Global Privacy Policy

Privacy and security are important to Atlantic Partners Asia. This Global Privacy Policy explains how Atlantic Partners Asia collects, uses, discloses, stores, protects and otherwise processes personal information in connection with its websites, client portals, products, services and related interactions.

“APA”, “we”, “us” or “our” refers to Atlantic Partners Asia Holdings (SG) Pte Ltd and the affiliate or subsidiary that determines the purposes and means of processing your personal information in connection with the relevant Service. We operate the website www.atlanticpartnersasia.com. The identity of the responsible APA entity may also be stated in your Client Agreement, onboarding materials or another notice provided to you.

This Privacy Policy applies to personal information we process about website visitors; prospective, current and former clients; authorised users and representatives of business clients; directors, officers, shareholders, partners, trustees and beneficial owners; payers, payees and beneficiaries; suppliers and business partners; and other individuals who interact with us, whether directly or through a client, partner or service provider (collectively, “you”, “Client”). It applies to information collected online and offline in connection with our website our client portal and any dashboards within it (the “Client Portal”)) and any products or services that APA provides to you (the “Services”). Where a Client provides us with information about another individual, that Client is responsible for ensuring that it is authorised to do so and that the individual receives any notice required by applicable law.

Please read this Privacy Policy carefully. Your use of the Services is also subject to our contractual terms and any supplemental or local privacy notice made available to you.

1.1 The personal information that APA collects depends on your relationship with us, the Services you use, your location and applicable law.

1.2 We collect information directly from you; from your organisation or authorised representatives; from your counterparties, payment networks and financial institutions; from identity-verification, fraud-prevention, sanctions-screening, analytics and other service providers; from regulators and public authorities; and from publicly available or commercially available sources. We may combine information from these sources. Our Services are not directed to persons under 18 years. We do not knowingly collect personal information from children.

1.3 We collect the following information:

a) Identity and government identifier information: including name, age, date of birth, citizenship, nationality, signature, account credentials (including access credentials and multi-factor authentication details), and details from passports, visas, national or state identification documents, driver’s licences and tax identification records.

b) Contact information: including residential or business address, email address, telephone or mobile number, and other details used to communicate with you.

c) Payment and transaction information: including payer and payee details, payment instructions, transaction amounts, currencies, dates, locations, counterparties, references, status, history and information needed to process, reconcile, investigate or report a transaction.

d) Financial and due-diligence information: including bank and account details, payment instrument information, credit or risk information, occupation, employer, salary or income information, and information relating to source of funds and source of wealth.

e) Biometric data: including your image in photo or video form, and facial scan data extracted from your photo or video (known as "biometric data"), to verify your identity during onboarding as part of our Know-Your-Customer (KYC) and Know-Your-Business (KYB) checks, to authenticate you as an authorised user of our Services, or to detect and prevent fraud.

f) Business and relationship information: including company name, registration details, ownership and control information, business activities, expected account activity, role or authority, contracts, preferences, and records of our relationship with you or your organisation.

g) Communications and support information: including correspondence, call or meeting records where lawfully recorded, enquiries, complaints, feedback and information you provide when you contact or interact with us, including through the Client Portal.

h) Any other information or data that you voluntarily provide to us related to the Services or otherwise, or that we may collect as permitted by law and with your consent, where required by law.

Please note that we also collect the above information in respect of any shareholders, directors, trustees, beneficiaries, partners and authorised personnel as part of our Know-Your-Business (“KYB”) processes.

1.4 When you use our websites, the Client Portal, applications or any electronic communications, we may automatically collect the following information:

a) Device and usage information: including IP address, device and browser type, operating system, device identifiers, pages or screens viewed, referring URLs, timestamps, session activity, diagnostic data and network information, including log-in history and records of your activity within the Client Portal.

b) Location information: including approximate location inferred from IP address and, where enabled and permitted, more precise geolocation from a device or application.

c) Cookies and similar technologies: information collected through cookies, software development kits, pixels, tags and similar technologies, including identifiers, preferences, session information and interactions with our website. We also use cookies and similar technologies to identify you and permit access to areas of the Client Portal in place of a login and password, and to record your use of the Client Portal, as described in our Cookie Policy. Where required by law, we obtain consent before using non-essential technologies. You can manage available choices through our cookie settings and your browser or device controls.

