Privacy
How I collect, use, store, and protect information when you use this website.
This Privacy Statement explains how Darren Sim (the "Operator") collects, uses, discloses, transfers, and retains personal data in connection with this website. It is a notice, not a contract. The terms governing your use of the Website, including governing law and dispute resolution, are set out in the Terms of Use.
Version dated 5 September 2026
Before publishing: replace each bracketed placeholder with final details, and confirm the tools listed in clause 3 and in the Cookie Notice match what is actually deployed on the Website.
1. Who is responsible for your personal data
1.1 The Operator of this website is Darren Sim, based in Singapore. The Operator is the person responsible for personal data processed through the Website. Where the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") or the UK GDPR applies, the Operator is the controller of that personal data. Where the Personal Data Protection Act 2012 of Singapore (the "PDPA") applies, the Operator is the organisation responsible for it.
1.2 The Operator has designated a data protection officer for the purposes of section 11(3) of the PDPA. All communications concerning personal data — including questions about this Privacy Statement, requests for access, correction, or deletion, withdrawals of consent, requests for transfer documentation, and complaints — should be submitted through the "Contact Us" facility on the Website, selecting "Legal & Privacy" as the topic.
1.2.1 The contact facility is the Operator's designated channel for such communications and is monitored by the data protection officer. The Operator does not publish a separate email or postal address for this purpose. Where the Operator requires a postal address in order to respond to or verify a request, it will ask you for one through that channel. A postal address will be provided on written request where the Operator is required by law to supply one.
1.3 The Operator has not appointed a representative under Article 27 of the GDPR or the UK GDPR, on the basis that the Website is not directed at, and does not monitor the behaviour of, individuals in the European Economic Area or the United Kingdom. Should that position change, a representative will be appointed and identified in this Privacy Statement.
2. Interpretation and scope
2.1 In this Privacy Statement, "the Website" means this personal content website, including its blog, speaking engagements, publications, contact facility, and newsletter subscription facility; and "you" and "your" mean any person who accesses or uses the Website or whose personal data is otherwise processed by the Operator in connection with it.
2.2 "Personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data together with other information to which the Operator has or is likely to have access, and includes "personal data" and "personal information" as defined under any other applicable data protection law.
2.3 This Privacy Statement applies to personal data collected by or on behalf of the Operator in connection with the Website. It does not apply to any third-party website, platform, publication, or service, whether or not accessed by means of a link on the Website.
2.4 Headings are for convenience only. Words importing the singular include the plural and vice versa. "Include" and "including" are to be construed without limitation.
3. Personal data collected and the purposes of processing
3.1 Enquiries submitted through the contact facility. Where you submit an enquiry, the Operator collects the information you enter into the following free-text fields: name, email address, topic, and message. This data is used to respond to and administer your enquiry and any consequent correspondence, and to maintain a record of it. Providing this data is voluntary, but without it the Operator cannot respond.
3.2 You are asked not to submit sensitive personal data through the contact facility unless strictly necessary for your enquiry. Anything you enter into the free-text fields is submitted at your own election.
3.3 Newsletter subscriptions. Where you subscribe to the newsletter, the Operator collects your email address in order to distribute the newsletter and related updates. The Operator or its email service provider additionally records data necessary to administer and secure the mailing list, including subscription source and timestamp, confirmation and unsubscribe activity, and delivery, bounce, and complaint records.
3.4 Newsletter engagement tracking. You should be aware that the newsletter platform used by the Operator embeds tracking pixels and rewritten links in outgoing messages, which record whether a message was opened, when, on what approximate device and location derived from IP address, and which links were clicked. This constitutes profiling of subscriber engagement and is used to gauge interest in topics and to maintain list hygiene. Where consent is required for such tracking, it is sought at the point of subscription, and you may withdraw it at any time in accordance with clause 5.
3.5 Technical and server-log data. Providers engaged to host, secure, and deliver the Website automatically process limited technical data in server logs, including IP address, browser and device type, referring page, access times, and pages requested, for the purposes of delivery, security, diagnostics, abuse prevention, and maintenance.
3.6 Cookies and similar technologies. The Website uses cookies and similar technologies as described in the Cookie Notice, which forms part of this Privacy Statement. Where the Website is accessed from a jurisdiction requiring prior consent to non-essential cookies, such cookies are set only after consent is obtained through the cookie banner, and your preferences may be changed or withdrawn at any time.
