Privacy notice

Operated by SCSP Pte. Ltd. | ACRA Registered CSP No. FA20260077

This Privacy Notice explains how SCSP Pte. Ltd., trading as Auberique ("Auberique", "we", "us", or "our"), collects, uses, discloses, retains, and safeguards personal data when you access auberique.com (the "Website"), submit an enquiry, book a consultation, or engage our services. We process personal data in strict compliance with the Personal Data Protection Act 2012 of Singapore (PDPA), the Personal Data Protection Regulations 2021, and applicable international data privacy standards.

1. Who We Are and Regulatory Standing

SCSP Pte. Ltd. is a private limited company incorporated in Singapore and a Registered Corporate Service Provider regulated by the Accounting and Corporate Regulatory Authority (ACRA) under the Corporate Service Providers Act 2024 (Registration No. FA20260077).

In accordance with Section 9 of the Corporate Service Providers Act 2024, our corporate secretarial practices, client due diligence assessments, and statutory lodgments are actively supervised by accredited Registered Qualified Individuals (RQIs). We have designated a Data Protection Officer (DPO) to oversee our data protection compliance.

2. Operational Capacity: Data Controller vs. Data Intermediary

Depending on the context of the interaction and the services requested, Auberique operates in two distinct legal capacities under the PDPA:

• As a Data Controller: We act as a Data Controller in respect of personal data collected directly through our Website enquiry forms, scheduling tools, direct communications, and the mandatory customer due diligence (CDD/KYC) records we obtain to satisfy our own statutory obligations under the Corporate Service Providers Act 2024 and applicable anti-money laundering (AML) laws.
• As a Data Intermediary (Data Processor): Where we are formally engaged by an investment fund, private capital sponsor, special purpose vehicle (SPV), or operating company to provide fund administration, corporate secretarial, or cap table management services, we process personal data concerning investors, directors, shareholders, and corporate personnel strictly on behalf of and under the instructions of the client entity. Such processing is governed exclusively by our Master Services Agreement (MSA) and standalone Data Processing Addendum (DPA) executed with the client.

3. Personal Data We Collect

We collect personal data across three primary operational areas:

A. Website Enquiries & Consultation Bookings

When you submit an enquiry, request indicative pricing, or schedule a consultation:

• Contact Details: Full name, business email address, and phone number.
• Professional Profile: Organization name, whether you are acting as an investor/sponsor or founder/operator, and your primary jurisdiction.
• Project Parameters: The vehicle or service of interest (e.g., Variable Capital Company (VCC), closed-end fund, SPV, holding company) and any commercial context voluntarily provided in your message.
• Meeting Information: Scheduled consultation date, time zone, and meeting notes.

B. Statutory Due Diligence & Client Onboarding (KYC / AML / CFT)

Upon executing an engagement letter, to fulfill mandatory statutory obligations under the Corporate Service Providers Act 2024, the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 (CDSA), and ACRA regulations, we collect:

• Identity Records: Full legal name, aliases, date of birth, nationality, passport or National Registration Identity Card (NRIC) details, and residential address.
• Verification Documents: Certified proof of residential address, corporate authorization documents, and identity verification logs.
• Compliance & Ownership Data: Source of funds, source of wealth declarations, tax identification numbers (TIN), politically exposed person (PEP) status, sanctions screening records, and beneficial ownership data required for ACRA’s Register of Registrable Controllers (RORC), Register of Nominee Directors (ROND), and Register of Nominee Shareholders (RONS).

C. Technical Infrastructure & Web Analytics

When you browse the Website:

• Technical identifiers including your Internet Protocol (IP) address, browser type and version, device operating system, and approximate geographical location derived from server logs.
• Basic diagnostic and server telemetry metrics captured automatically by our website hosting infrastructure.

