Privacy Policy

1. Scope and Application

This policy covers personal data processed in connection with the mechatronics service business of Apex Mechtronix Pte. Ltd. That includes website visits, enquiry forms, email and telephone contact, quotations, purchase orders, service job cards, delivery notes, invoices, warranty claims, site visits and follow up support. It also covers the records the bay keeps about the equipment it services, to the extent those records identify an individual.

The policy applies to personal data held in electronic systems and to personal data held on paper. Paper job cards, intake sheets and signed delivery notes are part of the operating record of the bay, and they are handled under the same principles described here even where a physical file is involved.

Where a corporate customer provides personal data about its own employees, the Company treats that data as confidential business information and handles it in line with the instruction of the customer, while still applying the safeguards described in this policy. The corporate customer remains responsible for ensuring it has a lawful basis to share the data with the Company.

This policy does not apply to websites operated by other organisations, even where a link to such a website appears on this site. It does not apply to personal data processed by a customer in its own systems. It does not create rights for any person beyond those described in law and in this document.

2. Data We Collect

The Company collects only the personal data it needs for a stated purpose. The categories below describe what is typically involved. Not every category applies to every person, and the Company avoids collecting a category that has no bearing on the work at hand.

Identity and contact data

• Full name, job title, employer and department.
• Work email address and, where given, a mobile number for site coordination.
• Work address and delivery address for hardware.
• Preferred language and preferred method of contact.

Commercial data

• Company registration details supplied on a purchase order.
• Quotation references, order numbers and invoice references.
• Billing contact and payment status noted from the finance team of the customer.
• Correspondence about scope changes, delivery dates and warranty claims.

Service and technical data

• Equipment make, model, serial number and installed location.
• Fault descriptions, photographs and traces supplied by the customer.
• Technician notes, torque values, measured readings and release records.
• Site access notes, safety induction records and the name of the escort on site.

Website data

• Internet protocol address and browser type recorded by the hosting provider.
• The page requested, the time of the request and the referring page.
• Messages sent through the enquiry form, which pass through the mail program of the visitor rather than through a database on this site.

Recruitment data

• Curriculum vitae, cover letter, references and interview notes where a person applies for a role at the bay.

The Company does not intentionally collect special categories of personal data such as health data, religious belief or biometric identifiers. If a customer sends such data without being asked, the Company will delete it where it is not needed for the service and will note the deletion in the correspondence file.

3. How Data Reaches Us

Most personal data reaches the Company directly from the person concerned. A customer contact sends an email, fills in the enquiry form, calls the intake desk or hands over a business card at the bay. A technician writes a name on a job card during a site visit. A supplier representative registers at reception before a delivery. None of this is unusual, and each of these routes is described below so that the record is complete.

Data may also reach the Company indirectly. A purchasing department may include the name and email of an engineer on a purchase order. A freight forwarder may list a receiving contact on a delivery note. A customer may forward a chain of messages that includes colleagues who never contacted the Company directly. Where data arrives indirectly, the Company limits its use to the purpose for which it was shared.

The website itself is simple. It is a set of static pages that describe the service lines, the bay and the contact routes. The enquiry form does not post to a server owned by the Company. Instead, the form prepares an email in the mail program of the visitor, so the content reaches the Company only when the visitor chooses to send it. This design keeps personal data out of a web database and puts the visitor in control of the transmission.

Server logs are generated by the hosting provider as a normal part of serving pages. Those logs contain technical data such as the address of the requesting device and the page requested. The Company uses the logs only for availability, troubleshooting and abuse prevention, and it does not attempt to identify individual visitors from them except where a security incident requires investigation.

4. Purposes of Processing

The Company processes personal data for a limited set of purposes. Each purpose is tied to a service activity or a legal duty, and the Company does not reuse data collected for one purpose for an unrelated purpose without a fresh basis.

