Effective date: 10 November 2026
1. Who we are
EXLAG Pte. Ltd. (“EXLAG”, “we”, “us”) is a company incorporated in Singapore, Unique Entity Number 201633292N, with its registered office at 21 Tan Quee Lan Street, #02-04, Heritage Place, Singapore 188108. We operate the website exlag.com (the “Website”) and are responsible for the personal data collected through it under the Personal Data Protection Act 2012 of Singapore (“PDPA”).
Our Data Protection Officer is Daniel Kettler, Director. You can reach him at d.kettler@exlag.com or at the address above.
2. What this policy covers
This policy explains which personal data we collect when you visit the Website or contact us through it, why we collect it, how long we keep it, who else receives it, and which rights you have. It does not cover data we receive in the course of a project or business relationship; that is governed by the respective contract.
3. Visiting the Website (server logs)
When you open a page, the web server of our hosting provider automatically records technical data: your IP address, the date and time of the request, the page requested, the referring page, and your browser type and operating system. We need this data to deliver the pages to your device and to keep the Website secure, for example to detect attacks or faults. It is not combined with other data about you.
Log files are kept only for as long as needed for these purposes and are then deleted automatically. Our hosting provider is SG Cloud Hosting, Singapore.
4. Cookies, analytics and third-party content
The Website sets no cookies for visitors and uses no analytics, tracking, advertising or social-media tools. Fonts and images are delivered from our own web server, so no data is sent to third-party content or font networks when you view a page. The Website contains no embedded maps or videos.
Should we add such tools in the future, we will update this policy before they go live.
5. Contact form
If you use the contact form, we collect the data you enter: your name, company (optional), work email address, the topic you select and your message. To protect the form against automated abuse, it contains a hidden field that only software fills in, and a hashed (one-way encrypted) version of your IP address is stored for 15 minutes to limit the number of submissions.
We use this data solely to handle your enquiry: to answer you, to prepare a study, offer or project, and to keep a record of the correspondence. By submitting the form you consent to this use. We do not use contact form data for marketing and do not pass it on for any other purpose.
Your message is delivered to our internal team as an email through the email delivery service Resend (Resend, Inc., San Francisco, California, USA). Resend processes the message only on our instructions and for the purpose of delivery, under a data processing agreement that requires a standard of protection comparable to the PDPA. The message is then stored in our business mailboxes.
We keep enquiries for as long as needed to deal with them. If an enquiry leads to a business relationship, we keep the correspondence for the duration of that relationship and any statutory retention period for business records in Singapore (currently five years). Enquiries that do not lead to a business relationship are deleted after twelve months at the latest.
6. Email contact
If you email us directly, we process the data you send us in order to reply. Our mailboxes are hosted by SG Cloud Hosting, Singapore. The retention rules in section 5 apply.
7. Who receives your data
Within EXLAG, only the staff who need your data to handle your enquiry have access to it. Outside EXLAG, your data is processed by the following service providers, each on our instructions and bound by contract:
| Provider | Service | Location |
|---|---|---|
| SG Cloud Hosting | Web hosting, server logs, email mailboxes | Singapore |
| Resend, Inc. | Delivery of contact form emails | USA |
Enquiries concerning Malaysia may be handled by our Penang office. We disclose personal data to authorities only where the law requires it. We never sell personal data.
8. Transfers outside Singapore
Contact form emails are routed through Resend’s systems in the United States, and enquiries may be handled by our office in Penang, Malaysia. In each case we ensure, through contractual arrangements, that the data receives a standard of protection comparable to the PDPA, as its transfer limitation obligation requires.
9. Security
The Website is delivered over an encrypted connection (HTTPS). Access to enquiries is limited to the staff who need it, and our hosting provider applies physical and technical safeguards to its servers. No transmission over the internet is completely secure, so we cannot guarantee the absolute security of data you send us.
10. Your rights
Under the PDPA you may ask us for access to the personal data we hold about you and for information about how it has been used or disclosed in the past year, and you may ask us to correct it. You may withdraw your consent to our use of your data at any time; we will then explain the likely consequences and stop using the data unless the law requires us to keep it.
Please send requests to our Data Protection Officer (section 1). We respond within 30 days. If you are not satisfied with our response, you may complain to the Personal Data Protection Commission of Singapore (pdpc.gov.sg).
11. Visitors from the European Economic Area, the United Kingdom and Switzerland
If you contact us from one of these regions, the General Data Protection Regulation (GDPR) or its UK or Swiss equivalent may also apply. Our legal basis for handling your enquiry is the preparation of a contract at your request (Art. 6(1)(b) GDPR) and, for the server logs and abuse protection, our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).
You have the right to access, rectify or erase your data, to restrict or object to its processing, and to receive it in a portable format. You may also complain to a data protection supervisory authority in your country. Where your data is transferred outside these regions, we rely on the safeguards offered by our service providers, such as the EU Standard Contractual Clauses.
12. Children
The Website is directed at businesses and is not intended for children. We do not knowingly collect personal data from anyone under 18.
13. Changes to this policy
We may update this policy when the Website or the law changes. The current version and its effective date are always published on this page.
14. Contact
EXLAG Pte. Ltd. · 21 Tan Quee Lan Street, #02-04, Heritage Place, Singapore 188108
Data Protection Officer: Daniel Kettler, d.kettler@exlag.com
See also our Legal Notice.