With the following information, we would like to give you an overview of how we process your personal data as well as your rights under the Data Protection Act. What specific data is processed in detail and how it will be used depends on the requested or agreed services.
1. Who is responsible for data processing and who can I contact?
Contact details as follows:
GC LEASE PTE LTD
80 Anson Road
#11-06 Fuji Xerox Towers
Phone: +65 6351 8252
Fax: + 65 6351 8262
You can reach our operational data protection officer at:
GC LEASE PTE LTD
80 Anson Road
#11-06 Fuji Xerox Towers
2. What sources and data do we use?
We process personal data that we receive from our customers as part of our business relationship. In addition, we process – as far as necessary for the provision of our services – personal data that we might collect from publicly accessible sources (e.g. debtor directories, land registers, trade and association registers, press, internet) or that was obtained from our distribution partners or from other third parties (e.g. a credit agency). Finally, we process personal data of our shareholders, shareholder representatives, guests of the Annual General Meeting and analysts on the basis of our legal obligations.
Relevant personal data includes:
• Personal details (name, address, birthday, place of birth and nationality)
• Contact details (telephone, e-mail address)
• Verification data (e.g. ID data)
• Authentication data (e.g. signature sample)
• Order data (e.g. payment order)
• Data from the fulfilment of our contractual obligations (e.g. sales data in payment transactions)
• Information about your financial situation (e.g. creditworthiness data, scoring/rating data, source of assets)
• Advertising and sales data (including advertising scores), documentation data (e.g. consultation minutes)
• Data in connection with the shareholder position, such as the number of shares, type of shares, type of share ownership or information on the bank holding your shares.
• Data in connection with the Annual General Meeting of GC LEASE PTE LTD such as the number of the admission ticket, powers of attorney, instructions, etc.
and other data comparable to the aforementioned categories.
3. What do we process your data for (purpose of processing) and on what legal basis?
We process personal data in accordance with the provisions of the Singapore Personal Data Protection Act (PDPA):
a. For the fulfilment of contractual obligations
Data is processed in order to provide financial services as part of the execution of our contracts with our customers or to carry out pre-contractual actions, which are carried out upon request. The purposes of data processing are primarily geared towards the specific product (e.g. leasing, factoring) and may include, but are not limited to, needs analysis, consulting and to perform transactions. Further details on the purposes of data processing can be found in the relevant contract documents and terms and conditions.
b. For the protection of our legitimate interests, and those of third parties
As far as necessary, we process your data beyond the actual fulfilment of the contract for the protection of our legitimate interests or those of third parties, in particular:
• Consultation and exchange of data with credit agencies (e.g. DP Credit Bureau, Credit Bureau Singapore, Experian) to identify credit risk or default risk
• For the purposes of examining possible credit risks and default risks as well as preventing criminal offences, we provide DP Credit Bureau, Credit Bureau Sin-gapore and/or Experian Credit (“Credit Bureau Agencies”), with data on the application and the applicant. The Credit Bureau Agencies will provide us with data stored on your person in their respective portals .
In addition, we transfer personal data collected in the context of this contract concerning the application, execution and termination of this business relationship as well as data on non-contractual or fraudulent behaviour to the Credit Bureau Agencies .
• We are authorised to disclose personal data to the Credit Bureau Providers on the basis of (a) your consent; and (b) Paragraph 1(k) of the Fourth Schedule of the PDPA. Furthermore, we are authorised to collect personal data from the Credit Bureau Providers on the basis of (a) your consent; and (b) Paragraph 1(k) of the Second Schedule of the PDPA. Collection from, use of personal data from and disclosure of personal data to the Credit Bureau Providers shall only be carried out to the extent necessary to safeguard our legitimate interests or those of third parties
• For the purpose of performing data analysis of our business, our sales and business processes
• Review and optimisation of requirements analysis procedures for direct customer contact
• Optimisation and needs-based design of the website
• Advertising or market and opinion research, provided that you have not objected to the use of your data
• Asserting legal claims and defence in legal disputes
• Ensuring the IT security and IT operation of our company
• Prevention and investigation of criminal offences
• Video surveillance for the protection of domiciliary rights, and for the collection of evidence in cases of robbery and fraud
• Measures for building and plant safety (e.g. access control)
• Measures to safeguard domiciliary rights
• Measures for business management and further development of services and products
c. On the basis of your consent (Section 13 PDPA)
Insofar as you have given us your consent to process your personal data for specific purposes (e.g., disclosure of data within the Group, or analysis of payment transaction data for marketing purposes), the legality of this processing is assured on the basis of your consent. Consent that has been issued can be revoked at any time. The revocation of consent does not affect the legality of the data processed until the revocation.
