Data protection policy

Prepared in accordance with the Personal Data Protection Act 2012 of Singapore and other applicable Singapore laws and regulations.

1. Introduction and purpose

Meridium Management Consultants Pte. Ltd. (referred to in this policy as Meridium, the Company, we, us or our) provides corporate, advisory and management consulting services to international principals establishing or scaling their operations in Asia. In the course of delivering these services we collect, use, disclose and otherwise handle personal data belonging to our clients, the individuals connected to our clients, our employees, our business partners, our suppliers and members of the public.

Meridium is committed to protecting personal data and to handling it responsibly, lawfully and transparently. This policy sets out how the Company complies with its obligations under the Personal Data Protection Act 2012 (the PDPA) and the subsidiary legislation, advisory guidelines and codes of practice issued by the Personal Data Protection Commission (the PDPC), and how it meets the data protection requirements of the other laws that apply to its business.

The purposes of this policy are to:

• set out the principles and obligations that govern how Meridium handles personal data;
• establish a consistent framework for collection, use, disclosure, protection, retention and disposal of personal data;
• define the roles and responsibilities of the Data Protection Officer, management and all personnel; and
• explain how individuals may exercise their rights and how queries or complaints are handled.

This policy is a binding internal policy. Every director, officer, employee, contractor and temporary or agency staff member of Meridium must read, understand and comply with it. Breach of this policy may result in disciplinary action and, in serious cases, termination of employment or engagement, in addition to any liability that may arise under law.

2. Scope and application

This policy applies to all personal data processed by Meridium, in any form, whether held electronically or in physical records, and regardless of where the data is stored. It applies to all personal data for which Meridium is responsible as an organisation under the PDPA, and to personal data that Meridium processes on behalf of another organisation as a data intermediary.

This policy applies to all personnel of Meridium and to third parties who process personal data on the Company’s behalf. Where Meridium engages a vendor or service provider to process personal data, that arrangement must be governed by a written contract that imposes data protection obligations consistent with this policy and the PDPA.

Where Meridium provides services to clients who are themselves subject to data protection laws outside Singapore, such as the European Union General Data Protection Regulation or the United Kingdom General Data Protection Regulation, the Company will take reasonable steps to support its clients in meeting their obligations and will comply with any additional contractual data protection requirements agreed with those clients.

3. Definitions

The following terms have the meanings set out below. Terms not defined here carry the meaning given to them in the PDPA.

Term	Meaning
Personal data	Data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which the organisation has or is likely to have access.
Individual	A natural person, whether living or deceased. The PDPA continues to apply for a limited period to data about a deceased individual.
Processing	Any operation performed on personal data, including collection, recording, holding, organisation, use, disclosure, transfer and disposal.
Collection, use, disclosure	The gathering, application and sharing of personal data, each of which is separately regulated under the PDPA.
Data intermediary	An organisation that processes personal data on behalf of and for the purposes of another organisation, under a written contract.
Consent	Agreement by an individual, given freely and on the basis of reasonable notification of purposes, to the collection, use or disclosure of personal data, including deemed consent recognised under the PDPA.
DPO	The Data Protection Officer appointed by Meridium to oversee compliance with the PDPA and this policy.
CDD	Customer due diligence measures conducted to meet anti-money laundering, countering the financing of terrorism and counter proliferation financing obligations.
Data breach	The unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data, or the loss of any storage medium or device on which personal data is stored, in circumstances where unauthorised access is likely.

4. Our data protection obligations

Meridium structures its handling of personal data around the obligations set out in the PDPA. The Company applies each of the following obligations to its operations.

4.1 Consent obligation

Meridium collects, uses and discloses personal data only with the consent of the individual, unless an exception under the PDPA applies. Consent may be express or, where the conditions are met, deemed. The Company does not obtain consent through false or misleading information or deceptive practices, and does not require an individual to consent to collection, use or disclosure beyond what is reasonable to provide the relevant product or service. An individual may withdraw consent at any time on reasonable notice, and Meridium will inform the individual of the likely consequences of withdrawal and cease the relevant processing unless required or permitted to continue by law.