• Responding to enquiries about the six service lines and confirming which station a job should start on.
• Preparing quotations and estimates, including the scope, release standard and expected bay time.
• Performing servo drive rebuilds, control board refits, motion stage alignments, encoder recalibrations, cable loom replacements and preventive service cycles.
• Coordinating site visits, including access arrangements, safety induction and escort allocation.
• Keeping job cards, test records and release sheets so that a machine can be traced through its service history.
• Issuing invoices, tracking payment and managing warranty claims.
• Maintaining supplier and subcontractor relationships where a part or service is outside the bay.
• Keeping accounting, tax and corporate records required by Singapore law.
• Investigating safety incidents, equipment damage or disputes.
• Improving the clarity of the website and the written service literature.
• Managing recruitment where a person applies for a role.
• Preventing fraud, misuse of the site and unauthorised access to records.

Where the Company wishes to use personal data for a purpose not listed here, it will provide additional notice before doing so, or seek consent where consent is the appropriate basis. The notice will state the new purpose, the data involved and the choices available to the person concerned.

5. Legal Bases

The Company relies on several legal bases depending on the activity. The Singapore Personal Data Protection Act provides the primary framework for the business, and where the Company handles data of individuals in other jurisdictions it applies the local requirements that are mandatory for that handling.

Performance of a contract

Where a person is a party to a service contract, or where processing is necessary to take steps at that person request before a contract is formed, the Company processes data on that basis. Quotations, job cards, delivery notes and invoices fall naturally under this heading.

Consent

Where the Company asks for consent, it does so separately and in plain language. Consent is used for optional activities such as sending a service newsletter or retaining a curriculum vitae for a future role. Consent can be withdrawn at any time, and withdrawal does not affect processing carried out before the withdrawal.

Legitimate interests

The Company processes some data on the basis of its legitimate interests in running a safe and well documented workshop. Examples include server log analysis for security, keeping a service history so that repeat jobs are handled consistently, and recording site access for safety. The Company balances those interests against the rights of the individual and does not rely on this basis where the impact on the individual would be disproportionate.

Legal obligation

Some records must be kept because the law requires it. Accounting records, tax documents and certain safety records are retained and disclosed where a lawful request is received from a competent authority.

Vital interests and public interest

In rare cases, such as a serious safety incident at the bay or on a customer site, the Company may process data to protect a person from harm. This basis is used narrowly and only where no other basis applies.

6. Equipment and Job Records

A mechatronics bay lives on records. The job card for a servo drive rebuild, a control board refit or a motion stage alignment follows the hardware from intake to release, and it usually contains the name of the technician who performed each step, the name of the customer contact who authorised the work and the name of the person who signed the release. Those names are personal data, and the Company treats the job card as a personal data record even though most of its content is technical.

The technical content of a job card, such as torque values, measured readings, reference designators and trace captures, is retained because it is the basis of the warranty and the service history. It is shared with the customer who owns the equipment. It is not shared with other customers, and it is not used to advertise the Company without the identification of the equipment being removed first.

Photographs taken during intake and during the rebuild are retained with the job card. Photographs are framed to show the equipment rather than the people around it. Where a person appears incidentally in a photograph, the Company does not publish the image and will crop or delete it on request where the image is not needed for the technical record.

Trace files and test captures from the proof bench are retained for the warranty period and for a reasonable period afterwards. They are used to answer questions about a later fault and to compare the behaviour of a machine across service cycles. They are not sold or licensed to third parties.

7. Cookies and Local Storage

This website is built as static pages. It does not set advertising cookies, it does not load third party tracking scripts and it does not create a profile of a visitor across sessions. The pages load a local stylesheet and a local script file, both served from the same domain, so the number of external requests is kept to a minimum.

The script that supports the mobile navigation and the reveal animation runs in the browser and does not transmit data to the Company. It stores a small amount of state in memory for the duration of the visit only. No identifier is written to persistent local storage, and no cookie is created by the Company for the purpose of recognising a returning visitor.

The hosting provider may set a strictly necessary cookie or use a similar mechanism for load balancing and security. Such a mechanism is not used for marketing, is not shared with advertising networks and is removed when the session ends. Where the provider offers a control that allows the Company to switch the mechanism off without affecting availability, the Company prefers the simpler configuration.