d. On the basis of your deemed consent (Section 15 PDPA), requirements or authorisations in other applicable laws (Section 13 PDPA), or the provisions of the PDPA allowing us to process personal data without consent (Section 17 PDPA)
Due to legal requirements set out in the Companies Act, in particular, as well as due to the legitimate interests in the context of the organization and orderly conduct of Annual General Meetings, we also process personal data of shareholders, shareholder representatives and, if applicable, guests at the Annual General Meeting of GC Lease Pte Ltd (in particular name and contact details). The processing of this data is necessary for the participation of shareholders, shareholder representatives and possible guests in the Annual General Meeting or the holding of analyst events. Personal data is stored in accordance with legal obligations and then deleted.
4. Who receives my data?
Within our organisation, the entities that gain access to your data are those who need it in order to fulfil our contractual and legal obligations. Our service providers and vicarious agents may also receive data for these purposes. These are companies in the cat-egories of financial services, IT services, logistics, printing services, telecommunications, debt collection, advising and consulting, as well as sales and marketing.
With respect to the disclosure of data to recipients outside our company, we may only disclose information about you if we are required or authorised to do so by law or if you have given us your consent to do so. Under these conditions, recipients of personal data may be, for example:
• Public authorities and institutions (e.g. the Monetary Authority of Singapore, the tax and legal authorities) in the presence of a legal or regulatory obligation.
• Other credit and financial services institutions or
• comparable institutions to which we transfer personal data over the course of our business relationship with you (depending on the contract, e.g., correspondent banks, credit agencies).
• Other companies within the group
• for risk management due to legal or regulatory obligations.
Other data recipients may be those to whom you have given us your consent for your data to be submitted.
5. Is data transmitted to a third-party country or to an international organisation?
A transfer of data to bodies in countries outside Singapore (so-called third-party coun-tries) takes place, as far as this is permissible under the PDPA, and:
• this is required in order to execute your orders (e.g. payment orders),
• this is required by law (e.g. in order to comply with tax reporting obligations), or
• you have given us your consent.
6. How is my data processed on the website?
Unless otherwise stated, we process your data on our website either to action your request (Section 15 of the PDPA), or for our research purposes to improve our website (Section 13 of the PDPA, Paragraph 1(i) of the Third and 1(q) of the Fourth Schedules to the PDPA).
a. Usage data
Every time you access a page and retrieve a file, this process automatically saves general data to a log file. The storage is exclusively system-related and is purely for statistical purposes or to report criminal offences in exceptional circumstances.
We use this data to improve our websites and to present content tailored to your interests on various sites on the internet and on multiple devices. As part of this process, usage data is not merged with personalised data. Should you decide to provide us with your data, this data will be backed up securely during the entry process. The same applies to the storage in our system. For security reasons, we store your IP address. This can be accessed in case of a legitimate interest.
We do not save your browser history. A transfer of data to third parties or any other evaluation does not take place, unless there is a legal obligation to do so.
In detail, the following data record is saved for each access:
• Device used
• Name of the accessed file
• Date and time of access
• Time zone
• Transferred data volume
• Report as to whether the access was successful
• Description of the type of web browser used
• Operating system used
• The previously visited site
• User's IP address
b. Contact forms
In order to be able to give you the best possible advice as part of a request via our contact forms, the appropriate group company that is best suited to respond to your request will be identified after inquiring about your specific interest at the top of the page. If you contact us (e.g. via contact forms), the designated company will save your data in order to process your request (Section 15 of the PDPA) or in case any further correspondence is required.
If you expressly agree to be contacted by e-mail, telephone or post (Section 13 of the PDPA) within the scope of the contact form, you grant GC Lease Pte Ltd the opportunity to inform you in future by telephone, e-mail or post about current products and services, in the selected category. We may also store your data for the purpose of sending you our newsletter. In addition, we store your IP address and the date of your registration in order to be able to prove your newsletter subscription in case of doubt. You can object to the use of your data for advertising purposes at any time or unsubscribe from the newsletter at any time by clicking on the unsubscribe link in the footer of the newsletter.