4.2 Purpose limitation obligation

Meridium collects, uses and discloses personal data only for purposes that a reasonable person would consider appropriate in the circumstances and that have been notified to the individual. Personal data is not used for new purposes without fresh consent or a valid exception.

4.3 Notification obligation

Meridium informs individuals of the purposes for which their personal data will be collected, used or disclosed, on or before collection, unless an exception applies. Notification is provided through this policy, engagement documents, data protection notices, consent forms and the Company website.

4.4 Access and correction obligation

On request, and subject to the exceptions in the PDPA, Meridium will provide an individual with access to their personal data in the Company’s possession or control, and information about the ways in which that data has been or may have been used or disclosed within a year before the request. The Company will correct an error or omission in personal data on request, unless it is satisfied on reasonable grounds that a correction should not be made. Where appropriate, corrected data will be sent to other organisations to which the data was disclosed within a year before the correction.

4.5 Accuracy obligation

Meridium makes reasonable efforts to ensure that personal data it collects is accurate and complete, particularly where the data is likely to be used to make a decision affecting the individual or is likely to be disclosed to another organisation.

4.6 Protection obligation

Meridium protects personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, and the loss of any storage medium or device on which personal data is stored. The security measures applied by the Company are described in section 13.

4.7 Retention limitation obligation

Meridium ceases to retain personal data, or removes the means by which the data can be associated with particular individuals, as soon as it is reasonable to assume that retention no longer serves the purpose for which the data was collected, and is no longer necessary for legal or business purposes. Retention is governed by section 12.

4.8 Transfer limitation obligation

Meridium transfers personal data outside Singapore only where it has taken appropriate steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA. Cross-border transfers are addressed in section 11.

4.9 Data breach notification obligation

Meridium assesses data breaches affecting personal data in its possession or control and, where a breach is notifiable, notifies the PDPC and affected individuals within the timelines required by the PDPA. The Company’s breach management procedure is set out in section 14.

4.10 Accountability obligation

Meridium is accountable for the personal data in its possession or control. The Company has appointed a Data Protection Officer, has developed and implemented this policy and supporting practices, makes information about its policies and practices available on request, and trains its personnel. The Company keeps written records sufficient to demonstrate its compliance.

5. Personal data we handle and why

The categories of personal data that Meridium handles, and the principal purposes for handling them, include the following. This is not an exhaustive list, and the specific data handled in any engagement depends on the services provided.

Category of individual	Typical personal data	Principal purposes
Clients and prospective clients	Name, contact details, role, business correspondence	Responding to enquiries, providing proposals, delivering services, billing, relationship management
Directors, shareholders, beneficial owners and officers of client entities	Name, nationality, identification document details, residential and contact details, source of wealth or funds information	Incorporation and corporate secretarial services, statutory filings, customer due diligence and AML compliance
Employees and job applicants	Identification, contact, employment, remuneration, tax, bank account and next of kin details	Recruitment, payroll, statutory contributions, work pass administration, performance and HR management
Suppliers, partners and referrers	Name, contact details, banking details where relevant	Procurement, payment, partnership and referral administration
Website visitors, newsletter subscribers and event attendees	Contact details, communications, technical and usage data	Responding to enquiries, sending the newsletter where consent is given, event administration and website operation (see section 6)

6. Website, forms and online tools

This section explains what happens to personal data when you use meridium.sg and the pages and tools linked from it. It applies together with the rest of this policy.

6.1 Enquiry form and newsletter sign-up

When you submit the enquiry form, send your plan from the setup planner (section 6.2), ask for your filing dates by email (section 6.2) or subscribe to the Meridium newsletter, the details you enter (name, email address, and where provided company name, country, the service you are interested in and your message) are sent from your browser directly to HubSpot, the customer relationship management platform Meridium uses, and stored as a contact record there. Each submission also records the address and title of the page it was sent from; the address is sent without any campaign labels or click identifiers that were in the link. Meridium uses this data to respond to your enquiry, to prepare proposals and, where you have subscribed, to send you the newsletter you chose (English or German).

