1. Who we are
This Privacy Policy explains how First Pavilion Technology collects, uses, shares and protects personal data when you visit fpgtechnology.com and its subdomains (the Website), use our live demos, contact us, subscribe to our updates, or deal with us as a client, prospective client, partner or supplier.
"First Pavilion Technology", "we", "us" and "our" mean:
- [SINGAPORE ENTITY NAME], UEN [NUMBER], 6 Raffles Quay, #16-01, Singapore 048580; and
- First Pavilion Technology Sdn Bhd, Registration No. [NUMBER], Suite 23.02, 23rd Floor, Menara JKG, No. 282, Jalan Raja Laut, 50350 Kuala Lumpur, Malaysia,
both members of the First Pavilion Global Berhad group. The entity you deal with, or whose website form you submit, is the data controller (in Malaysia, the "data user") for your personal data. FIRST, FirstMarket, FirstXchange, FirstTokenz, FirstWallet, FirstBizSuite, FirstLead and FirstAI are our product brands.
We provide technology and advisory services to businesses. When we host or operate a platform for a client, the client is usually the controller of its own customers' data and we act as its data processor (or "data intermediary" in Singapore). That processing is governed by our contract with the client and by the client's own privacy notice, not by this Policy.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, job title, company, work email, phone number, country | You, through forms, email, calls and meetings |
| Enquiry details | What you are planning, markets, licence interest, your brief | You |
| Business and due-diligence data | Directors, shareholders and beneficial owners of a client, identity documents, sanctions and adverse media screening results | You, your company, public registers, screening providers |
| Contract and billing | Billing contact, invoices, payment records, bank details | You and your company |
| Communications | Emails, call notes, meeting recordings (only with notice), support tickets | You and our staff |
| Marketing preferences | Newsletter subscription, consent records, opt-outs | You |
| Demo usage | Branding you upload to a demo, actions taken in a demo session | You, through our demo platforms |
| Technical and usage | IP address, device and browser type, pages viewed, referring site, date and time, approximate location from IP | Your device, through cookies and server logs (see our Cookie Policy) |
| Recruitment | CV, employment history, references | You, recruiters, referees |
We do not intend to collect sensitive personal data through the Website. Please do not send us identity documents, health information or financial account details through website forms. Where due diligence requires them, we will ask for them through a secure channel.
The Website and our services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18.
3. How we use personal data and our legal basis
| Purpose | Legal basis |
|---|---|
| Reply to enquiries and arrange consultations | Your consent; steps you request before a contract; our legitimate interest in answering business enquiries |
| Provide demos, proposals and services | Performance of a contract or steps before one |
| Carry out client due diligence, sanctions screening and anti-money-laundering checks | Legal obligation; legitimate interest in preventing financial crime |
| Invoice, collect payment and keep accounting records | Contract; legal obligation |
| Send FIRST Insights and other marketing | Your consent, which you can withdraw at any time |
| Run, secure and improve the Website, including analytics | Legitimate interest; consent for non-essential cookies |
| Detect and prevent fraud, abuse and security incidents | Legitimate interest; legal obligation |
| Establish, exercise or defend legal claims | Legitimate interest; legal obligation |
| Recruitment | Steps before an employment contract; consent where required |
In Singapore and Malaysia we rely on consent, deemed consent and the exceptions those laws allow. In the EU and UK we rely on the legal bases shown. Where we rely on legitimate interest, we have weighed it against your rights; you can ask us for details.
We do not sell personal data. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
4. Use of artificial intelligence
Some of our internal tools, including FirstAI, may help our staff summarise enquiries, draft replies or check documents. A person reviews any output before it is used in a decision about you or sent to you. We do not use personal data you send us to train general-purpose AI models.
5. Who we share personal data with
We share personal data only as needed for the purposes above, with:
- companies in the First Pavilion Global Berhad group;
- service providers that host, support or operate our systems (cloud hosting, email, customer relationship management, analytics, video calls, e-signature), under contracts that require them to protect the data and use it only on our instructions;
- identity verification, sanctions screening and due-diligence providers;
- professional advisers such as lawyers, auditors and licensing consultants, under confidentiality duties;
- regulators, courts, law enforcement and other authorities where the law requires or allows it;
- a buyer or successor if all or part of our business is sold or restructured, under equivalent protection.