A visitor can block or delete cookies through the settings of the browser. Because the site does not depend on cookies for its main functions, blocking them does not prevent a visitor from reading the pages or sending an enquiry through the contact form.

8. Analytics and Logs

The Company keeps a small amount of website measurement so that it can tell whether the service pages are being found and whether the contact route works. Measurement is aggregate and does not attempt to identify a person. Where a third party analytics service is used, it is configured with the minimum retention available and without advertising features.

Server logs are kept by the hosting provider for a short operational period. The logs record the internet protocol address, the request time, the requested page, the response code and the user agent. They are used to detect outages, to investigate repeated failed requests and to block abusive traffic. The Company does not combine log data with enquiry data to build a profile of a named person.

Email correspondence is retained in the mailbox of the Company for the period needed to handle the matter and to keep the commercial record. Email is not used as a marketing list unless the recipient has opted in, and every marketing message includes a clear route to stop receiving further messages.

The Company reviews its measurement setup at least once a year. If a tool is found to collect more than is needed, it is removed or reconfigured. The default is to collect less.

9. Sharing and Disclosure

The Company shares personal data only where there is a clear reason and a lawful basis. The categories of recipient are limited, and each recipient receives only the data needed for the task.

• The customer that owns the equipment, for job cards, quotations, delivery notes and invoices.
• Freight and courier providers, for the name, address and telephone number needed to collect or deliver hardware.
• Parts suppliers and authorised repair partners, where a component must be sourced or a specialist process is required outside the bay.
• Professional advisers such as accountants and lawyers, under a duty of confidence.
• Banks and payment processors, for the details needed to settle an invoice.
• Insurers, where a claim arises from damage or a safety incident.
• Regulators, courts and law enforcement, where disclosure is required by law or by a valid legal process.

The Company does not sell personal data. It does not rent contact lists. It does not share personal data with advertising networks. Where a disclosure is made to a public authority, the Company checks that the request is lawful, limits the response to what is strictly required and, where permitted, informs the person concerned.

If the business is reorganised, merged or transferred, personal data may be transferred to a successor organisation that continues the service. In that case the successor is bound by this policy until it publishes its own notice, and affected persons are informed of the change through the website and, where practical, by email.

10. Service Providers

The Company uses a small number of service providers to run the website and the business systems. Each provider is chosen for reliability and is bound by a written agreement that requires confidentiality, security and the use of data only for the agreed purpose.

Hosting is provided by a cloud infrastructure provider that serves static files from a content delivery network. The provider processes request logs on behalf of the Company and does not use the data for its own marketing. Email is provided by a business mail service with encryption in transit and at rest. Accounting records are held in a bookkeeping system that is accessible only to authorised staff.

The Company reviews its providers when a contract is renewed and when a material change is announced. A provider that cannot meet the security and confidentiality terms is replaced. The Company does not add a new provider that processes personal data without first updating the internal register of processing activities.

Where a provider operates outside Singapore, the transfer is covered by the safeguards described in the next section. The Company does not rely on a provider promise alone; it checks the contractual terms and, where relevant, the certification the provider holds.

11. Cross Border Transfers

The Company is based in Singapore and performs most of its work from the bay at 30 Petain Road, Singapore - 208099, Singapore (SG). Some service providers, such as the hosting and email platforms, may store data in other countries. Where personal data leaves Singapore, the Company takes steps to ensure that the data continues to receive a standard of protection comparable to the standard applied at home.

Those steps include contractual clauses that require the recipient to protect the data, to limit its use to the agreed purpose, to notify the Company of a breach and to return or delete the data at the end of the engagement. Where a provider is located in a jurisdiction with a recognised adequacy decision, the Company records that fact in its provider register rather than duplicating the contractual work.

A customer or individual who wishes to know where their data is stored may ask the Company in writing. The Company will identify the countries involved and the safeguards applied, subject to any confidentiality obligation owed to the provider.