Meridium keeps data from enquiries, setup planner reviews, requests for filing dates and downloads for 24 months after the last contact, unless an engagement follows, in which case section 12 applies. Newsletter data is kept until you unsubscribe.

The newsletter is sent monthly from newsletter@meridium.sg and covers business, regulatory, tax and compliance developments in Singapore and the region. Subscribing triggers an automated welcome email. HubSpot records whether each newsletter is opened and which links in it are clicked, so that Meridium can see which topics are of interest; you agree to this when you subscribe. Every newsletter contains an unsubscribe link, and you may also withdraw consent at any time by writing to dpo@meridium.sg. Enquiry contacts are not added to the newsletter unless they subscribe separately.

Together with the details you enter, the enquiry form and the setup planner’s review form send how you reached the site: the campaign labels in the link that brought you here, if there were any (such as “utm” tags naming the source and campaign), the name of the website that linked to us, the first page you viewed and, only if you have accepted advertising cookies (section 6.6), the Google Ads click identifier. Meridium uses this to understand which channels lead to enquiries. These details are kept in your browser only for the current session (section 6.5) and are sent only if you submit one of these forms.

HubSpot processes this data on Meridium’s behalf as a data intermediary, under a written data processing agreement, on servers located outside Singapore. Meridium relies on HubSpot’s contractual commitments to provide a standard of protection comparable to the PDPA, as described in section 11.

6.2 Online calculators and tools

The income tax calculator and the Employment Pass salary calculator on the resources page, the employer cost calculator, the corporate tax estimator and the withholding tax checker run entirely in your browser. The figures you enter, such as income, age, salary, profit or the amount of a payment, are used only on your device to produce the result and are not transmitted to, or stored by, Meridium or any third party. If you have accepted analytics cookies (section 6.6), the Google tag records that a result from the employer cost calculator, the corporate tax estimator or the withholding tax checker was printed, without the figures or the result.

The setup planner also runs in your browser. Your answers are used on your device to produce your plan and are kept in your browser’s session storage, so that the plan is still there if you leave the page and return; they are deleted when you close the browser tab or choose “Start again”. They are not transmitted to Meridium unless you send the review form at the end of the plan. If you do, your answers, a summary of the plan, the structure the planner recommends, a priority score from 0 to 10 that the planner calculates from your answers (for example whether you need a resident director or an Employment Pass, and how soon you want to start) to help Meridium plan its reply, and the details you enter (name, email address, company, country and any note) are sent from your browser directly to HubSpot and handled as an enquiry, as described in section 6.1. The score is not used to make any decision about you. If you have accepted analytics cookies (section 6.6), the Google tag records that the planner was started, completed or sent, without your answers or your result.

The filing deadline calculator also runs in your browser. The financial year end and options you choose are used only on your device to list your deadlines and to create the calendar file you can download; they are not stored or transmitted. If you ask for the dates by email, your name, email address, company (if given) and the dates listed for your company are sent from your browser directly to HubSpot, stored with your contact record as described in section 6.1 and used to email you the dates. You do not receive the newsletter unless you subscribe separately. If you have accepted analytics cookies (section 6.6), the Google tag records that the calendar file was downloaded, the dates were printed or the email was requested, without the dates themselves.

6.3 Guides, the compliance calendar and other downloads

Downloadable resources are hosted for Meridium by HubSpot on the subdomain resources.meridium.sg. To download one, you enter your name and email address and, if you wish, your company. These details are stored in HubSpot as described in section 6.1 and used to provide the download and to understand which resources are of interest. You receive the Meridium newsletter only if you tick the newsletter box on the form, and you can unsubscribe at any time.

Pages on resources.meridium.sg are served by HubSpot. With your consent, given through the cookie banner on those pages, HubSpot sets cookies to measure page visits and to recognise returning visitors. Cookies needed to display the page and run the form are set in any case. You can change your choice at any time through the cookie settings link at the foot of those pages.