If you do not give your consent, your data will be deleted after your request has been processed. Excluded from this is data for which legal or otherwise prescribed storage obligations exist.
Within the framework of our contact forms we work with the Eloqua, a service of the provider ORACLE Nederland B.V., Hertogswetering 163, 3543 AS Utrecht, P.O. Box 40387, 3504 AD Utrecht, The Netherlands. For further information on the use of Eloqua, please refer to the additional notes under g.
The data provided during registration will only be used by us to enable you to use our services (Section 13 of the PDPA, Paragraph 1(a) of the Third Schedule of the PDPA).
We collect the following data for the registration process:
• E-mail address
• User name
We are happy to inform you on the basis of your consent (Section 13 of the PDPA) about the latest news with our newsletter.
In order to receive the newsletter, you must enter your name and e-mail address. You can also enter and submit further optional information. After you have submitted your e-mail address, you will receive an e-mail from us to the e-mail address you have specified, in which you must click a confirmation link to verify the e-mail address you provided.
Your data will be stored by us only for the purposes of sending our newsletter. In addi-tion, we store your IP address and the date of your registration in order to be able to prove the newsletter subscription in case of doubt. In addition, in order to measure the success of our newsletter, we collect data on whether the newsletter is opened, when it is opened and which links are clicked.
For the delivery of our newsletter we work with the Eloqua service of the provider OR-ACLE Nederland B.V., Hertogswetering 163, 3543 AS Utrecht, P.O. Box 40387, 3504 AD Utrecht, The Netherlands. Newsletters sent with the help of Eloqua use tracking technologies. We use this data primarily to find out which topics are of interest to you by tracking whether our emails are opened and which links you click on. We then use this information to improve the e-mails we send you and the services we provide, and to link them to existing tracking or profiling information. You will not be able to track your emails if you have disabled the display of images in your email program by default. In this case, however, the newsletter will not be displayed in full and you may not be able to use all the features. If you display the images manually, the above-mentioned tracking will take place. For further information on using Eloqua, please refer to the additional notes under g.
You can unsubscribe from the newsletter at any time by clicking the unsubscribe link at the bottom of the newsletter.
aa) General information
In order to make your visit to our websites more pleasant and to enable the use of certain functions, we use so-called cookies on various sites. These are small text files that are stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your device and allow us or our affiliates to recognise your browser on your next visit (so-called persistent cookies).
Cookies cannot access other files on your computer or identify your email address.
cc) Legitimacy of the storage of cookies
The essential, functional and statistical cookies are stored for the safe operation, optimisation and needs-based design of our website (Section 13 and 15 of the PDPA).
Cookies are stored for marketing purposes on the basis of the user's consent (Section 13 of the PDPA). These cookies are therefore only set if the user agrees to the storage by issuing their consent to the cookie notification on the website.
dd) Deactivating and deleting cookies
The setting you choose on the first visit in response to the cookie notification will be saved. The selected settings can be adjusted here in the privacy settings at any time.
Technical cookie for the load balancer
Functional cookies allow a website to store information that has already been entered (such as preferred language), and to provide the user with enhanced, more personalised features. Functional cookies are used for instance to enable requested functions such as playing videos. These cookies collect anonymised information; they cannot track your movements on other websites.
These cookies collect information that is either used to track the interests of our customers respectively our website users and to help improve the experience on their websites or to help us understand how our products and services are used.
Statistical cookies collect information about the use of a website – such as the user’s most frequently visited pages and whether the user receives error messages when using a website. These cookies do not store information that allows the user to be identified. The information gathered is pooled and therefore evaluated anonymously. These cookies are used exclusively to improve a website's performance and thus the user experience.
Used to send data about the device and the visitor's behaviour to PIWIK.
30 minutes – 1 year
Session and permanent cookie
To detect if a visitor has deliberately deactivated tracking.
Cookies for marketing purposes
Cookies for marketing purposes are used to play targeted advertisements relevant to the user and adapted to their interests. They are also used to limit the frequency of an ad and to measure the effectiveness of advertising campaigns. They register whether you have visited a website or not. This information may be shared with third parties, such as advertisers. Cookies to improve targeting and advertising are often linked to third-party site functionalities.
These cookies enable behavioural advertising and analysis of Facebook.