2.1 We collect, use, disclose and otherwise process personal information only where reasonably necessary and permitted by applicable law, including for the following purposes:

a) to enter into, perform and administer agreements with you, your organisation or an end customer; open and manage accounts; process, settle, reconcile and report transactions; and provide, operate, monitor, maintain and improve our website, the Client Portal, or Services;

b) to manage our relationship with you, including granting, administering and revoking access to the Client Portal for you and your Authorised Users; verifying instructions and authority, providing support, and receiving, investigating and responding to enquiries, requests, applications, disputes, complaints and feedback;

c) to verify identity, conduct KYC, KYB and other due-diligence checks, screen and monitor transactions, maintain records, make required reports, and comply with legal and regulatory obligations, lawful requests and applicable anti-money laundering, counter-terrorism financing, sanctions, anti-bribery, fraud-prevention, tax and audit requirements;

d) to communicate with you about the Services, including any technical notices, updates, security alerts, and support and administrative messages, and to respond to your comments, questions, and client service requests;

e) to protect the integrity and security of our Services; manage operational, credit, financial-crime and compliance risk; detect, investigate, prevent and respond to suspected fraud, money laundering, sanctions breaches, cyber incidents and other unlawful or harmful activity; and protect the rights, property and safety of APA, our clients and others;

f) to administer and improve our business and Services, including quality assurance, testing, analytics, product development, audit, compliance monitoring, consolidated reporting, business continuity, training and customer service; where practicable, we use aggregated or de-identified information for these purposes;

g) to send marketing communications about products, services and events offered by APA or selected partners, and provide news and information we reasonably believe may be relevant to you, only where permitted by applicable law and subject to your choices. See “Marketing Opt-Out Rights” below.

h) to establish, exercise or defend legal claims; enforce our agreements; obtain professional advice; and evaluate or complete an actual or proposed merger, acquisition, financing, reorganisation, sale of assets or similar corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

The legal basis or authority on which we rely depends on the purpose, the information and the applicable law. Where a jurisdiction does not use the concept of a “legal basis”, we process personal information in accordance with the applicable consent, notification, reasonable-purpose and other legal requirements. We may rely on one or more of the following:

a) Contract and pre-contractual steps: processing necessary to enter into or perform a contract with you, or to take steps at your request before doing so;

b) Legitimate interests: processing necessary for our or a third party’s legitimate interests, including operating and improving the Services, communicating with you, preventing fraud and other unlawful activity, ensuring network and information security, managing risk, maintaining records and protecting or enforcing legal rights, provided those interests are not overridden by your interests, rights or freedoms where the applicable law requires that balancing;

c) Legal obligation and public interest: processing necessary to comply with applicable laws, regulations, court orders, lawful requests and regulatory obligations, or to carry out tasks in the public interest where recognised or permitted by applicable law, including screening, monitoring, reporting, tax, audit and recordkeeping requirements;

d) Consent: processing for a specified purpose where valid consent is required or otherwise appropriate, including for certain marketing activities, optional cookies and similar technologies, and biometric information where applicable. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice, without affecting processing already carried out lawfully; and

e) Vital interests and legal claims: processing necessary to protect a person’s vital interests, or to establish, exercise or defend legal claims, where recognised by applicable law.

4.1 We send direct marketing only as permitted by applicable law and, where required, after obtaining consent. Marketing messages will identify the sender and provide a method to opt out. You may withdraw your consent to, or opt out of, marketing at any time by using the unsubscribe mechanism in the message or by contacting dpo@atlanticpartnersasia.com. We will action valid opt-out requests within the period required by applicable law and will not charge you for doing so.

4.2 Opting out of marketing will not prevent us from sending service, security, legal, regulatory or transaction-related communications that are necessary to administer your account or provide the Services. If you ask us to stop all communications, we may be unable to continue providing some or all Services.

5.1 We may disclose personal information for the purposes described in this Privacy Policy to the following categories of recipients, subject to applicable law and appropriate safeguards:

a) APA affiliates and subsidiaries that support the Services or perform centralised functions, including technology, hosting, operations, compliance, risk, fraud prevention, finance, audit, legal, marketing and customer support. Group recipients may process personal information only for authorised purposes and must protect it in accordance with applicable law and our internal requirements. Where the Client Portal (including its Dashboard component) displays an aggregated view of products or services provided by more than one APA entity, each item of information is provided by, and remains the responsibility of, the APA entity identified as the relevant service provider in your Client Agreement, and such aggregation does not itself change the entity responsible for processing that information;

b) service providers that process information on our behalf, including providers of cloud hosting, communications, analytics, identity verification, sanctions and fraud screening, payment processing, customer support and professional services. We require such providers by contract or other legally enforceable means to use personal information only for authorised purposes and to apply appropriate confidentiality, security, retention and assistance measures; and independent controllers or joint controllers, including banks, payment networks, correspondents, counterparties, agents and other financial institutions that process information under their own legal and regulatory responsibilities;

c) courts, regulators, law-enforcement agencies, tax authorities and other public bodies where disclosure is required or permitted by law, necessary to respond to lawful process, or reasonably necessary to prevent or investigate suspected unlawful activity, protect rights or safety, or satisfy reporting obligations relating to anti-money laundering, counter-terrorism financing, proliferation financing, sanctions, fraud or similar matters; and

d) actual or prospective purchasers, investors, lenders, advisers and successor entities in connection with an actual or proposed merger, acquisition, financing, reorganisation, insolvency, transfer or sale of all or part of our business or assets, subject to appropriate confidentiality and data-protection safeguards.

5.2 We do not sell personal information to third parties. .

6.1 APA operates globally and may transfer, store, access or otherwise process personal information in jurisdictions other than the one in which it was collected, including through APA group entities and service providers. Those jurisdictions may have different data-protection laws. Before making a restricted transfer, we take steps required by applicable law to assess the transfer and protect the information.

