← Back to home

Privacy Policy

Last updated: 2026-05-09

1. Who we are

This site (insights-2.com) is operated by INSIGHTS-2, a sole-proprietorship registered in Singapore (UEN 53523643C), trading as Insights² (“we”, “us”, “our”). Our principal place of business is 21 Hazel Park Terrace, #1-7, Hazel Park Condominium, Singapore 678946.

We are the data controller for personal data collected through this website. For the purposes of GDPR / UK-GDPR we act as controller; for CCPA / CPRA we are a “business”.

Contact a human

  • General & privacy enquiries: hello@insights-2.com
  • Data Protection Officer (PDPA s.11): Mark Cunningham, routed via the address above.
  • EU representative (GDPR Art. 27): To be appointed — until then please contact us directly using the address above and we will respond within the GDPR Art. 12 timeframe.
  • UK representative (UK-GDPR Art. 27): To be appointed — same fallback as above.

2. What personal data we collect

We try to collect as little personal data as possible. The categories below are exhaustive for this website (separate notices apply on Meridian and any other product subdomains).

Information you give us directly

  • The contents of any email you send us (your name, email address, and the body of the message).
  • If you fill in a contact form (when one is published), the fields you complete in that form.

Information collected automatically

  • Vercel Analytics: page views, referrer, country (derived from IP — your full IP is not retained), device class, and the URL paths you visited. No advertising IDs, no cross-site tracking.
  • Server logs: standard web request logs from our hosting provider Vercel (HTTP method, status, timestamp, user-agent, request path). Held for incident-response and abuse-prevention purposes.
  • Browser local storage: a no_track flag if you opt out of analytics; sidebar / UI state on a few pages. No personal data is stored in browser storage.

CCPA / CPRA categories

For California residents, we collect the following CCPA categories: Identifiers (email when you contact us), Internet or other electronic network activity (analytics events), and Inferences (none drawn at present). We do not collect sensitive personal information, financial information, or government identifiers.

3. Why we use it (purposes)

  • To respond to your enquiries and provide the consultancy services you ask about.
  • To understand how the site is used and improve it (privacy-respecting analytics only).
  • To detect, investigate, and prevent abuse, fraud, and security incidents.
  • To meet legal, accounting, and regulatory obligations in Singapore and any other jurisdiction in which we have a customer.

4. Lawful basis (GDPR / UK-GDPR / PDPA)

If GDPR or UK-GDPR applies to you, we rely on the following Article 6 lawful bases, stated per purpose:

  • Responding to enquiries: performance of pre-contractual steps at your request (Art. 6(1)(b)) or our legitimate interests in operating a consultancy (Art. 6(1)(f)).
  • Analytics and product improvement: your consent (Art. 6(1)(a)) given via the cookie banner; you can withdraw at any time by clicking “Manage cookies” in the footer or by setting localStorage.no_track = '1'.
  • Security and abuse prevention: our legitimate interests (Art. 6(1)(f)) in keeping the site secure, balanced against your rights and freedoms.
  • Legal & tax compliance: compliance with a legal obligation (Art. 6(1)(c)).

If PDPA applies, we rely on your consent (deemed or express, per the circumstances), or one of the exceptions in the PDPA First and Second Schedules where consent is not required (e.g. business contact information; legitimate interests after a balancing test).

5. Who we share it with (subprocessors)

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We do use the following service providers, who process your data on our instructions under written agreements:

  • Vercel Inc. (US) — hosting, edge runtime, and Vercel Analytics. Vercel privacy policy.
  • Microsoft 365 (Microsoft Ireland Operations Limited / Microsoft Corporation, US) — hosts the hello@insights-2.com mailbox; processes any email correspondence you send us.
  • Google Fonts (Google LLC, US) — serves the Inter and Fraunces typefaces. Loaded from Google's CDN at request time.

We will also disclose personal data when required by law (Singapore, or another jurisdiction with a valid legal basis), to enforce our Terms, to detect or prevent fraud, or with your explicit consent.

6. International transfers

Our subprocessors are global. Personal data therefore leaves Singapore and may be processed in the United States, the European Union, the United Kingdom, or elsewhere. We rely on the following transfer mechanisms:

  • PDPA s.26: contractual undertakings ensuring a comparable standard of protection, as required by the PDPA Transfer Limitation Obligation.
  • GDPR Chapter V: the European Commission's Standard Contractual Clauses (June 2021 version) included in our subprocessors' data processing addenda; or, where available, an applicable adequacy decision.
  • UK-GDPR: the ICO's International Data Transfer Agreement or the UK Addendum to the EU SCCs.

Copies of the relevant transfer mechanisms are available from us on request.

7. How long we keep it

  • Email correspondence: 7 years from the last interaction to meet IRAS income-tax recordkeeping obligations (Singapore Income Tax Act, s.67) and the Singapore Limitation Act.
  • Analytics: 24 months in aggregated form (Vercel Analytics retention).
  • Server logs: 90 days, after which they are rotated out.
  • Browser local storage: persists on your device until you clear it; we do not retain a server-side copy.

8. Your rights

Wherever you are, you can ask us to:

  • Tell you what personal data we hold about you and provide you with a copy (right of access).
  • Correct anything that is inaccurate or incomplete (right of correction / rectification).
  • Delete your personal data (right of erasure, where applicable).
  • Stop processing your personal data, or restrict how we process it.
  • Withdraw any consent you have given, at any time, without affecting the lawfulness of processing before the withdrawal.
  • Receive your personal data in a portable, machine-readable format (data portability).
  • Object to processing carried out on the basis of legitimate interests.

We do not engage in solely-automated decision-making that produces legal or similarly significant effects, so GDPR Art. 22 does not currently apply to anything we do here.

How to exercise these rights: email hello@insights-2.com. We respond within 30 days of receiving a verifiable request, and we will not discriminate against you for asking.

Right to complain:

  • Singapore: Personal Data Protection Commission — pdpc.gov.sg.
  • EU: your local supervisory authority, or the lead authority via our EU representative once appointed.
  • UK: the Information Commissioner's Office — ico.org.uk.
  • California: the California Privacy Protection Agency / California Attorney General.
  • Australia: the Office of the Australian Information Commissioner — oaic.gov.au.

9. Do Not Sell or Share my Personal Information (CCPA)

We do not sell personal data and we do not share it for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act (Cal. Civ. Code § 1798.140).

We honour the Global Privacy Control (GPC) signal: if your browser sends a GPC header, we treat it as a request to opt out of any future sale or sharing. You can also opt out manually by clicking “Manage cookies” in the footer and toggling analytics off, which sets the same no_track flag.

10. Cookies and similar technologies

This site uses a small number of cookies and equivalent local-storage entries. The full list, with purpose and retention, is on our Cookies Policy page.

Non-essential cookies (currently: Vercel Analytics) are off by default and load only after you accept them in the cookie banner. You can change your choice at any time via the “Manage cookies” link in the footer.

11. Children

This site is intended for adult business users. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please email hello@insights-2.com and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of the page always reflects the latest version. For material changes that adversely affect your rights or how we use your data, we will give you at least 30 days' notice on this page (and by email if we have one for you) before the change takes effect.

13. Contact

For any privacy enquiry — including access, correction, deletion, complaint, or general questions — email hello@insights-2.com. We aim to acknowledge within two business days and respond substantively within 30 days.

INSIGHTS-2 (UEN 53523643C)
21 Hazel Park Terrace, #1-7, Hazel Park Condominium
Singapore 678946