Privacy policy
Last updated: 23 October 2026
1. Organisation and scope
API Raster Consulting (UEN 93690322M), operated by Marcus Tan Wei Lian, 16, Jalan Besar, 208877 Singapore, Singapore, is the data controller for personal data collected through https://api-raster.digital/ and related inquiry channels.
This policy explains how we handle personal data under the Personal Data Protection Act 2012 (PDPA) as amended, including obligations in force from 1 February 2021 regarding data breach notification.
2. Data Protection Officer
Our Data Protection Officer is Marcus Tan Wei Lian, Director. Contact: info@api-raster.digital or +65-6000-1910.
3. What we collect
| Source | Data | Purpose |
|---|---|---|
| Inquiry form | Name, email, optional phone, message text | Respond to your project inquiry and prepare a scope discussion |
| Cookie preference | Consent choice stored in your browser | Remember whether you accepted or rejected non-essential storage |
We do not run analytics, advertising pixels, or third-party tracking on this site.
4. Legal bases and PDPA purposes
We collect inquiry data with your consent when you submit the form, and as needed to take steps at your request before a contract. We use data only for the stated purposes (purpose limitation), keep it accurate where you notify us of changes, and protect it with access controls appropriate to a small consulting practice.
5. Retention
Inquiry records are kept for up to twenty-four months after our last meaningful correspondence unless a longer period is required for contracts, accounting, or legal claims. Consent preferences remain in your browser until you clear site data or change your choice via the cookie notice.
6. Transfers
We host and process inquiry data on infrastructure we control or contract with under written confidentiality terms. We do not sell personal data.
7. Your rights
You may request access to or correction of your personal data, or withdraw consent where applicable, by contacting the DPO. You may also lodge a complaint with the Personal Data Protection Commission (PDPC) in Singapore.
8. Do Not Call Registry
If you provide a Singapore telephone number, we will use it only to respond to your inquiry unless you separately agree to marketing calls. We check numbers against the Do Not Call Registry before promotional voice calls, which we rarely make for this B2B service.
9. Data breaches
If we assess a breach as notifiable under PDPA, we will notify the PDPC as soon as practicable and no later than three calendar days after that assessment, and notify affected individuals where significant harm is likely.
10. Inquiry form handling
Submissions POST as JSON to /api/inquiry on the same domain. The handler stores messages securely for staff review and does not publish them. Technical errors are logged server-side only.
11. Changes
We will post material updates on this page with a revised date.