Our main service providers are: [LIST, e.g. cloud host and region, email provider, CRM].
6. Transfers outside Singapore and Malaysia
We and our service providers may store or access personal data in Singapore, Malaysia and [OTHER LOCATIONS]. When we transfer personal data across borders, we make sure it receives a standard of protection comparable to the laws of Singapore and Malaysia: for example, by transferring to places with substantially similar data protection laws, by contract clauses (including the EU Standard Contractual Clauses and the UK Addendum where they apply), or with your consent where the law allows.
7. How long we keep personal data
We keep personal data only as long as needed for the purpose, then delete or anonymise it. Our usual periods are:
| Data | Retention |
|---|---|
| Enquiries that do not become clients | 24 months after last contact |
| Client, contract and billing records | Length of the relationship plus 7 years |
| Due-diligence and anti-money-laundering records | At least 5 years after the relationship ends, or longer if the law requires |
| Marketing consent and preferences | Until you withdraw consent, plus 2 years as a record of the withdrawal |
| Demo session data | 90 days after the session |
| Website server logs | 12 months |
| Unsuccessful job applications | 12 months |
8. How we protect personal data
We use administrative, technical and physical safeguards suited to the sensitivity of the data. They include encryption in transit, role-based access, multi-factor authentication for staff, logging of administrative access, staff confidentiality obligations and supplier security reviews. No system is completely secure. If a data breach is likely to cause you significant harm, we will notify you and the relevant regulator as the law requires.
9. Your rights
Depending on where you are, you may have the right to:
- access the personal data we hold about you and ask how it has been used;
- correct data that is inaccurate or incomplete;
- withdraw consent at any time, without affecting processing already done;
- receive or transfer your data in a commonly used format (data portability), where the law provides it;
- ask us to limit processing or delete your data;
- object to processing based on legitimate interest, and to direct marketing at any time;
- complain to a data protection authority.
To exercise a right, email privacy@fpgtechnology.com or write to our Data Protection Officer at the address in section 12. We may need to verify your identity. We will reply within 30 days, or tell you if we need longer. Malaysian law allows a reasonable fee for some access requests; we will tell you before charging one.
If you withdraw consent or ask us to delete data we need to provide a service, we may no longer be able to provide it. We will explain the consequences first.
10. Marketing
We send marketing emails only with your consent, and every message includes a way to unsubscribe. We do not send marketing messages to Singapore telephone numbers listed on the Do Not Call Registry unless you have given clear and unambiguous consent.
11. Cookies
We use cookies and similar technologies on the Website. Non-essential cookies are used only if you agree. See our Cookie Policy and use Cookie preferences in the footer to change your choices at any time.
12. Contact and complaints
Data Protection Officer: [NAME OR ROLE]
Email: privacy@fpgtechnology.com
Singapore: 6 Raffles Quay, #16-01, Singapore 048580
Malaysia: Suite 23.02, 23rd Floor, Menara JKG, No. 282, Jalan Raja Laut, 50350 Kuala Lumpur
If you are not satisfied with our response, you may complain to:
- Singapore: Personal Data Protection Commission (pdpc.gov.sg)
- Malaysia: Personal Data Protection Commissioner (pdp.gov.my)
- EU or UK: the supervisory authority where you live or work, or the UK Information Commissioner's Office (ico.org.uk)
- Other countries: your national data protection authority
13. Jurisdiction-specific notes
- Malaysia: this Policy is our notice under section 7 of the Personal Data Protection Act 2010. A Bahasa Malaysia version is available on request. If the versions differ, the English version applies to the extent the law allows.
- EU and UK: where we are not established in the EU or UK and the GDPR applies to us, contact our Data Protection Officer for our representative's details. [ADD REPRESENTATIVE IF APPOINTED]
- Indonesia, Thailand, Hong Kong, Australia and the UAE: you have the rights given by your local law, which we will respect when you contact us.
14. Changes to this Policy
We may update this Policy. We will post the new version on this page with a new "last updated" date and, if the changes are significant, tell you by email or a notice on the Website.