Site visits do not normally involve cross border transfer. When a technician travels to a customer site outside Singapore, the job card may be completed on a company device and synchronised to the Singapore systems. The device is encrypted and is wiped remotely if it is lost.

12. Retention Periods

The Company keeps personal data only as long as it is needed for the purpose for which it was collected or for a legal requirement. Retention is set by record type rather than by a single blanket period, because a job card and a marketing preference have very different lives.

• Enquiries that do not become a job are kept for twelve months and then deleted.
• Quotations that are not accepted are kept for twenty four months for reference and then deleted.
• Job cards, test records and release sheets are kept for seven years from the date of the last service on the equipment, to support warranty and traceability.
• Invoices and accounting records are kept for the period required by Singapore tax law, which is currently five years from the end of the relevant year of assessment.
• Supplier and subcontractor records are kept for the duration of the relationship and for six years afterwards.
• Recruitment records for unsuccessful applicants are kept for twelve months unless the applicant asks for a longer retention.
• Marketing preferences are kept until the person unsubscribes, plus a short suppression record to ensure the preference is respected.
• Server logs are kept by the hosting provider for a short operational period, typically no longer than ninety days.

When a retention period ends, the data is deleted or anonymised. Anonymisation removes the identifiers that link a record to a person while preserving the technical content that gives the record its value. Where a legal hold applies, the affected records are preserved until the hold is lifted, and the reason for the hold is recorded.

13. Security Measures

The Company applies technical and organisational measures that are proportionate to the sensitivity of the data and to the size of the operation. The measures are reviewed when a new system is introduced and after any security incident.

Technical measures

• Encryption of data in transit using current transport security protocols.
• Encryption of company laptops and mobile devices, with remote wipe enabled.
• Multi factor authentication for email, accounting and hosting accounts.
• Role based access, so that a technician can see job cards without seeing payroll data.
• Automatic backup of job records, with periodic restore testing.
• Network segmentation between the office systems and the test bench instrumentation.

Organisational measures

• A written confidentiality obligation for every member of staff and contractor.
• Induction training on data handling, phishing and physical security at the bay.
• A clear rule that equipment records leave the bay only through the approved file transfer route.
• A visitor log at reception and a requirement that visitors are escorted in the workshop.
• A disposal routine for paper records and for storage media that have reached the end of their life.

No system is perfectly secure. If a personal data breach occurs, the Company contains the incident, assesses the risk to affected persons and notifies the relevant authority and the affected persons where the law requires it. A written record of the incident is kept, including the cause and the corrective action taken.

14. Your Rights

Subject to the law that applies to the person, the Company supports the following rights. A request can be made by email to service@apexmechtronix.autos or by post to 30 Petain Road, Singapore - 208099, Singapore (SG). The Company may ask for proof of identity before acting on a request, so that data is not disclosed to the wrong person.

• Access. A person may ask what personal data the Company holds about them and receive a copy in a readable form.
• Correction. A person may ask the Company to correct data that is inaccurate or incomplete.
• Deletion. A person may ask for data to be deleted where it is no longer needed and no legal obligation requires its retention.
• Restriction. A person may ask the Company to pause processing while a dispute about accuracy is resolved.
• Portability. Where the law provides it, a person may ask for data they supplied to be provided in a structured format.
• Objection. A person may object to processing based on legitimate interests, and the Company will stop unless it can show compelling grounds that override the objection.
• Withdrawal of consent. Where processing is based on consent, a person may withdraw it at any time.
• Complaint. A person may complain to the Company or to the data protection authority in the relevant jurisdiction.

The Company aims to respond to a request within thirty days. Where a request is complex, the Company explains the reason for any extension and keeps the person informed. There is normally no charge for a request, though a reasonable fee may apply where requests are manifestly unfounded or excessive.

15. Marketing Communications

The Company sends marketing messages only to persons who have asked to receive them, or to business contacts where the law permits a soft opt in following a service relationship. Marketing is limited to service information, technical notes and workshop announcements. It is never used to promote unrelated products.