6.4 Booking a call

The “Book a call” buttons on this website link to Calendly, a third party scheduling service. Details you enter there (name, email address and any notes) are collected by Calendly under its own privacy policy and shared with Meridium to arrange and hold the call. After you book, Calendly returns you to a confirmation page on meridium.sg; your booking details are not passed to that page.

6.5 Hosting, server logs and cookies

meridium.sg is a static website hosted on GitHub Pages and delivered through Cloudflare, which provides the secure connection, caching and protection against attacks. In common with any web host, GitHub and Cloudflare record standard server logs, which may include your IP address, browser type and the pages requested, for security and operational purposes. Meridium does not receive these logs in identifiable form. Cloudflare does not use cookies on meridium.sg for analytics or advertising. If it detects unusual traffic, it may show a short security check and set a strictly necessary security cookie so that the check is not repeated.

No HubSpot tracking script is loaded on meridium.sg. The site stores a small number of values in your browser: one remembers that the newsletter invitation has been shown or that you have subscribed, so that it is not shown again; another remembers your cookie choice (described in section 6.6); the setup planner keeps your answers for the current browser session (described in section 6.2); and, for the current browser session only, the site counts the pages you have viewed, so that the newsletter invitation waits until your second page, and keeps the campaign details of the link that brought you to the site (described in section 6.1). Apart from those campaign details, which are sent only with a form you submit, none of these values is sent to Meridium, and all of them can be cleared through your browser settings.

6.6 Analytics and advertising cookies (Google)

Meridium uses the Google tag (Google Analytics and Google Ads, provided by Google) to understand how visitors find and use meridium.sg and to measure the results of its online advertising. The Google tag is loaded only if you accept it in the cookie banner that appears on your first visit:

• If you accept, the Google tag is loaded and Google Analytics and Google Ads cookies are set in your browser. They record information such as the pages you visit, how you arrived at the site (including whether you clicked a Meridium advertisement), your approximate location derived from your IP address, and your device and browser type. Meridium uses this information in aggregated form to improve the website and to measure its advertising. Meridium does not use it to show you personalised advertising (remarketing).
• If you decline or make no choice, the Google tag is not loaded: no Google script runs, no information is sent to Google and no Google cookies are set.

To measure which pages and advertisements lead to enquiries and calls, once you have accepted, the Google tag also records when an enquiry, a plan from the setup planner, a request for filing dates or a newsletter sign-up is sent, when the filing deadline calendar is downloaded or printed, when a result from the employer cost calculator, the corporate tax estimator or the withholding tax checker is printed, when a “Book a call” link is clicked and when you reach the confirmation page after booking a call (section 6.4), in the same way as other page activity described above. These records never include anything you type into a form.

Your choice is remembered for twelve months. You can change or withdraw it at any time through the “Cookie settings” link at the foot of every page; withdrawing consent stops the Google tag and removes the Google cookies set on meridium.sg.

Google processes this data as described in Google’s privacy policy and business data processing terms, on servers that may be located outside Singapore, including in the United States. Meridium relies on Google’s contractual commitments to provide a standard of protection comparable to the PDPA, as described in section 11. Where the General Data Protection Regulation applies to your visit, Meridium relies on your consent for the Google tag and its cookies.

6.7 Email and correspondence

Email correspondence with Meridium is held in Google Workspace, which processes data on Meridium’s behalf on servers that may be located outside Singapore, under Google’s data processing terms.

If you call Meridium or send a message through WhatsApp, Meridium uses the details you provide to respond to you. WhatsApp messages are carried by WhatsApp (part of Meta) under its own terms and privacy policy. Please do not send identity documents or financial details by WhatsApp; Meridium will ask for anything of that kind through a secure channel once an engagement begins.

6.8 Visitors in the European Union and the United Kingdom

Where the EU or UK General Data Protection Regulation (GDPR) applies to your use of this website, the controller is Meridium Management Consultants Pte. Ltd., 143 Cecil Street, #09-01 GB Building, Singapore 069542, enquiries@meridium.sg; its Data Protection Officer can be reached at dpo@meridium.sg. The following applies in addition to the rest of this policy.