These cookies enable behavioural advertising and analysis of Instagram.
These cookies enable behavioural advertising and analysis on the Google AdWords platform.
30 days–2 years
These cookies enable behavioural advertising and analysis of LinkedIn
These cookies enable behavioural advertising and analysis of Twitter.
These cookies collect information that is either used to track the interests of our customers' users and to help improve the experience on their websites or to help us understand how our products and services are used.
These cookies enable behavioural advertising and analysis within the context of email marketing and measuring the effectiveness of email advertising. Tracking is done anonymously until a user identifies him or herself by submitting a form.
f. Range analysis using Piwik
If you consent ((Section 13 of the PDPA), we use Piwik, a software for statistical evaluation of user access.
You can revoke your consent to this data processing as follows:
g. Use of Eloqua
We use the Eloqua service to collect statistical data about the use of our website, to send our newsletters and to optimize our services accordingly. The Eloqua servers of the supplier ORACLE Nederland B.V., Hertogswetering 163, 3543 AS Utrecht, P.O. Box 40387, 3504 AD Utrecht, Netherlands are located in the EU.
If you enter personal data (e.g. in the contact form) during your visit to the website, these data will be processed with the usage behavior in order to offer you content on the website and in our newsletter that is geared to your interests, as well as to be able to send you news and information about our company or our range of services based on your data, which are geared to your individual interests. For this purpose, it is technically necessary that we combine your accrued and given data in user profiles and evaluate them for the aforementioned purposes. This is done internally and only for the aforementioned purposes.
The legal basis for the pseudonymous evaluation of the use of our website is your consent (Section 13 of the PDPA), which you may have given us in the course of using our website.
The information generated by the cookie about your use of this website is transferred to a server and stored there. On our behalf, Eloqua uses this information to evaluate your use of the website and to compile reports on website activity. If you wish to prevent the use of Eloqua cookies or the evaluation of usage behavior on your device in the future, this is possible via the following link: Eloqua Opt-Out .
h) Integration of social media plug-ins
We are currently using the following social media plug-ins: Facebook, Instagram, Twitter, LinkedIn.
When you visit a page that contains such a plug-in, the browser will connect to the social media providers' servers and provide the information that you have accessed the corresponding subpage of our website. In addition, the data referred to in paragraph 6a of this declaration will be transmitted, whereby in the case of Facebook, according to the respective providers in Germany, only an anonymous IP is recorded. This happens regardless of whether you have an account with this plug-in provider and are logged in there. If you are logged in to the plug-in provider, this data will be assigned directly to your account. If you click the button, the plug-in provider also stores this information in your user account and informs your contacts publicly. If you do not want your profile to be linked with the plug-in provider, you must log out before clicking the button.
The plug-in provider stores this data as usage profiles and uses it for the purposes of advertising, market research and/or tailored website design. Such an evaluation is carried out in particular (also for non-logged-in users) to present needs-based advertising and to inform other users of the social network about your activities on our website. You have a right to object to the formation of these user profiles; you must contact the respective plug-in provider to exercise them.
For more information on the purpose and scope of the data collection and its processing by the plug-in provider, please refer to the privacy statements of these providers, which can be found below. You will also find further information about your rights and settings options to protect your privacy here.
Addresses of the respective providers and URLs with their privacy policies:
• Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, more information on data recording: https://www.facebook.com/about/privacy, https://www.facebook.com/help/186325668085084. Facebook has submitted itself to the EU-US Privacy Shield (see https://www.privacyshield.gov/EU-US-Framework).
• Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA, more information on data recording: https://www.instagram.com/about/legal/privacy, https://www.facebook.com/help/186325668085084. Instagram has submitted itself to the EU-US Privacy Shield (see https://www.privacyshield.gov/EU-US-Framework).
• Twitter Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/en/privacy. Twitter has submitted itself to the EU-US Privacy Shield (see https://www.privacyshield.gov/EU-US-Framework).
• LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; http://www.linkedin.com/legal/privacy-policy. LinkedIn has submitted itself to the EU-US Privacy Shield (see https://www.privacyshield.gov/EU-US-Framework).
i) Integration of Google Maps
7. How long will my data be stored?
Unless explicitly stated in this privacy statement, the usage and registration data stored with us is deleted as soon as it is no longer required for its intended use and the deletion does not conflict with any statutory retention obligations.
