forthcoming programmes, where you have indicated that you are open to receiving such correspondence
• To maintain accurate records as required by applicable law and professional standards
• To improve the quality and design of our programmes over time

We do not use your personal data for automated decision-making, profiling, or any purpose that would be unexpected given the nature of your relationship with us.

4. Legal Basis for Processing

Under the PDPA, we rely on the following bases for collecting and using personal data:

• Contractual necessity — where processing is required to fulfil your registration or to respond to a specific request you have made
• Legitimate interests — where we have a reasonable interest in maintaining contact with past and prospective participants, and that interest does not override your own interests or rights
• Your consent — where we send optional communications, such as updates about new programmes, and you have indicated your agreement to receive them
• Legal obligation — where applicable law or a regulatory requirement compels us to retain or process certain records

5. Sharing Your Personal Data

We do not sell, rent, or trade your personal data to third parties.

We may share your personal data in limited circumstances:

• With service providers who assist us in operating our business — for example, a payment processing service or a document management system — where those providers are bound by appropriate data protection obligations
• With professional advisers such as accountants or lawyers, where required in the ordinary course of business
• Where required by law, regulation, or a court or regulatory authority

Where we engage third-party service providers, we take reasonable steps to satisfy ourselves that they handle personal data responsibly.

6. Retention of Personal Data

We retain personal data for as long as is reasonably necessary for the purpose for which it was collected, and in accordance with any applicable legal obligations.

As a general guide:

• Enquiry records where no registration follows are retained for twelve months
• Programme attendance and session records are retained for seven years from the date of the final session
• Financial and payment records are retained for the period required by applicable tax and accounting law

After the applicable retention period, personal data is securely deleted or de-identified.

7. Your Rights

Under Singapore's PDPA, you have the right to:

• Request access to the personal data we hold about you
• Request that inaccurate personal data be corrected
• Withdraw consent to the use of your personal data for optional communications at any time
• Request, in certain circumstances, that we cease using your personal data

To exercise any of these rights, please contact us by electronic mail at [email protected] or by telephone at +65 6745 3201. We will respond within the timeframe required by the PDPA — ordinarily within thirty calendar days.

We will ask you to verify your identity before acting on any such request, so that we can be confident we are providing information to the right person.

8. Cookies and Our Website

Our website uses a small number of cookies to support its basic operation and to understand, in broad terms, how visitors find and use our pages. We do not use cookies to build individual profiles or to serve advertising.

A full description of the cookies we use and how you may manage them is set out in our Cookie Policy.

9. Security

We take reasonable steps to protect the personal data we hold from loss, misuse, and unauthorised access. These steps include restricting access to personal data to those within our organisation who have a legitimate need to see it, and using standard security practices for any electronic records.

No method of transmitting or storing data is entirely without risk, and we cannot offer an absolute assurance. If you have a concern about the security of your data, please contact us directly.

10. Changes to This Policy

We may update this Privacy Policy from time to time, for example if our practices change or if legal requirements are updated. When we do, we will revise the date at the top of this page. We encourage you to review this policy periodically if you would like to remain informed of how we handle personal data.

If we make a material change that affects your rights or the way we use your personal data, we will take reasonable steps to inform you directly.

11. Contact and Complaints

If you have a question about this Privacy Policy or about how we handle your personal data, please contact us:

If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore, which oversees compliance with the PDPA. Details are available at www.pdpc.gov.sg.