4. Cookies and Web Technologies

• No Advertising or Behavioral Tracking Cookies: The Website does not deploy third-party advertising cookies, commercial tracking pixels, or cross-site behavioral profiling scripts.
• Server-Level Telemetry: Our hosting provider records anonymous, aggregate technical metrics to monitor platform uptime, server load, and basic security without depositing client-side tracking cookies on your device.
• External Web Assets (Google Fonts): The Website renders typography using Google Fonts. When your browser requests a page, it establishes a direct connection with Google's servers, transmitting your device's IP address to Google in accordance with standard internet protocol.
• Future Deployments: If non-essential operational or analytical cookies are integrated in the future, we will update this notice and deploy a consent mechanism prior to activation.

5. Purposes of Processing and Legal Bases

We collect, use, and disclose personal data strictly for specified purposes under the PDPA:

6. Artificial Intelligence & Automated Processing Safeguards

Auberique utilizes enterprise-tier software tools and secure artificial intelligence applications to streamline document parsing, text extraction, and administrative due diligence workflows. We operate under clear structural controls:

• No Public Foundation Model Training: Client personal data and transaction documents are never submitted to public consumer AI models and are never used by our software vendors to train, retrain, or improve underlying machine learning models.
• Enterprise SaaS Configurations: AI-assisted processing is conducted exclusively within business-grade environments configured to prevent third-party data retention or cross-tenant sharing.
• Mandatory Human Oversight: In alignment with PDPC Advisory Guidelines on AI systems, we do not execute automated decision-making producing legal or similarly significant effects. AI-assisted screening outputs and document extractions serve solely as operational triage and remain subject to independent verification and sign-off by our Registered Qualified Individuals (RQIs) or compliance personnel before any formal onboarding or statutory determination is made.

7. Who We Disclose Personal Data To

We do not sell, rent, or trade personal data. We disclose personal data strictly on a need-to-know basis to:

• Our Associated Law Firm: Where an engagement requires legal opinions, custom fund structuring, cross-border tax advice, or formal legal documentation falling outside our CSP administrative parameters, data is shared with our associated regulated law firm (Luther) pursuant to a direct or tripartite engagement.
• Regulated Banking Partners: Upon your explicit instruction and consent, completed and verified CDD/KYC packages are shared with partner commercial or private banks to facilitate corporate account opening.
• Enterprise Service Providers (Sub-Processors): Trusted vendors supporting our day-to-day operations—primarily certified cloud productivity suites (Google Workspace for Business), digital identity verification vendors, and secure email providers—bound by enforceable contractual confidentiality and data protection obligations.
• Statutory and Law Enforcement Authorities: ACRA, the Monetary Authority of Singapore (MAS), the Inland Revenue Authority of Singapore (IRAS), the Suspicious Transaction Reporting Office (STRO) of the Commercial Affairs Department (CAD), and judicial bodies where required by law.

8. Cross-Border Data Transfers

Where our enterprise cloud infrastructure (including Google Workspace data centers) routes or stores data outside Singapore, we ensure compliance with the Transfer Limitation Obligation under the Personal Data Protection Regulations 2021.

We take steps to ensure that overseas service providers provide a standard of protection comparable to that of the Singapore PDPA by relying on enterprise data processing addenda that incorporate legally enforceable commitments, such as Standard Contractual Clauses (SCCs) or equivalent international security certifications.

9. Data Retention Schedules

We retain personal data only for as long as necessary to fulfill the legal and operational purposes for which it was obtained:

• Statutory KYC, AML & Corporate Records: All customer due diligence files, identification documents, transaction records, statutory registers, and corporate resolutions are retained for a mandatory minimum period of five (5) years following the formal termination of the business relationship or completion of the transaction, pursuant to the Corporate Service Providers Act 2024 and ACRA regulations.
• Prospective Enquiries (Non-Converting): Enquiries and preliminary consultation records that do not result in a commercial engagement are permanently purged within twelve (12) months of our last interaction.
• Technical Server Logs: Web server diagnostic and access logs are retained on a rolling ninety (90) day security cycle before automated deletion.