Legal bases. Enquiries, plans sent from the setup planner, requests for filing dates and download requests: to respond to your request and to take steps before a possible engagement (Article 6(1)(b) GDPR), and Meridium’s legitimate interest in answering business enquiries (Article 6(1)(f)). The newsletter: your consent (Article 6(1)(a)). The Google tag and its cookies on meridium.sg, and HubSpot cookies on resources.meridium.sg: your consent (Article 6(1)(a)). Server logs and website security: Meridium’s legitimate interest in running a secure website (Article 6(1)(f)).

Your rights. You may ask for access to your personal data, its correction or erasure, restriction of its processing and a copy in a portable format. You may object to processing based on legitimate interests and, at any time, to direct marketing. You may withdraw consent at any time with effect for the future. Write to Meridium’s Data Protection Officer at dpo@meridium.sg. You may also complain to a data protection supervisory authority, in particular in the country where you live or work.

Retention. Newsletter data is kept until you unsubscribe. Data from enquiries and downloads is kept for 24 months after the last contact unless an engagement follows, in which case section 12 applies.

Transfers. Meridium is based in Singapore. HubSpot and Google may process data in the United States and other countries. Where they process data on Meridium’s behalf, they do so under their data processing terms, which include the European Commission’s standard contractual clauses or comparable safeguards.

7. Lawful bases and exceptions to consent

In addition to obtaining consent, Meridium relies, where appropriate, on the exceptions recognised by the PDPA. These include the following, applied only where the relevant statutory conditions are satisfied:

• deemed consent, including deemed consent by contractual necessity and deemed consent by notification, where the conditions in the PDPA are met;
• legitimate interests, where the benefit to Meridium or another party outweighs any adverse effect on the individual and an assessment has been documented;
• business improvement, for purposes such as improving services, operational efficiency and developing new offerings;
• legal or regulatory requirement, where collection, use or disclosure is required or authorised under other written law, including the obligations described in sections 8 and 9; and
• other PDPA exceptions, such as where collection, use or disclosure is necessary for an investigation or proceedings, or in the interest of the individual where consent cannot be obtained in a timely way.

Where Meridium relies on the legitimate interests or business improvement exceptions, the relevant assessment is documented and retained by the DPO.

8. National identifiers and sensitive personal data

Meridium handles national identification numbers, such as the NRIC or FIN, and copies of identification documents only where the collection, use or disclosure is required under law, or is necessary to accurately establish or verify an individual’s identity to a high degree of fidelity. This approach is consistent with the PDPC’s guidance on the handling of national identifiers. Where identity verification can be achieved by other means, Meridium uses those means instead. The Company does not use national identification numbers as a default reference, login or account identifier.

Meridium recognises that certain personal data, such as identification documents, financial information, and information about source of wealth and funds, carries a higher risk of harm if compromised. Such data is subject to enhanced protection, access restriction and oversight.

9. Customer due diligence and AML, CFT and counter proliferation financing

Where Meridium provides corporate services within the meaning of the Corporate Service Providers Act 2024, which took effect on 9 June 2025, it is required to register with the Accounting and Corporate Regulatory Authority and to comply with obligations relating to anti-money laundering, countering the financing of terrorism and counter proliferation financing. To meet these obligations, Meridium collects, uses, discloses and retains personal data through customer due diligence measures, including identification and verification of clients, beneficial owners and controllers, screening, and ongoing monitoring.

Personal data collected for customer due diligence is handled as follows:

• it is collected and processed to meet legal and regulatory obligations, and the relevant PDPA exceptions are relied upon where consent is not the basis of processing;
• it is accessible only to personnel who require it to perform compliance and client onboarding functions;
• it may be disclosed to ACRA, the Suspicious Transaction Reporting Office, other competent authorities and screening service providers where required or permitted by law; and
• it is retained for at least five years after Meridium stops providing corporate services to the customer, in line with the record keeping requirement under the Corporate Service Providers Act 2024 and its regulations, and for longer where another law requires.

