What we collect, and what we do with it.

1. Who we are

Lubelink is a marine lubricant procurement platform operated by the Kaeline Group. In this policy, "we", "us" and "our" mean Lubelink and the Kaeline Group. "You" means any individual whose personal data we hold.

For everything in this policy, we act as the organisation responsible for the personal data described here.

2. What we collect

We collect only what you give us, and a small amount of technical information that arrives with it. We do not buy personal data, and we do not build profiles of visitors.

When you fill in the contact form

What	Whether you have to give it
Your name	Required
Your company	Required
Your email address	Required if you ask us to reply by email
Your mobile number	Required if you ask us to reply by phone
Which you prefer	Required
Anything you write in the message	Optional, and entirely up to you

What arrives with your message

• Your browser's user agent string, which says which browser and operating system you used.
• A one-way cryptographic hash of your IP address. We do not store your IP address itself. The hash lets us spot repeated automated submissions without recording where you are.
• The date and time you submitted.

If we have given you an account

A small number of people have an account on our private support area. For them we hold a name, an email address, and whatever they send us through it.

3. Why we collect it

We collect personal data for purposes a reasonable person would consider appropriate in the circumstances, and for no other purpose. Specifically:

• To answer you. If you ask us to get in touch, we use your contact details to do exactly that.
• To discuss and provide our services. Including arranging a demonstration, answering questions about the platform, and following up on a procurement enquiry.
• To run the support portal. To let an authorised person sign in, submit a change request, and see its progress.
• To keep the site working and free of abuse. The hashed address and the timestamp are used to limit automated submissions.
• To meet legal and regulatory obligations where those apply to us.

We do not use your personal data for automated decision making, and we do not sell it to anyone, ever.

4. Your consent, and taking it back

When you submit the contact form, you consent to us collecting, using and disclosing the personal data in it for the purposes set out in section 3. We tell you those purposes before you submit, which is what this policy is for.

You can withdraw your consent at any time by writing to info@lubelink.com. We will act on it within a reasonable time and tell you what the likely consequences are, which is usually that we can no longer reply to your enquiry. Withdrawing consent does not make anything we did beforehand unlawful, and it does not affect data we are required by law to keep.

5. Who else sees it

Your personal data is seen by our own staff who need it to answer you, and by a small number of service providers who process it on our instructions and nothing more. Those are:

• Our website host, which delivers the pages and receives your form submission.
• Our database and file storage provider, which holds the records described above.
• Our email provider, which delivers an internal notice to the colleague handling your enquiry.

Each of them is bound by contract to protect the data and to use it only for the service they provide to us. We do not disclose personal data to anyone else, except where we are required to by law or by a court, or where it is necessary to protect someone's safety.

Our pages load their typefaces from this site rather than from a font service, so reading a page tells no one else that you were here. We set no advertising or analytics code on this site.

6. Where it is kept

Personal data collected through this site is stored in a database hosted in Singapore. Some of our service providers may process limited data outside Singapore in the course of delivering their service, for example when routing an email message.

Where personal data is transferred out of Singapore, we take reasonable steps to satisfy ourselves that the recipient is bound by legally enforceable obligations to protect it to a standard comparable with the Personal Data Protection Act 2012, as section 26 of that Act requires.

7. How long we keep it

We stop keeping personal data once the purpose we collected it for has been served and there is no longer a legal or business reason to hold it. In practice:

• Enquiries that do not become a relationship: deleted within 24 months of your last contact with us.
• Enquiries that become a customer relationship: kept for the life of that relationship, then for as long as any legal, tax or accounting obligation requires.
• Support portal accounts and change requests: kept while the account is active, and deleted within 12 months of the account closing.
• Attachments you upload to a request: deleted with the request.

You may ask us to delete your data sooner, and we will unless we are required to keep it.

8. How we protect it

We make reasonable security arrangements to protect personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. These include:

• Every page and every submission is encrypted in transit using TLS.
• The database refuses all access by default. No key held by any web browser can read or write a record. Only our server can, and it holds its credentials in a secrets store, never in the page.
• Files you attach to a support request are stored privately and are reachable only through a link that expires.
• The support portal has no passwords to be guessed or reused. Signing in requires a single-use link sent to an address we have set up in advance, and nobody can create their own account.
• Your IP address is reduced to a one-way hash before it is ever written down.
• Access to personal data inside our organisation is limited to the people who need it.

No system is perfectly secure, and we do not claim otherwise. We do commit to the measures above and to the notification duties in section 10.

9. Seeing and correcting your data

Under the Personal Data Protection Act 2012 you may ask us:

• For access: to be told what personal data of yours we hold, and how it has been used or disclosed in the 12 months before your request.
• For correction: to correct an error or omission in it.
• For deletion, or to withdraw your consent, as set out in section 4.

Write to info@lubelink.com. We may ask you to confirm your identity so that we do not hand your data to somebody else. We will respond as soon as we reasonably can, and if we cannot respond within 30 days we will tell you within that time when we will.

There is no charge for a correction request. For an access request we may charge a reasonable fee to cover the cost of responding, and if we do we will tell you the amount first and let you decide whether to proceed.

In a small number of situations the Act permits or requires us to refuse a request, for example where releasing the data would reveal personal data about somebody else. If we refuse, we will tell you why.

10. If something goes wrong

If a data breach occurs, we will assess it promptly. Where the breach is likely to result in significant harm to the individuals affected, or is of a significant scale, we will notify the Personal Data Protection Commission as soon as practicable and in any case within 3 calendar days of establishing that it is notifiable. Where the breach is likely to result in significant harm to you, we will notify you as well, at the same time or after we notify the Commission.

11. Calls and messages

If you give us a Singapore telephone number and ask us to reply by phone, you are asking us to contact you on it about your enquiry.

We do not send marketing messages to telephone numbers. If that ever changes, we will check the relevant Do Not Call registers maintained under the Personal Data Protection Act 2012 before sending anything, unless you have given us clear and unambiguous consent in writing to receive it, and every message will identify us and tell you how to stop it.

12. Cookies and tracking

This website sets no cookies. It carries no analytics, no advertising pixels, and no third-party tracking of any kind. We do not know who you are when you read these pages, and we are not trying to find out.

The one exception is the support portal, which stores your sign-in session in your own browser so that you are not asked to sign in again on every page. That is stored on your device, not read by us, and it is cleared when you sign out.

13. Children

This site is for people working in shipping and procurement. It is not directed at children, and we do not knowingly collect personal data from anyone under 13. If you believe a child has sent us personal data, write to us and we will delete it.

14. Changes to this policy

We may update this policy. The version and effective date at the top of this page always tell you which one is current. If a change materially affects how we handle personal data we already hold, we will take reasonable steps to tell the people affected.

15. Contact and complaints

We have designated a Data Protection Officer responsible for making sure we comply with the Personal Data Protection Act 2012. You can reach them here:

Use that address for any question about this policy, any request under section 9, or any complaint about how we have handled your personal data. We would like the chance to put things right ourselves.

If you are not satisfied with our response, you may complain to Singapore's Personal Data Protection Commission at pdpc.gov.sg.