Privacy Policy & Data Governance

1. Introduction & Roles Under the PDPA

Luke Solutions Pte. Ltd. ("ECKHO", "we", "us", or "our") operates the ECKHO corporate secretarial practice management operating system. We are committed to safeguarding personal data in compliance with the Singapore Personal Data Protection Act 2012 ("PDPA").

Under the PDPA and PDPC Advisory Guidelines:

• Organisation / Data Controller: We act as an Organisation regarding prospective customers, website visitors, billing contacts, and demo inquiries collected directly for our own business administration.
• Data Intermediary Framework: Where Luke Solutions processes personal data solely on a customer's behalf and for that customer's purposes (such as when Corporate Service Providers, law firms, or corporate secretaries store entity records and identity documents in ECKHO), the parties' respective roles and responsibilities are documented consistently with the PDPA's data-intermediary framework pursuant to contract, subject to applicable Protection and Retention Limitation obligations under the PDPA.

2. Personal Data We Collect & Process

Depending on your interaction with ECKHO, we may collect or process the following categories of data:

• Prospective & Account Information: Full name, business email address, contact telephone number, corporate employer/firm name, role, and subscription tier interest.
• Entity Governance & Identity Information: Identity information, including NRIC/passport information where lawfully required, is processed for defined customer onboarding, identity verification, compliance or recordkeeping purposes in accordance with the customer's instructions and applicable statutory requirements.
• Technical & Audit Data: IP addresses, browser user-agent, timestamped activity logs, digital signature verification hashes, and security challenge tokens (via Cloudflare Turnstile).

3. Purposes of Collection, Use & Disclosure

In accordance with Section 18 of the PDPA, we collect, use, and disclose personal data only for reasonable business purposes, including:

• Providing, maintaining, and supporting the ECKHO software platform and user accounts;
• Assisting corporate service providers in preparing statutory company registers, AGM/AR deadlines, and structured records for statutory compliance with the Singapore Companies Act 1967;
• Executing electronic signature workflows under the Electronic Transactions Act 2010 framework with cryptographic audit trails;
• Facilitating customer-initiated screening against sanctions, PEPs, and adverse media databases under Singapore corporate services regulatory requirements;
• Responding to inquiries, scheduling software demonstrations, and processing payments;
• Detecting, preventing, and addressing security incidents, bot traffic, and unauthorized platform access.

4. Strict Data Isolation & Non-Competition Covenant

5. Data Storage, Sovereignty & Security Safeguards

In compliance with Section 24 of the PDPA (Protection Obligation), we implement comprehensive administrative, physical, and technical safeguards:

• Local Singapore Cloud Hosting: Customer production databases and entity files are hosted within Singapore data centers on Oracle Cloud Infrastructure (OCI).
• Cryptographic Controls: Data in transit is protected using TLS 1.3 encryption (256-bit). Data at rest, including stored identity documents, is encrypted using AES-256.
• Access Governance & 2FA: Firm-level tenant data isolation, role-based permission scopes, and mandatory email-verified Two-Factor Authentication (2FA) for team accounts.
• Forensic Traceability: Dynamic PDF watermarking displaying user credentials and export timestamps to deter unauthorized distribution.

6. Retention & Disposal (PDPA Section 25)

We retain personal data only for as long as necessary to satisfy the purpose for which it was collected, or as required by applicable laws (such as statutory 5-year recordkeeping requirements for corporate service providers under Singapore corporate regulations). When retention is no longer required, data is securely anonymized or permanently purged from our active systems.

7. Cross-Border Data Transfers (PDPA Section 26)

Our primary infrastructure resides in Singapore. If personal data is transferred outside Singapore (e.g. for specialized infrastructure redundancy or subprocessor services), we take steps to ensure that the recipient organisation provides a standard of protection comparable to the PDPA.

8. Individual Rights: Access, Correction & Consent Withdrawal

Under Sections 16, 21, and 22 of the PDPA, individuals have the right to request access to and correction of their personal data in our possession, or to withdraw consent for marketing communications.

Where ECKHO processes personal data as a Data Intermediary on behalf of a corporate service provider or law firm, access or correction requests regarding company records should be submitted directly to the relevant CSP or company secretary. We will assist our customer organisations in fulfilling verifiable requests.

For any personal data protection inquiries, access requests, or privacy questions, please contact Luke Solutions Pte. Ltd. at [email protected].