Where a disclosure to a competent authority is required by law, Meridium makes that disclosure in accordance with the relevant statutory regime, including any confidentiality and tipping off restrictions that apply.

10. Data intermediaries and third party processors

Meridium engages third party service providers, such as IT, cloud, payroll, screening and professional service providers, that process personal data on its behalf. The Company carries out reasonable due diligence on such providers and enters into written contracts that require the provider to protect personal data to a standard at least equivalent to that required by the PDPA, to process the data only on Meridium’s instructions and for the agreed purposes, to assist with access and correction requests and breach response, and to return or securely dispose of the data on termination.

Where Meridium acts as a data intermediary for a client, the Company processes personal data only in accordance with its contract with that client, and complies with the Protection and Retention Limitation Obligations and the data breach notification requirements that apply to data intermediaries under the PDPA, including notifying the client without undue delay where it has credible grounds to believe a breach has occurred.

11. Cross border transfers of personal data

Meridium operates across Asia and works with international principals, and may transfer personal data outside Singapore for the purposes described in this policy. Before transferring personal data outside Singapore, Meridium takes appropriate steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA. These steps may include contractual clauses, intra group data protection arrangements, binding corporate rules, or reliance on a recognised certification, as appropriate. Where a transfer relies on consent, the individual is informed of the transfer before it takes place.

12. Data retention and disposal

Meridium retains personal data only for as long as it is needed for the purposes for which it was collected, or to meet legal, regulatory, accounting or contractual requirements. Retention periods are set having regard to the requirements of the applicable laws, including the following examples:

Record type	Indicative minimum retention
Customer due diligence and AML records	At least 5 years after the end of the corporate services relationship
Accounting and tax records	At least 5 years, in line with the Income Tax Act and Goods and Services Tax Act
Corporate and statutory records	As required under the Companies Act 1967
Employee records	Duration of employment plus the periods required under the Employment Act and related law
General client engagement records	Duration of the engagement plus the applicable limitation period

When personal data is no longer required and no retention obligation applies, Meridium disposes of it securely, or anonymises it so that individuals can no longer be identified. Physical records are shredded or otherwise securely destroyed, and electronic data is securely erased.

13. Security of personal data

Meridium applies reasonable administrative, technical and physical measures to protect personal data, proportionate to the sensitivity of the data and the risks involved. These measures include:

• Organisational measures: access on a need to know basis, confidentiality undertakings, this policy and supporting procedures, staff training, and vendor management.
• Technical measures: access controls and authentication, encryption of data in transit and, where appropriate, at rest, network and endpoint protection, logging and monitoring, secure backups, and patching.
• Physical measures: secured premises, locked storage for physical records, clear desk practices, and controlled disposal of documents and media.

Personnel must report any suspected weakness, loss or compromise of personal data to the DPO immediately, in accordance with section 14.

14. Data breach management and notification

Meridium maintains a data breach response procedure based on the PDPC’s framework of containing the breach, assessing its impact, reporting where required, and evaluating the response to prevent recurrence.

Any person who becomes aware of an actual or suspected data breach must report it to the DPO without delay. The DPO leads the assessment of whether the breach is notifiable. A breach is notifiable where it results in, or is likely to result in, significant harm to the affected individuals, or where it is of significant scale, which means it affects 500 or more individuals.

Where a breach is assessed to be notifiable, Meridium notifies the PDPC as soon as practicable, and in any case no later than three calendar days after the day the Company determines that the breach is notifiable. Where the breach is likely to result in significant harm to affected individuals, Meridium also notifies those individuals, at the same time as, or after, notifying the PDPC, unless an exception to individual notification applies. The Company conducts its assessment expeditiously and does not delay it unreasonably.

Where Meridium acts as a data intermediary, it notifies the organisation on whose behalf it processes the personal data without undue delay from the time it has credible grounds to believe that a breach has occurred, so that the organisation can meet its own obligations.

Meridium keeps a record of all data breaches, whether or not notifiable, together with the assessment and the remedial action taken.

