Last updated: 25 October 2026
weCDEF ("we", "us") is responsible for the personal data described here under Singapore's Personal Data Protection Act 2012 (PDPA).
Data Protection Officer: contact@wecdef.com
1. What we collect, and why
Audit requests and waitlist sign-ups. When you request a free audit or join our waitlist, we collect your name, email, firm name, trade (and a description if you choose "Other"), your website or Google Maps link and the areas you serve (optional for the waitlist), your phone number and up to three competitor websites (if you give them), any notes you add, the date and time, the page you used, and which consent wording you agreed to. Please don't put personal or sensitive details about other people in the notes. We don't collect your IP address or browser details through the form. We use these details to:
- prepare your audit, email you the report and answer your questions about it, or, for the waitlist, email you when a place opens;
- keep a record of your request and of the consents you gave.
Your report also describes our optional pilot and paid services.
Calls and WhatsApp. We call or WhatsApp you about your report only if you tick the box that allows it. We don't send marketing calls, texts or WhatsApp messages unless you've separately agreed to them.
Marketing emails. We don't send any.
Clients and pilots. For firms that sign a pilot or service agreement, we keep contact, billing and agreement records.
Information we gather about firms. To prepare audits and to contact firms that might want one, we look at public business information: websites, Google Business Profiles, directories, public registers, reviews and answers from AI tools. This may include a business owner's name or business contact details as published there. We use it only for the audit and for business-to-business contact about our services.
Customer data we handle for clients. When a client asks us to help with, for example, review requests, we handle its customers' details only on the client's instructions, as its data intermediary. The client's own privacy policy applies to that data. Questions about it should go to the client.
Website use. Our host processes IP addresses and browser details to deliver and protect the site. We don't use analytics cookies.
We don't sell your personal data, and we don't share it with anyone for their own marketing.
2. Who handles it for us, and transfers outside Singapore
We use these providers:
- Cloudflare: hosts this website, and receives and stores the audit request form.
- Zoho: our mailbox and outgoing email.
They process data for us, not for their own marketing. Some store data outside Singapore. We use providers bound by contractual data-protection terms, and we take steps to make sure recipients outside Singapore protect it to a standard comparable to the PDPA.
3. How long we keep it
- Audit requests, waitlist sign-ups and the consent records that come with them: deleted automatically 90 days after you submit the form. After that we don't contact you again about that request unless you ask us to. If you sign a pilot or service agreement, the details you need for it move to our client records (below).
- Audit reports we've sent: 90 days after sending, unless you become a client.
- Public business information gathered for prospecting: 12 months after our last contact, or sooner if you ask us to stop.
- Client records: the agreement period plus 5 years, for accounting and tax.
- Client customer data (as data intermediary): deleted within 30 days after the purpose ends or the agreement ends, as our service terms set out.
After that, we delete or anonymise the data.
4. Your choices and rights
- Withdraw consent at any time: email contact@wecdef.com. We'll stop as soon as reasonably possible. If you withdraw consent for your audit before we send it, we won't be able to prepare or send it. Withdrawing doesn't affect what we've already done lawfully.
- Access and correction: you can ask what personal data we hold about you and how it has been used in the past year, or ask us to correct it. We normally reply within 30 days, and we'll tell you if we need longer. We may charge a reasonable fee for an access request, and we'll tell you the amount first.
- Stop business contact: if we've contacted your firm and you don't want to hear from us again, reply "stop" and we won't contact you again.
5. How we protect it
We collect only what we need. Access is limited to the people doing the work. Every account uses a strong, unique password with two-factor authentication. We don't keep copies on unmanaged personal devices, and we don't put your personal data into AI tools except ones set so that inputs aren't used to train their models.
If we suspect a data breach, we assess it within 30 days. If it's notifiable (likely to cause significant harm, or affecting 500 or more people), we notify the Personal Data Protection Commission within 3 calendar days of that assessment, and the people affected where required.
6. Calls and messages
Before any marketing call, SMS or WhatsApp to a Singapore number, we check the Do Not Call Registry, unless you've given us clear consent to that kind of message. We never use auto-generated numbers or software that harvests numbers.
7. Changes and contact
We may update this policy. The date at the top shows when it last changed. For any question about this policy or your data, email our Data Protection Officer at contact@wecdef.com.