Privacy Policy

Contact form data: When you submit an enquiry through our website, we collect your name, email address and any additional information you choose to provide in the message field. Phone number is optional.

Engagement data: During consulting engagements, we may collect the names and contact details of process participants and other individuals involved in the work. This is done solely for the purpose of conducting the engagement and is covered by a separate engagement agreement.

Cookies and analytics: Our website may use cookies to understand how visitors use the site. See our Cookie Policy for details.

Legal basis: We process contact form data on the basis of legitimate interest (responding to an enquiry) and, where an engagement begins, on the basis of contractual necessity. Engagement participant data is collected with the knowledge and agreement of the client organisation.

Retention: Enquiry data is retained for up to 12 months. Engagement documentation is retained for the duration of the engagement and up to 24 months thereafter for reference purposes, unless a shorter period is agreed.

Contact form submissions are used to respond to your enquiry and, if appropriate, to arrange an initial call. We do not add you to any marketing list without your explicit consent.

Engagement participant data is used solely to conduct the agreed engagement work. It is not shared with third parties and is not referenced in other engagements.

We do not sell, rent or trade personal data. We do not use personal data for profiling, automated decision-making or targeted advertising.

Data submitted through our contact form is transmitted over encrypted connections (HTTPS). Access to stored data is limited to Vellum personnel involved in the relevant enquiry or engagement.

We do not store sensitive personal or financial data. Engagement deliverables (process maps, notes, reports) containing third-party or participant information are stored securely and are not accessible outside the engagement team.

In the event of a data breach that poses a risk of significant harm, affected individuals and the Personal Data Protection Commission (PDPC) will be notified in accordance with PDPA obligations.

Under Singapore's PDPA, you have the right to access personal data we hold about you, to correct inaccurate data and to withdraw consent for data collection where consent is the legal basis.

You may also request that we delete personal data we hold about you, subject to any legal obligations that require us to retain it. Requests will be responded to within 30 days.

To exercise any of these rights, contact us at [email protected] with your name and the nature of your request.

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission Singapore: pdpc.gov.sg.