How we handle your data.

This Privacy Policy explains how SPAX Engineering Pte Ltd ("SPAX", "we", "us", "our") collects, uses, discloses, and retains personal data when you visit spax.sg or contact us through this website. It is drafted to be consistent with Singapore's Personal Data Protection Act 2012 ("PDPA").

1. Data Protection Officer

Our designated Data Protection Officer (PDPA s.11(3)) can be reached at spax.solar@gmail.com. Use this address for any question about your data, withdrawal of consent, access requests, or correction requests.

2. What we collect

We only collect personal data that you actively provide:

• Information submitted through our contact drawer — name, company, email, phone, and the project enquiry message you send us.
• Information you provide by email or phone in the course of a project discussion.

Our website host (Cloudflare Pages) records server-side technical data automatically — IP address, user-agent string, page-view path, request timestamp. These logs are pseudonymous and retained per Cloudflare's defaults.

We do not run third-party analytics on this site and we do not deploy tracking cookies. Session cookies, if any, are first-party and used only to maintain page state (for example, contact-drawer open/closed).

3. Why we collect it

We use the data you provide to:

• Respond to your project enquiry and prepare a quotation or proposal.
• Communicate with you about an ongoing project.
• Comply with Singapore tax, accounting, and contract record-keeping requirements.
• Improve the site — for example, identifying broken links or slow pages.

4. Who we share it with

We do not sell or share personal data with third parties for marketing.

We may disclose personal data to:

• Cloudflare, Inc. — our website host and edge-cache provider, which processes server logs as a data processor on our behalf.
• Tax authorities, regulators, or courts where compelled by Singapore law.
• EPC clients we are subcontracted under, only to the extent necessary to discharge the contracted scope of work (e.g., site-induction lists, safety reporting).

5. How long we retain it

We retain personal data only as long as needed for the purpose collected, or as required by law:

• Enquiry correspondence — three (3) years from last contact, in line with Singapore commercial practice.
• Contract and accounting records — seven (7) years from contract close, per Singapore tax law.
• Server logs — thirty (30) days, per Cloudflare defaults.

6. Your rights under PDPA

You have the right, on written request to the DPO, to:

• Withdraw your consent to our continued use of your personal data.
• Access the personal data we hold about you.
• Correct any inaccurate personal data we hold.
• Request deletion, subject to legal retention requirements.

We will respond to access and correction requests within fourteen (14) calendar days of receipt.

7. Cookies

We use only first-party session cookies necessary for the site to function. We do not deploy third-party analytics, advertising, or social-media tracking cookies. Because there are no cross-site trackers, this site does not display a cookie consent banner.

8. Updates to this policy

We may revise this policy from time to time. The effective date at the top of this page reflects the most recent revision. Material changes will be communicated through the contact drawer or the home-page footer when reasonably possible.

9. Contact for privacy questions

For any question about this policy, your data, or to exercise the rights described in section 6, contact the DPO at spax.solar@gmail.com.