We process and store other personal data as long as it is necessary for the fulfilment of our contractual and legal obligations. It should be noted that our business relationship is a continuing obligation, which is designed to last for years. If the data is no longer required for the fulfilment of contractual or legal obligations, it is regularly deleted, unless its - temporary - further processing is necessary for the following purposes:
• Fulfilment of commercial and tax-related retention obligations: including the Companies Act, Goods and Services Tax Act, Income Tax Act, Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act, Terrorism (Suppression of Financing) Act and the Hire Purchase Act must be mentioned here. The deadlines for retention and documentation are up to six years.
• Preservation of evidence in the context of the statutory limitation periods. According to the Limitation Act, these limitation periods can be up to 30 years, where the regular limitation period is 6 years.
8. Which data protection rights do I have?
Every affected person has with respect to us
• the right of access under Section 21 of the PDPA,
• the right to correction under Section 22 of the PDPA,
In addition, there is a right to make an application to the Personal Data Protection Committee to conduct a review (Section 28 PDPA).
You may revoke your consent to the processing of personal data at any time. Please note that the revocation is only applicable for the future. Processing that took place before the revocation is not affected.
9. Am I obligated to provide data?
As part of our business relationship, you must provide the personal data required in order to enter into a business relationship and perform its associated contractual obligations, or the personal data that we are required to collect by law. Without this information, we will generally not be able to conclude or execute the contract with you.
In particular, to comply with the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act, Terrorism (Suppression of Financing) Act (“Anti Money Laundering Laws”), we are obligated to identify you prior to entering into a business relationship with you on the basis of your identification document and to record and save your name, place of birth, date of birth, nationality, address and identification data. In order for us to be able to fulfil this legal obligation, you must provide us with the necessary information and documents in accordance with the Anti-Money Laundering Act and immediately notify us of any changes during the course of the business relationship. If you do not provide us with the necessary information and documents, we may not enter into or continue your desired business relationship.
10. Does profiling take place?
We sometimes process your data automatically with the aim of evaluating certain personal aspects (profiling). For example, we use profiling in the following cases:
• Due to legal and regulatory requirements, we are committed to combating money laundering, the financing of terrorism, and property-related offences. At the same time, data evaluations are also carried out (inter alia in payment transactions). These measures are also in place for your protection.
• In order to provide you with targeted information and advice on products, we use evaluation tools. These enable needs-based communication and advertising, including market and opinion research.
• We use the scoring to assess your creditworthiness. This calculates the probability with which a customer will meet their payment obligations in accordance with the contract. The calculation may include, for example, income, expenses, existing liabilities, occupation, employer, duration of employment, past business experience, past repayment of the loan, and information from credit reporting agencies. The scoring is based on a mathematically-statistically recognised and proven procedure. The calculated scores help us make decisions within the context of product sales and are part of ongoing risk management.
1. Case-specific right to object
You have the right at any time upon giving reasonable notice to us, for reasons arising from your particular situation, to revoke your consent for the collection, use or disclosure (i.e. processing) of personal data relating to you, which takes place on the basis of Section 13 of the PDPA (data processing on the basis of your consent) and Section 15 of the PDPA (data processing on the basis of your deemed consent).
If you object, we will no longer process your personal data unless such processing without your consent is required or authorised under the PDPA or other written law.
Please note that in some cases, we rely on your consent to process personal data for crucial aspects of the products and services which we provide to you. In the event that you inform us that you wish to withdraw your consent allowing us to process such data, we will notify you that we may be required to cease providing the relevant products and services and seek your confirmation that you wish to proceed to withdraw your consent. If you proceed to withdraw your consent, the relevant agreement between us for the products or the services shall be deemed to be terminated due to your request. Please be assured that we will not as a condition of providing our products or services require you to consent to the processing of personal data beyond what is reasonable to provide the product or service.
2. Right to revoke your consent to the processing of data for direct advertising purposes
In individual cases, we process your personal data in order to perform direct advertising. You have the right to object at any time to the processing of personal data concerning you for such advertising, which includes profiling to the extent that it is related to such direct advertising.
If you object to the processing for direct advertising purposes, your personal data will no longer be processed for such purposes.
You can revoke your consent to this by sending a correspondingly worded letter to:
GC LEASE PTE LTD
Data protection officer
80 Anson Road
#11-06 Fuji Xerox Towers