Privacy Policy and PDPA Notice
Last updated 24 October 2026. This notice explains how Infracom Consultancy Integration Pte Ltd collects, uses, discloses and protects your personal data when you use store.infracom.com.sg, and what your rights are under Singapore's Personal Data Protection Act 2012.
- We collect only what a purchase needs: your name, e-mail, phone, billing address and, if you give it, a company name.
- We do not sell your personal data to anyone.
- We share it only with the services that make the store work: Stripe for payment, Xero for the tax invoice, Microsoft 365 for e-mail, Microsoft Azure for hosting, and where the law requires.
- Orders are kept for as long as the law on accounting records requires. Dormant store accounts are deleted after three years, with a warning first.
- You can download or delete your store data yourself from your order page. Privacy questions and PDPA requests go to our Data Protection Officer at [email protected]; order questions go to [email protected]. You can escalate to the PDPC.
- Who we are
- What personal data we collect
- Why we collect it
- Legal basis under the PDPA
- Who we share data with
- Where your data is processed
- How long we keep your data
- How we protect your data
- Your rights under the PDPA
- Cookies and tracking
- Data Protection Officer
- Complaints and PDPC escalation
- Changes to this policy
1. Who we are
This notice is issued by Infracom Consultancy Integration Pte Ltd ("Infracom", "we", "us"), a private limited company incorporated in Singapore, UEN 200802723Z. Registered office: 506 Chai Chee Lane #07-02, Singapore 469026. Infracom Store sells digital toolkits and guides written from Infracom's own cybersecurity and governance work. Primary contact for data matters: [email protected]. Questions about an order go to [email protected].
2. What personal data we collect
When you buy
Your name, e-mail address, phone number, billing address, the company name you choose to give for the tax invoice, the product bought, the amount paid, the currency, and the order id. Card details are entered on Stripe's payment page and never reach our servers. We receive from Stripe the card's country, the last four digits and the payment reference.
When you use your order page
The dates and countries of your downloads, the number of downloads per file, the time your order page was last opened, and any message you send through Report a problem.
When you ask for a free template
Your e-mail address, the product you chose it from, the time you confirmed, and the follow-up e-mails sent to you. You can unsubscribe from the follow-ups with one click.
When you write or chat
E-mails to support, WhatsApp messages to our number, and questions put to the Owl, our website assistant. Please do not send confidential material through the assistant.
Website usage
With your consent through the cookie banner: pages viewed, the path to a purchase and your general location, through Google Analytics and Google Tag Manager. Without consent only the cookies the store needs to work are set.
3. Why we collect it
- To take payment, deliver the files, issue the tax invoice and keep the accounting records the law requires.
- To run your order page: links, fresh links, downloads, the invoice, refunds under the refund rule, replacements.
- To mark every delivered file with the order it belongs to, which is how the single business licence is enforced.
- To answer your questions and send the free template and its follow-ups you asked for.
- To see how the store is used and improve it.
4. Legal basis under the PDPA
We rely on your consent, given when you order, ask for a template, accept cookies or write to us; on the need to perform the contract you entered when you bought; and on our legal obligations, in particular the duty to keep accounting records. Where consent is the basis you may withdraw it at any time, with effect from then on.
5. Who we share data with
Service providers
- Stripe Payments Singapore Pte Ltd: payment processing, card fraud checks and tax calculation. Stripe's own privacy policy applies to the payment page.
- Xero Limited: the tax invoice, payment and refund records in our accounts.
- Microsoft Corporation: e-mail through Microsoft 365, hosting and file storage through Microsoft Azure.
- Google LLC: analytics and tag management, only with your cookie consent; reCAPTCHA on the assistant.
- Meta Platforms: WhatsApp messages, when you message our number.
- Cloudflare: the network in front of the store, which sees the connection details of every visit.
Each provider processes data on our instructions and under its own data protection terms.
Disclosure required by law
We disclose personal data where a Singapore law, court order or regulator requires it, and only to the extent required.
6. Where your data is processed
The store runs in Microsoft Azure's Southeast Asia region, in Singapore. Stripe, Xero, Microsoft 365, Google and Meta may process data outside Singapore. We transfer data only to providers who give protection comparable to the PDPA, as the Act requires.
7. How long we keep your data
- Orders, invoices and payment records: five years from the end of the financial year, as Singapore accounting and tax law requires. Deleting your store account does not remove these.
- Your store account and files: deleted three years after the last time your order page was opened, with a warning e-mail 30 days before. You can delete it yourself at any time from the order page.
- Free template sign-ups: deleted after one year without activity.
- Support e-mails and chat: as long as the case is open plus the period needed to answer a later question about it.
- Analytics: Google Analytics keeps aggregated usage data for 14 months.
8. How we protect your data
Administrative
Infracom operates an ISO/IEC 27001 certified information security management system. Access to store data is limited to the people who run the store, and every access to an order through the admin pages is logged.
Technical
All traffic is encrypted in transit. Files are kept in private storage and released only through links that expire and count downloads. Card data never touches our servers. Secrets are kept in a managed vault, not in code.
Physical
The store runs on Microsoft Azure, whose data centres hold independent security certifications. Infracom holds no servers for the store on its own premises.
9. Your rights under the PDPA
- Access and portability: Download my data on your order page gives you everything the store holds about you, as a file.
- Correction: Change my e-mail on your order page; for a wrong name or address, write to [email protected] and we correct it.
- Withdrawal of consent: unsubscribe from follow-ups with the link in each e-mail; change your cookie choice at any time; ask us to stop any other use.
- Deletion: Delete my account on your order page removes your orders, links, files and messages from the store. The accounting records stay as the law requires.
- Complaint: see section 12.
To exercise any of these rights, send a written request to [email protected]. We answer every request within 30 days. We do not charge for requests.
10. Cookies and tracking
The banner shown on your first visit lets you choose. Your choice is kept in your browser and can be changed by clearing the site's data.
- Necessary: the cookie that remembers your consent choice, and the session used by Stripe's payment page. Always on.
- Analytics: Google Analytics through Google Tag Manager, only when you accept. Used to count visits and see which pages lead to a purchase.
- Marketing: conversion measurement for our advertising, only when you accept.
Google's consent mode is set to denied until you accept, so no analytics or marketing cookie is written before your choice.
11. Data Protection Officer
In compliance with PDPA Section 11(3), Infracom has designated a Data Protection Officer responsible for ensuring compliance with the PDPA. For all privacy-related enquiries, requests under the PDPA, or to report a concern, write to:
Data Protection Officer
Infracom Consultancy Integration Pte Ltd
[email protected]
By post: 506 Chai Chee Lane #07-02, Singapore 469026, marked "Attention: Data Protection Officer".
12. Complaints and PDPC escalation
If you have any concern about how we have handled your personal data, contact us first at [email protected]. We investigate and respond within 30 days. If you are not satisfied, you may complain to the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.
13. Changes to this policy
We update this notice when the store or the law changes. The date at the top shows the current version. A material change is announced on this page before it takes effect.