Privacy notice

Last updated: 16 May 2026

Contents

• 1. Data controller
• 2. Data we collect
• 3. Legal bases
• 4. Who we share data with
• 5. Data retention
• 6. International transfers
• 7. Your rights (GDPR / UK GDPR / PDPA)
• 8. Cookies and trackers
• 9. Security
• 10. Data breach notification
• 11. Changes to this notice
• 12. Regulatory complaints
• 13. Contact the DPO

1. Data controller

The controller of personal data processed through swyftsite.com (the “Site”) is:

VBCREATION PTE. LTD.
A private company limited by shares incorporated in Singapore
UEN: 202620906D
Registered office: 160 Robinson Road #14-04, Singapore Business Federation Center, Singapore 068914

VBCREATION PTE. LTD. acts as data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (“EU GDPR”), Article 4(7) of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (UK), and the Personal Data Protection Act 2012 (Singapore, “PDPA”).

2. Data we collect

We process personal data in three categories of data subjects:

2.1 Visitors

• Technical data: IP address (truncated), user-agent, pages visited, timestamps.
• Cookie identifiers (see §8).

2.2 Prospects

• Identification data: first name, last name, professional email, company, role.
• Business data: website URL, sector, country of incorporation.
• Outreach data: messages exchanged, engagement events (open, click, reply).

2.3 Customers

• Identification data: first name, last name, billing email, billing address, company.
• Account data: authentication identifiers, session metadata, audit logs.
• Service data: discovery briefs, generated site assets, support exchanges.
• Payment data: processed via third-party providers (Stripe, Wise) — VBCREATION PTE. LTD. does not store full card numbers or banking credentials.

3. Legal bases

• Consent (Art. 6(1)(a) GDPR / s.13 PDPA): non-essential cookies and trackers, marketing communications to individuals where required, newsletter subscription.
• Performance of a contract (Art. 6(1)(b) GDPR): account creation, service delivery, billing, customer support.
• Legitimate interest (Art. 6(1)(f) GDPR): B2B outreach to professional contacts, fraud prevention, security monitoring, product analytics in aggregated form. A balancing test is documented for each legitimate-interest processing.
• Legal obligation (Art. 6(1)(c) GDPR / IRAS): retention of accounting and customer records.

4. Who we share data with

Personal data is shared only with categories of recipients strictly necessary to operate the service. We do not sell personal data.

• Hosting and edge network: Cloudflare, Inc. (United States) — https://www.cloudflare.com.
• Payment processor (cards): Stripe Singapore — payment instrument data is collected directly by Stripe under PCI-DSS scope.
• Money transfer and multi-currency e-money: Wise Business (EMI regulated by FCA UK, licence 900507 / Major Payment Institution regulated by MAS Singapore under the Payment Services Act 2019).
• Accounting and bookkeeping service: Sleek Tech Pte. Ltd. (Singapore) — receives customer billing records to meet IRAS and ACRA filing obligations.
• Transactional email and outreach delivery: MailerSend (within the EEA).
• Authorities and courts: where compelled by a valid legal request issued under Singapore, EU member state or UK law.

5. Data retention

Personal data is kept only for as long as necessary for each processing purpose:

• Customer data: 5 years after end of business relationship (IRAS legal requirement: Income Tax Act s.67(1) + Companies Act s.199(2)).
• Prospect data (non-customers): 90 days maximum after last contact (deleted if no engagement).
• Authentication logs and security events: 12 months.
• Cookie identifiers: see retention windows declared in the cookie banner (§8), capped at 13 months.
• Accounting books and supporting documents: 5 years from the end of the financial year, in accordance with the Singapore Companies Act s.199(2) and the Income Tax Act s.67(1).

6. International transfers

As VBCREATION PTE. LTD. is established in Singapore, some processing operations involve transfers of personal data outside the European Economic Area and outside the United Kingdom.

• EU → Singapore and other third countries: transfers rely on the Standard Contractual Clauses adopted by the European Commission under Decision 2021/914 of 4 June 2021, supplemented where appropriate by transfer impact assessments and contractual or technical safeguards.
• UK → Singapore and other third countries: transfers rely on the UK Addendum to the EU SCCs issued by the Information Commissioner's Office (ICO).
• From Singapore: transfers comply with PDPA s.26 and the Personal Data Protection Regulations 2021, with comparable protection ensured through contractual safeguards.

A copy of the applicable safeguards may be obtained from the DPO (see §13).

7. Your rights (GDPR / UK GDPR / PDPA)

Under PDPA (Singapore), GDPR (EU) and UK GDPR / Data Protection Act 2018 (UK):

• Right of access to your personal data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) within the limits provided by law.
• Right to restrict processing.
• Right to object to processing, in particular for direct marketing and for processing based on legitimate interest.
• Right to data portability.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
• Right not to be subject to a decision based solely on automated processing producing legal effects.
• Right to lodge a complaint with the competent supervisory authority (see §12).

Requests may be sent to dpo@vbcreation.io. We respond within one month of receipt, extendable by two further months for complex requests in accordance with Art. 12(3) GDPR.

8. Cookies and trackers

The Site uses cookies and similar technologies. Strictly necessary cookies (session, security, load balancing) are deposited without consent. Analytics, audience measurement beyond the exempt scope and marketing trackers are deposited only after explicit, granular consent obtained through our cookie banner. Consent can be withdrawn at any time via the cookie banner or upon request to the DPO (see §13).

9. Security

VBCREATION PTE. LTD. implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include encryption in transit (TLS 1.2+), encryption at rest for sensitive stores, role-based access control, audit logging, principle of least privilege, vendor due diligence, secure software development practices and periodic security reviews.

10. Data breach notification

In the event of a personal data breach, our notification obligations are as follows:

• Singapore (PDPA): if the breach is likely to result in significant harm to affected individuals OR affects 500 or more individuals, we notify the PDPC and affected individuals within 3 calendar days after determining the breach is notifiable (Personal Data Protection (Notification of Data Breaches) Regulations 2021).
• European Union (GDPR): we notify the competent supervisory authority within 72 hours of becoming aware of the breach, and affected individuals without undue delay where there is a high risk to their rights and freedoms.
• United Kingdom (UK GDPR / DPA 2018): same 72-hour notification standard to the ICO, with the same high-risk threshold for notifying affected individuals.

11. Changes to this notice

This Privacy notice may be updated to reflect changes in our processing operations or in applicable law. The “Last updated” date at the top of this page indicates the date of the most recent revision. Material changes are highlighted on the Site and, where required, communicated to affected individuals before they take effect.

12. Regulatory complaints

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the competent supervisory authority:

• Singapore: Personal Data Protection Commission (PDPC) — https://www.pdpc.gov.sg.
• United Kingdom: Information Commissioner's Office (ICO) — https://ico.org.uk.
• European Union: Your national Data Protection Authority (e.g., France: CNIL — https://www.cnil.fr; Germany: BfDI; Italy: Garante; Spain: AEPD).

13. Contact the DPO

For any question relating to your personal data or to exercise your rights, please contact our Data Protection Officer:

Email: dpo@vbcreation.io
Post: VBCREATION PTE. LTD. — DPO — 160 Robinson Road #14-04, Singapore Business Federation Center, Singapore 068914

SwyftSite by VBCreation — VBCREATION PTE. LTD. — UEN 202620906D — Legal notice · Terms of service