3.7 Personal data obtained from third parties. In connection with speaking engagements, publications, podcasts, and similar activities, the Operator may receive personal data from event organisers, hosts, publishers, or professional contacts, typically comprising name, organisation, role, and business contact details, for the purposes of arranging and delivering the engagement and subsequent professional correspondence. Where required by Article 14 of the GDPR or equivalent law, this clause serves as notice of that collection, of the categories of data concerned, and of the source from which it was obtained.
3.8 General purposes. Across all of the above, the Operator processes personal data only for purposes that a reasonable person would consider appropriate in the circumstances, namely: responding to enquiries; distributing the newsletter and administering subscriptions; arranging and delivering speaking engagements and publications; operating, securing, maintaining, and improving the Website; detecting and preventing misuse, fraud, and security incidents; and complying with legal, regulatory, and record-keeping obligations and establishing, exercising, or defending legal claims.
3.9 The Operator does not carry out automated decision-making producing legal or similarly significant effects concerning you.
4. Legal bases for processing
4.1 Under the PDPA, the Operator relies on your consent, deemed consent, or an applicable exception under the First or Second Schedule to the PDPA, including the legitimate interests exception in respect of security and fraud prevention.
4.2 Where the GDPR or UK GDPR applies, the legal bases are:
| Processing | Legal basis |
|---|---|
| Responding to enquiries | Article 6(1)(f) legitimate interests, namely responding to persons who contact the Operator |
| Newsletter distribution | Article 6(1)(a) consent |
| Newsletter engagement tracking | Article 6(1)(a) consent |
| Non-essential cookies | Article 6(1)(a) consent |
| Server logs, security, and abuse prevention | Article 6(1)(f) legitimate interests, namely operating and securing the Website |
| Speaking engagements and publications | Article 6(1)(b) steps at your request, or Article 6(1)(f) legitimate interests in professional activity |
| Legal and regulatory compliance | Article 6(1)(c) legal obligation |
| Establishing or defending claims | Article 6(1)(f) legitimate interests, or Article 9(2)(f) where special category data is involved |
4.3 Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
5. Withdrawal of consent
5.1 You may at any time, on giving reasonable notice, withdraw any consent given or deemed to have been given in respect of the collection, use, or disclosure of your personal data for any purpose, in accordance with section 16 of the PDPA and any equivalent right under other applicable law.
5.2 In respect of the newsletter specifically, you may withdraw consent using the unsubscribe facility in any newsletter, which takes effect promptly. In respect of any other processing, you may withdraw consent using the contact details in clause 1.2.
5.3 On receipt of a valid withdrawal the Operator will cease the relevant processing within a reasonable period and will inform you of the likely consequences of withdrawal, which may include being unable to respond to your enquiry or to send you the newsletter. The Operator may retain a minimal suppression record for the sole purpose of ensuring your withdrawal is honoured, and may retain data where retention is required or authorised by law.
6. Disclosure to third parties
6.1 The Operator does not sell, rent, trade, or share personal data for cross-context behavioural advertising, and has not done so in the preceding twelve months.
6.2 The Operator discloses personal data to the following categories of recipient, in each case only to the extent necessary for the provision of their services or as permitted or required by law:
- Website hosting, security, and content delivery providers
- Email newsletter and mailing list platforms
- Contact form and email service providers
- Analytics providers, where deployed
- Professional advisers, where necessary for legal or accounting purposes
6.2.1 The Operator engages a small number of established service providers in each of the above categories and may change them from time to time. Details of the specific providers engaged at any given time will be furnished on request made in accordance with clause 1.2.
6.3 The Operator may further disclose personal data where reasonably necessary to comply with applicable law or lawful process, to respond to a request from a public authority acting within its powers, to protect the rights, property, or safety of the Operator or any other person, to investigate suspected misuse of the Website, or to establish, exercise, or defend legal claims.
6.4 Where the GDPR or UK GDPR applies, the providers referred to in clause 6.2 act as processors under Article 28 and are engaged under written terms imposing confidentiality, security, sub-processing, assistance, and deletion obligations. Where the PDPA applies, those providers act as data intermediaries.