Every marketing message includes a clear way to stop receiving further messages. The Company honours an opt out promptly and keeps a minimal suppression record so that the preference is respected across systems. Opting out of marketing does not affect messages that are needed to perform a service, such as an update on a job card or a delivery notice.

The Company does not buy contact lists. Where a list is received from a partner, the Company does not use it unless the partner confirms that each recipient has opted in and the basis is documented. Lists that cannot be verified are discarded.

16. Privacy for Children

The services of the Company are provided to businesses and to adult professionals. This website is not directed at children, and the Company does not knowingly collect personal data from a person under the age of eighteen. If a person under that age contacts the Company, the Company will not retain the data beyond what is needed to reply and will ask the person to involve a parent or guardian for any further step.

Where a customer supplies data about a minor in connection with an apprenticeship or an educational visit, the Customer is responsible for obtaining the necessary consent from a parent or guardian. The Company will handle that data with extra care, restrict access to staff who need it and delete it when the programme ends unless a lawful reason for retention applies.

If the Company discovers that data about a child has been collected without an appropriate basis, it will delete the data and record the deletion. A parent or guardian who believes that a child has provided data to the Company may contact the intake desk and the Company will act on the request promptly.

17. Third Party Links

This website may link to the websites of suppliers, standards bodies or equipment manufacturers. Those websites are not controlled by the Company and have their own privacy policies. The Company is not responsible for the content or the data practices of a linked site, and a link does not imply an endorsement of the way that site handles personal data.

A visitor who follows a link to another site should read that site privacy notice before providing personal data. If a linked site asks for data in connection with a service from the Company, the visitor should confirm the request with the intake desk before responding.

The Company reviews outbound links when the site is updated and removes links that no longer serve a technical or commercial purpose. A link that is broken or misleading is corrected as soon as it is identified.

18. Automated Decisions

The Company does not make automated decisions that produce legal or similarly significant effects for an individual. Quotation approval, warranty decisions and service scheduling are made by people. Software may sort enquiries, flag a known fault pattern or suggest a stock item, but a member of staff reviews the result before it affects a customer.

Where a diagnostic tool produces a recommendation, the recommendation is shown to the technician as an aid. The technician remains responsible for the diagnosis and for the release decision. The job card records the person who approved the work so that the decision can be traced.

If the Company introduces a system that makes or supports a decision with a significant effect, it will update this policy, describe the logic in plain language and provide a route for a person to request human review. The Company will not rely on a fully automated decision where the law requires human involvement.

19. Changes to This Policy

The Company reviews this policy at least once a year and after any material change to the service, the systems or the law. The version number and the effective date appear at the top of the page, so a visitor can tell whether the document has changed since the last visit.

Where a change affects how personal data is used, the Company will provide notice before the change takes effect. Notice may be given through the website, by email to active customers or, where the change is significant, by a direct message to the affected contacts.

A person who continues to use the website or the service after a change takes effect is treated as having seen the updated policy. Continuing to use the service does not, by itself, constitute consent to a new processing purpose where consent is required. In that case the Company asks for consent separately.

Previous versions of the policy are kept internally for six years so that the Company can show what was in force at a given date if a question arises.

20. How to Contact Us

Questions about this policy, requests to exercise a right and complaints about the handling of personal data should be sent to the intake desk of the Company. The same address and telephone number are used for service enquiries and for privacy matters, so there is no separate mailbox to remember.

By email: service@apexmechtronix.autos

By telephone: +12343449628, during the business hours published on the contact page.

By post or in person:

The Company takes every complaint seriously. A complaint is logged, investigated and answered in writing. Where a complainant is not satisfied with the response, the Company will explain the route to the relevant data protection authority and will cooperate with any inquiry that follows.

This policy is published by Apex Mechtronix Pte. Ltd. and applies to the website at apexmechtronix.autos as well as to the service activity of the mechatronics bay. The developer name Apex Mechtronix is used for the design and maintenance of the website, while the company name and address above identify the organisation that is accountable for the processing described in this document.