10. Data Security & Limitations of Internet Transmission

We implement reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold:

• Cloud Infrastructure Standards: All verification records, statutory registers, and client correspondence are maintained within enterprise-grade, SOC 2 and ISO/IEC 27001 certified cloud environments (Google Workspace for Business).
• Access Controls & Encryption: Our systems enforce mandatory multi-factor authentication (MFA/2SV), role-based access restrictions, and industry-standard encryption protocols (TLS 1.3 in transit and AES-256 at rest).

Limitations of Internet Security: While we apply strict security controls to safeguard your data, no method of electronic transmission over the internet or method of digital cloud storage can be guaranteed as completely secure. Consequently, we cannot warrant or guarantee that personal data will never be subject to unauthorized access, interception, alteration, or loss resulting from sophisticated cyber-attacks, social engineering, or technical vulnerabilities beyond our reasonable commercial control.

11. Incident Management & Breach Notification

Auberique maintains internal incident response and data breach escalation procedures:

• As Data Controller: Where a verified security incident results in, or is likely to result in, significant harm to affected individuals or meets the statutory notification threshold under the PDPA (e.g., compromising sensitive identity records or affecting 500 or more individuals), we notify the Personal Data Protection Commission (PDPC) within seventy-two (72) hours of completing our assessment, and promptly notify affected individuals where required by law.
• As Data Intermediary: Where a security incident compromises personal data processed strictly on behalf of an institutional client entity (such as a fund or SPV), we notify the affected client organization without undue delay to provide the preliminary facts necessary for the client to assess and fulfill its own regulatory notification duties.

12. Your Statutory Rights Under the PDPA

Under the PDPA, individuals have explicit statutory rights regarding their personal data held by Auberique:

• Right of Access: You may request details regarding your personal data in our possession or control, as well as information on how that data has been used or disclosed within the past calendar year.
• Right of Correction: You may request the correction of any inaccurate, incomplete, or outdated personal data we hold about you.
• Right to Withdraw Consent: You may withdraw consent for the collection, use, or disclosure of your personal data at any time upon reasonable notice.
  • Operational Impact: Withdrawing consent may prevent us from responding to your enquiry or maintaining ongoing corporate administration services.
  • Statutory Exceptions: Withdrawal of consent does not affect data processing mandated by law, including our continuous statutory duty to maintain KYC/AML files under the Corporate Service Providers Act 2024.

How to Exercise Your Rights

To submit an access, correction, or consent-withdrawal request, please write directly to our Data Protection Officer:

• Attention: Data Protection Officer
• Entity: SCSP Pte. Ltd. (trading as Auberique)
• Email: dpo@auberique.com

We evaluate and respond to all verifiable statutory requests within thirty (30) days. If you remain unsatisfied with our handling of a request, you retain the statutory right to lodge an inquiry or complaint with the Personal Data Protection Commission of Singapore (PDPC) at www.pdpc.gov.sg.

13. Additional Disclosures for International Visitors (EEA / UK / Switzerland)

Where personal data of individuals located within the European Economic Area (EEA), United Kingdom, or Switzerland is collected or processed:

• Legal Bases: Processing is conducted on the legal bases of contractual necessity, compliance with mandatory statutory obligations under Singapore law (including the CSP Act 2024 and AML/CFT frameworks), or our legitimate interests in administering commercial engagements and maintaining platform security.
• Statutory Rights: In addition to rights under the Singapore PDPA, eligible data subjects may exercise their statutory rights under the EU/UK GDPR (including the right to erasure, restriction of processing, data portability, and the right to object to processing) by contacting our Data Protection Officer at dpo@auberique.com. You also maintain the right to lodge a complaint with your local data protection supervisory authority.

14. Updates to This Notice

We may amend this Privacy Notice from time to time to reflect changes in our operational practices, service offerings, or statutory obligations under ACRA and PDPC regulations. The "Last Updated" date at the top of this page indicates the effective revision date.