7. International transfers
7.1 The Website is accessible globally and personal data may be processed outside your jurisdiction, including in Singapore, the United States, and the European Union, depending on the location of the relevant provider's systems and personnel.
7.2 Where personal data is transferred out of Singapore, the Operator takes reasonable steps to ensure that the recipient is bound by legally enforceable obligations affording a standard of protection comparable to that under the PDPA, in accordance with section 26 of the PDPA and Part 3 of the Personal Data Protection Regulations 2021.
7.3 Where personal data is transferred out of the European Economic Area or the United Kingdom, the transfer is made pursuant to an adequacy decision where one applies, or otherwise on the basis of the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Agreement or Addendum), supplemented where appropriate by additional safeguards. In respect of providers in the United States, the Operator relies where available on certification under the EU–US Data Privacy Framework and its UK Extension, and otherwise on Standard Contractual Clauses.
7.4 A copy of the relevant transfer mechanism may be requested using the contact details in clause 1.2.
8. Retention
8.1 The Operator ceases to retain personal data, or removes the means by which it can be associated with a particular individual, as soon as it is reasonable to assume that the purpose for which it was collected is no longer served by retention and that retention is no longer necessary for legal or business purposes.
8.2 The Operator does not apply fixed retention periods. Because the Website is operated by an individual and the volume of personal data is small, retention is assessed by reference to the following criteria rather than by reference to a defined duration:
| Category | Criteria used to determine retention |
|---|---|
| Contact enquiries and correspondence | Retained while the enquiry remains live or the correspondence remains relevant to an ongoing or reasonably anticipated professional relationship, and thereafter while retention remains necessary for record-keeping, for resolving a dispute, or for establishing, exercising, or defending a legal claim |
| Newsletter subscriber data | Retained for the duration of the subscription |
| Unsubscribe and suppression records | Retained for so long as necessary to ensure the withdrawal of consent continues to be honoured, limited to the minimum data required for that purpose |
| Newsletter engagement data | Retained while it remains useful for assessing interest in topics and maintaining list hygiene, and is in any event held subject to the retention settings of the email service provider |
| Server and security logs | Retained in accordance with the operational and security requirements and default settings of the relevant hosting or security provider |
| Speaking engagement and publication records | Retained while relevant to the Operator's professional record and while necessary having regard to applicable limitation periods |
8.3 The Operator reviews the personal data it holds from time to time and deletes, or anonymises, data that no longer satisfies the criteria in clause 8.2. You may at any time request deletion of personal data concerning you using the contact details in clause 1.2, and the Operator will comply unless retention is required or permitted by law.
9. Security and data breaches
9.1 The Operator makes reasonable security arrangements of an administrative and technical nature, and relies additionally on safeguards implemented by its providers, to protect personal data in its possession or under its control against unauthorised access, collection, use, disclosure, copying, modification, disposal, and similar risks.
9.2 You acknowledge that no method of internet transmission and no method of electronic storage is completely secure, and that absolute security cannot be warranted.
9.3 In the event of a data breach, the Operator will assess it without undue delay and, where the breach is notifiable, will notify the Personal Data Protection Commission of Singapore and affected individuals in accordance with Part 6A of the PDPA, and will make any notification required under Articles 33 and 34 of the GDPR or the UK GDPR or other applicable law.
10. Your rights
10.1 Under the PDPA, and subject to the exceptions in the Fifth and Sixth Schedules, you may request access to personal data about you in the Operator's possession or under its control together with information about the ways in which it has been or may have been used or disclosed in the preceding year, and you may request correction of any error or omission.
10.2 Under the GDPR or UK GDPR, where applicable, you have rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and objection to direct marketing at any time, in each case subject to the conditions and exemptions in those laws.
10.3 Under United States state privacy laws, where applicable, you may have rights to know, access, correct, delete, and obtain a portable copy of your personal information, to opt out of sale, sharing, or targeted advertising, and not to be discriminated against for exercising those rights. The Operator does not sell or share personal information as those terms are defined in those laws. Where technically supported, the Operator honours the Global Privacy Control signal.
10.4 Requests may be submitted using the contact details in clause 1.2 and should contain sufficient particulars to enable the Operator to identify the data concerned and to verify your identity. The Operator will respond within the period required by applicable law and, where a request is refused in whole or in part, will provide reasons where required to do so. An authorised agent may submit a request on your behalf on production of satisfactory evidence of authority.
