Privacy Policy
Last Updated: 7 April 2025
Riverlith ("we", "our", "us") is committed to handling personal data responsibly and in line with Singapore's Personal Data Protection Act 2012 (PDPA). This policy describes what data we collect, how we use it, and the rights available to you.
1. Who we are
Riverlith is a product strategy consulting practice registered in Singapore, operating from 30 Cecil Street, #19-08, Prudential Tower, Singapore 049712. For data-related enquiries, contact us at [email protected].
2. Data we collect
We collect personal data in the following circumstances:
- Enquiry forms: Name, email address, and optionally phone number and a brief description of your situation.
- Email correspondence: Content you send us before, during, or after an engagement.
- Engagement documents: Documents you choose to share with us as part of a sounding-board or other engagement.
- Website analytics: Anonymised usage data via cookies (where consented), including page views and general device type.
3. How we use personal data
Personal data is used for the following purposes:
- Responding to enquiries and assessing whether an engagement is a suitable fit
- Delivering the engagement services you have engaged us for
- Sending written deliverables (notes, assessment documents, discovery plans)
- Scheduling and coordinating calls
- Complying with applicable legal obligations
We do not use personal data for marketing, profiling, or sharing with third-party advertisers.
4. Legal basis for processing
- Consent: Where you have provided consent, such as submitting an enquiry form
- Contractual necessity: Where processing is necessary to fulfil an engagement you have agreed to
- Legitimate interests: For internal record-keeping and responding to unsolicited professional enquiries
- Legal obligation: Where processing is required under Singapore law
5. Data retention
- Enquiry data where no engagement followed: deleted within 90 days of last contact
- Engagement documents shared by clients: deleted within 14 days of engagement close
- Financial records related to engagements: retained for 5 years in accordance with Singapore accounting requirements
- Email correspondence: retained for 12 months after last contact, then deleted
6. Data sharing
Riverlith does not sell, rent, or share personal data with third parties for commercial purposes. Data may be shared with:
- Service providers necessary to operate this website (hosting, analytics), bound by data processing agreements
- Legal or regulatory authorities where required by Singapore law
7. Cookies
We use cookies on this website. Essential cookies are required for the site to function. Analytics cookies are used only with your consent. Please see our Cookie Policy for full details and controls.
8. Security
We use reasonable technical and organisational measures to protect personal data from unauthorised access, loss, or disclosure. These include access controls, encrypted communications, and document handling procedures. In the event of a data breach that is likely to result in significant harm, we will notify affected individuals and the Personal Data Protection Commission (PDPC) as required under the PDPA.
9. Your rights under the PDPA
Under Singapore's Personal Data Protection Act, you have the right to:
- Request access to personal data we hold about you
- Request correction of inaccurate personal data
- Withdraw consent to processing (where processing is consent-based)
- Request that we cease using your data for specified purposes
- Lodge a complaint with the Personal Data Protection Commission
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
10. Third-party links
This website may contain links to external resources. Riverlith is not responsible for the privacy practices of those sites and recommends reviewing their policies independently.
11. Children's privacy
Our services are intended for business professionals aged 18 and over. We do not knowingly collect personal data from individuals under 18.
12. Changes to this policy
We may update this policy from time to time. When we do, we will revise the "Last Updated" date above. Continued use of our services after a change is posted constitutes acceptance of the updated policy.
13. Contact
For privacy-related questions or requests:
Email: [email protected]
Address: 30 Cecil Street, #19-08, Prudential Tower, Singapore 049712