15. Individual rights and how to exercise them

Individuals may, in relation to personal data held by Meridium:

• request access to their personal data and information about how it has been used or disclosed;
• request correction of an error or omission in their personal data;
• withdraw consent previously given, on reasonable notice; and
• raise a query or complaint about how their personal data is handled.

Requests should be made in writing to the Data Protection Officer at dpo@meridium.sg. Meridium will respond to an access or correction request as soon as reasonably possible, and will inform the individual within thirty days where it is unable to respond within that period. A reasonable fee may be charged for an access request, and the individual will be informed of any fee in advance. Meridium may decline a request where the PDPA permits or requires it to do so, and will inform the individual of the reason where it is required to.

16. Marketing messages and the Do Not Call provisions

Where Meridium sends marketing messages, it does so in compliance with the consent and Do Not Call provisions of the PDPA and with the Spam Control Act 2007. Before sending a specified message to a Singapore telephone number, Meridium checks the relevant Do Not Call Registry unless it has clear and unambiguous consent in evidential form, or another exception applies. Marketing messages identify the Company as the sender, provide contact information, and offer a means to unsubscribe. Meridium acts on unsubscribe requests within the period required by law.

17. Roles and responsibilities

17.1 Data Protection Officer

The Company has appointed a Data Protection Officer who is responsible for overseeing compliance with the PDPA and this policy, acting as the contact point for individuals and the PDPC, fostering a culture of data protection, advising on data protection matters, handling access, correction and withdrawal requests, leading data breach response, and maintaining records of compliance. The DPO may be contacted at dpo@meridium.sg. The appointment of a DPO does not relieve Meridium of its obligations under the PDPA.

17.2 Management

Management is responsible for supporting the DPO, allocating adequate resources, and ensuring that data protection is embedded in business processes and in the selection and oversight of vendors.

17.3 All personnel

All personnel must comply with this policy, handle personal data only as authorised and necessary for their role, keep personal data secure and confidential, report breaches and weaknesses promptly, and complete data protection training.

18. Training and awareness

Meridium provides data protection training to personnel on induction and at regular intervals, and additional training where roles involve higher data protection risk, such as client onboarding, compliance, payroll and IT. The DPO maintains a record of training delivered.

19. Applicable laws and regulatory framework

This policy is designed to be consistent with the laws and regulatory instruments that apply to Meridium’s handling of personal data, including the following. This list is not exhaustive and is read together with any guidance issued by the relevant authorities from time to time:

• the Personal Data Protection Act 2012 and its subsidiary legislation, including the Personal Data Protection (Notification of Data Breaches) Regulations 2021;
• the advisory guidelines, codes of practice and decisions issued by the Personal Data Protection Commission;
• the Corporate Service Providers Act 2024 and the Corporate Service Providers Regulations, and related AML, CFT and counter proliferation financing requirements;
• the Spam Control Act 2007 in relation to electronic marketing messages;
• the Companies Act 1967, the Income Tax Act 1947 and the Goods and Services Tax Act 1993 in relation to record keeping and retention;
• the Employment Act 1968 and related law in relation to employee records; and
• where applicable to a particular engagement, foreign data protection laws such as the European Union and United Kingdom General Data Protection Regulations, as agreed with the relevant client.

Where any provision of this policy is inconsistent with a mandatory requirement of applicable law, that requirement prevails, and the remainder of the policy continues to apply.

20. Queries, complaints and contact

Any query or complaint about how Meridium handles personal data should be directed to the Data Protection Officer at dpo@meridium.sg or to the registered office at 143 Cecil Street, #09-01 GB Building, Singapore 069542. Meridium will acknowledge and investigate complaints and respond in a reasonable time. If an individual is not satisfied with the Company’s response, the individual may refer the matter to the Personal Data Protection Commission.

21. Review and governance

This policy is reviewed at least annually, and whenever there is a material change in the applicable law, in the PDPC’s guidance, or in Meridium’s operations or systems. The DPO is responsible for proposing updates, and material changes are approved by management. The current version of this policy supersedes all previous versions.