10.5 Nothing in this Privacy Statement derogates from your right to lodge a complaint with the Personal Data Protection Commission of Singapore, with the supervisory authority of your EU Member State of residence or place of the alleged infringement, with the UK Information Commissioner's Office, or with any other competent authority in your jurisdiction. You are, however, encouraged to raise the matter with the Operator first.
11. Direct marketing compliance
11.1 The newsletter is distributed only to persons who have subscribed, and subscription is confirmed by a double opt-in email before any newsletter is sent.
11.2 Every newsletter identifies the sender, states the Operator's postal address, and contains a functioning unsubscribe facility that remains operative for the period required by applicable law. The Operator's practices are intended to comply with the Spam Control Act 2007 of Singapore, the CAN-SPAM Act (United States), Canada's Anti-Spam Legislation, and Article 13 of the ePrivacy Directive as implemented in the EEA and the United Kingdom.
11.3 The Operator does not conduct telemarketing and therefore does not send messages to Singapore telephone numbers to which the Do Not Call provisions of the PDPA would apply.
12. Minors
12.1 The Website is directed to a general professional audience and is not intended for children. The Operator does not knowingly collect personal data from any person under the age of 13, or under the age at which that person is capable of giving valid consent in their jurisdiction (which is up to 16 in parts of the EEA and the United Kingdom).
12.2 If you are below that age, you must not submit personal data without the involvement of a parent or guardian. Where the Operator becomes aware that personal data has been submitted by a minor without appropriate authorisation, the Operator will take reasonable steps to delete it.
13. Third-party links and embedded content
13.1 The Website may contain links to, and embedded content from, third-party websites, publications, event pages, video platforms, and social media services. Embedded content may set cookies and collect data as if you had visited the third-party service directly; see the Cookie Notice.
13.2 The Operator exercises no control over, assumes no responsibility for, and gives no warranty in respect of the privacy practices or content of any third party, whose own notices govern.
14. Amendments
14.1 The Operator may amend this Privacy Statement from time to time to reflect changes to the Website, to the providers engaged, or to applicable legal requirements. The amended version takes effect upon posting on this page bearing a revised version date.
14.2 Where an amendment materially affects the processing of your personal data, the Operator will provide reasonable advance notice by a prominent notice on the Website or, for subscribers, by email. Where the change materially alters processing carried out on the basis of your consent, the Operator will obtain fresh consent before implementing it; continued use of the Website is not treated as consent in that case.
15. Governing law
15.1 This Privacy Statement and any non-contractual obligation arising out of or in connection with it are governed by and construed in accordance with the laws of the Republic of Singapore.
15.2 Clause 15.1 does not deprive you of the protection of any provision of the data protection or consumer law of your country of habitual residence that cannot be derogated from by agreement, and does not limit your statutory right to complain to a supervisory authority under clause 10.5.
15.3 The terms governing your use of the Website, including the dispute resolution procedure and the choice of forum, are set out in the Terms of Use, which apply in addition to this Privacy Statement. In the event of a conflict between the two documents in respect of the handling of personal data, this Privacy Statement prevails.
15.4 Limitation of liability. Any liability of the Operator arising out of or in connection with this Privacy Statement, or with the collection, use, disclosure, transfer, retention, or security of personal data in connection with the Website, is subject to the disclaimers, exclusions, and cap on liability set out in clause 10 of the Terms of Use, which are incorporated into this Privacy Statement by reference and apply as if set out here in full.
15.5 Clause 15.4 does not exclude or limit, and nothing in this Privacy Statement excludes or limits, any liability that cannot lawfully be excluded or limited, any statutory right or remedy available to you under applicable data protection law, or your right to lodge a complaint with a supervisory authority under clause 10.5.
16. Severability and language
16.1 If any provision of this Privacy Statement is held to be invalid or unenforceable, that provision is severed to the minimum extent necessary and the remaining provisions continue in full force and effect.
16.2 This Privacy Statement is drafted in English. Where a translation is provided for convenience, the English text prevails in the event of inconsistency.
17. Contact
17.1 All questions, requests, and complaints concerning this Privacy Statement or the handling of personal data should be submitted through the "Contact Us" facility on the Website, selecting "Legal & Privacy" as the topic, as set out in clause 1.2.