6.2 Where required, we use legally recognised transfer mechanisms and supplementary safeguards, which may include contractual commitments, standard or model contractual clauses, intra-group arrangements, adequacy or comparable-protection determinations, risk assessments, technical and organisational measures, and vendor due diligence and oversight.

7.1 Subject to applicable law, you may have the right to request access to personal information we hold about you and information about how it has been used or disclosed; request correction of inaccurate or incomplete information; withdraw consent; object to or restrict certain processing; request deletion, de-identification or portability; opt out of direct marketing or certain disclosures; and lodge a complaint with us or a competent privacy regulator. These rights are not absolute and may differ by jurisdiction.

7.2 To exercise your rights, email dpo@atlanticpartnersasia.com and describe your request. We may take reasonable steps to verify your identity and authority, locate the relevant records, and protect the rights of other persons. An authorised representative may submit a request where permitted by law, subject to appropriate proof of authority.

7.3 We will respond within the period required by applicable law in the relevant jurisdiction and in any case no later than 30 days. If we are unable to respond within that time, we will notify you in writing, within those 30 days, of when we expect to respond. We may refuse or limit a request where an exemption applies, including where disclosure would reveal another person’s information, prejudice an investigation, breach legal privilege or conflict with a legal or regulatory obligation. Where required, we will explain the refusal and available review or complaint options.

7.4 While we do not ordinarily charge a fee for a privacy request, we reserve the right to charge you a processing fee (as permitted by law) depending on the nature and complexity of your request. If we intend to charge you a fee for processing your access request, we will provide you with a prior written estimate of the fee.

7.5 Withdrawing consent does not affect processing already carried out lawfully and may prevent us from providing Services where the information is necessary for those Services or for legal or regulatory compliance.

We may use automated tools to support identity verification, fraud detection, sanctions screening, transaction monitoring, eligibility, risk assessment and service security. These tools may generate risk indicators, flags or recommendations for review. Where an automated decision could significantly affect your rights or interests and applicable law requires notice, explanation, human review or a means to contest the outcome, we will provide those safeguards. We do not rely solely on automated decision-making that produces legal or similarly significant effects unless it is authorised by applicable law and accompanied by required protections.

9.1 We retain personal information only for as long as necessary, including to provide the Services, comply with legal and regulatory obligations, maintain financial and transaction records, records of your use of the Client Portal (including access logs and instruction history), resolve disputes, investigate misconduct, enforce agreements and establish or defend legal claims.

9.2 Applicable tax and anti-money laundering regulations may require certain records to be kept for a prescribed period after a transaction, relationship or account ends; we retain such records for a minimum of seven years. Information subject to a legal hold, investigation or dispute may be retained for longer.

9.3 When retention is no longer justified, APA will securely delete or de-identify the information or isolate it from further use until deletion is feasible.

9.4 Notwithstanding the above, anonymised information that can no longer reasonably identify an individual may be retained and used as permitted by law.

We maintain administrative, technical and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and other misuse. Depending on the information and risks, these safeguards may include encryption in transit and at rest, access controls based on business need, authentication (including multi-factor authentication for Client Portal access), logging and monitoring, secure development and change management, vulnerability management, business continuity measures, employee training, vendor due diligence, contractual controls, incident-response procedures and periodic testing. No system is completely secure, and we cannot guarantee the absolute security of your personal information.

We maintain procedures to identify, contain, investigate, assess and remediate actual or suspected personal-data breaches. Where required by applicable law, we will notify the relevant regulator and affected individuals within the prescribed timeframe and provide information required by law. In deciding whether notification is required, we assess factors such as the sensitivity of the information, the circumstances of the incident, the likelihood and seriousness of harm, and the effectiveness of remedial measures. We also maintain breach records where required.

Our website or Services may contain links to, or interoperate with, websites and services operated by third parties. Those third parties control their own privacy practices. This Privacy Policy does not apply to information processed independently by them, and we encourage you to review their privacy notices before providing personal information.

We may update this Privacy Policy to reflect changes in our Services, practices or legal obligations. We will post the updated version on this page and revise the “Last Updated” date. Where required by applicable law, we will provide additional notice of material changes and obtain consent before applying a new purpose that requires consent.

If you have a question, wish to exercise a privacy right or believe that we have not complied with applicable privacy law, please contact dpo@atlanticpartnersasia.com. You can also write to our Data Protection Officer at: Atlantic Partners Asia Holdings (SG) Pte Ltd, 133 Cecil Street, 18-01 Keck Seng Tower, 069535 Singapore.

Please provide enough detail for us to understand and investigate the matter. We will acknowledge, investigate and respond within the timeframe required by applicable law and will explain any available escalation options.

If you are not satisfied with our response, you may have the right to complain to the data privacy regulator in your jurisdiction. We ask that you contact us first so that we have an opportunity to address your concern, but this does not affect any right to approach a regulator directly.