Privacy policy.

1. Who we are

The GTM Studio Pte Ltd (“we”, “us”, “our”) is a Singapore-registered company providing GTM Engineering consultancy and software services. Our registered office is at 56a/b Boat Quay, Singapore.

For privacy questions, contact our Data Protection Officer at privacy@thegtmstudio.io.

2. What we collect

We collect personal data you provide directly when you:

• Submit forms on our website (name, email, company, role, message content).
• Subscribe to our newsletter (email address).
• Engage us for a workshop or service (business contact details, engagement-related communications).
• Visit our website (analytics data via privacy-respecting tooling — IP-anonymised, no fingerprinting).

3. How we use it

• To respond to enquiries and book workshops.
• To deliver services we've been engaged for.
• To send our monthly newsletter (you can unsubscribe in one click).
• To improve our website and content based on aggregate usage.
• To meet legal and regulatory obligations.

4. Legal basis

Under GDPR, we process personal data on the basis of (a) your consent, (b) performance of a contract, or (c) our legitimate business interests where these don't override your rights. Under Singapore's PDPA, we obtain deemed or express consent before collecting personal data.

5. Sharing

We don't sell personal data. We share it only with:

• Service providers acting on our instructions (e.g., email delivery, CRM, hosting) under binding data-processing agreements.
• Authorities where required by law.
• Other parties with your explicit consent.

6. Storage and security

Personal data is stored on servers in Singapore and the European Union with reputable providers (AWS, Webflow, HubSpot). We use industry-standard encryption in transit (TLS 1.3) and at rest. Access is limited on a need-to-know basis with two-factor authentication enforced.

7. Retention

• Enquiry data: 24 months from last contact, then deleted.
• Newsletter subscribers: until you unsubscribe, then 30 days for unsubscribe-confirmation.
• Client engagement data: 7 years for tax/audit purposes, then deleted.
• Website analytics: 14 months in aggregate form.

8. Your rights

You have the right to access, correct, port, restrict, or delete the personal data we hold about you. You can also withdraw consent or object to processing. To exercise these rights, email privacy@thegtmstudio.io — we respond within 30 days.

9. Cookies

We use a minimal set of cookies for essential functionality and privacy-respecting analytics. No third-party advertising cookies. You can decline non-essential cookies via your browser settings without affecting core functionality.

10. International transfers

If we transfer your data outside your jurisdiction, we ensure adequate protection through Standard Contractual Clauses (SCCs) or equivalent safeguards approved by relevant data-protection authorities.

11. Children

Our services are intended for business audiences. We don't knowingly collect personal data from anyone under 16. If you believe we have, contact us and we'll delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified via email to newsletter subscribers and prominently on the site. The “last updated” date at the top reflects the most recent revision.

13. Complaints

If you're unhappy with how we handle your data, contact us first — we want to fix it. You also have the right to lodge a complaint with Singapore's PDPC (pdpc.gov.sg) or your local data-protection authority.