1. About this policy

Beyond Strengths Pte Ltd (UEN 202529940M) ("Beyond Strengths", "we", "us" or "our") is committed to handling personal data responsibly. We provide coaching, consulting, training, learning programs and related digital services to individuals and organizations in Singapore and the region. 

This Policy explains how we collect, use, disclose, protect and retain personal data through our website, service engagements, learning platforms, communications, marketing activities and other interactions with us. It is intended to describe our practices under Singapore’s Personal Data Protection Act 2012 ("PDPA") and its applicable regulations. If a service has additional privacy terms, those terms should be read together with this Policy. 

In this Policy, "personal data" has the meaning given in the PDPA. It generally means data, whether true or not, about an individual who can be identified from that data alone or together with other information to which we have or are likely to have access.

2. Business contact information 

The PDPA’s data protection provisions do not apply to business contact information when it is collected, used or disclosed for business purposes. This generally includes an individual’s name, business position or title, business telephone number, business address, business email address, business fax number and similar information that is not provided solely for personal purposes. 

We may collect business contact information when working with client organisations. We nevertheless handle it with care. If information is provided in a personal capacity or goes beyond business contact information (for example, a personal mobile number or coaching information), the applicable PDPA protections apply. The Do-Not-Call rules may also apply to marketing messages to Singapore telephone numbers; see Section 13. 

3. Personal data we may collect

Depending on how you interact with us and the services you use, we may collect: 

• contact and identity details, such as name, email address, telephone number, job title, organisation and business or residential address; 

• enquiry, engagement and transaction information, including project scope, service requirements, correspondence, invoices and payment status; 

• information you provide during coaching, consulting, assessments, surveys, training, learning activities or account registration, including assessment responses and learning progress; 

• account, profile, login and technical information, such as account identifiers, IP address, device and browser details, pages or features used, session information and server logs; 

• payment-related information necessary to process a transaction. Payment card or account details may be collected directly by payment providers such as Stripe or PayPal, where used, under their own terms; 

• information made available when you connect an account or use an integration, such as Google, LinkedIn, Facebook or YouTube data, subject to the permissions you grant and the integration used; 

• images, video or audio recordings that you submit for a service or choose to use with AI avatar, voice synthesis or voice-cloning features. Such material may contain sensitive or biometric-like information; we use it for the requested feature and do not use it to identify you for unrelated purposes; and 

• cookie and analytics information, as described in Section 9. 

You are responsible for ensuring that information you provide about another person has been collected and shared with us lawfully and that you have authority to provide it. 

4. How we collect personal data

We collect personal data directly from you when you contact us, submit a form, create an account, enrol in a programme, engage us, take part in coaching or training, use our services, connect a third-party account, or communicate with us by email, telephone, messaging or other channels. We may also receive information from your organisation, authorised representatives, service providers, public sources, or connected platforms where permitted and relevant to the service. 

We notify you of the purposes for collection, use and disclosure at or before collection, through this Policy, the relevant form, service terms or another notice. Where the PDPA requires consent, we obtain it; we do not treat use of a service or acceptance of this Policy alone as consent to every use of personal data. 

5. How we use personal data 

We may collect, use or disclose personal data for purposes that are notified to you and that a reasonable person would consider appropriate in the circumstances, including to: 

• respond to enquiries and provide coaching, consulting, training, advisory, learning and related services; 

• create and administer accounts, portals, courses, profiles, communications and interactive features you choose to use; 

• carry out assessments, prepare deliverables, support learning and provide customer service; 

• manage client engagements, payments, records, contractual obligations and business operations; 

• operate, maintain, secure, troubleshoot and improve our services, website, learning experience and internal processes; 

• provide service notices, changes, updates and information about services you have requested or purchased; 

• send newsletters or marketing communications where we have obtained consent or are otherwise permitted to do so, and honour opt-out requests; 

• carry out due diligence or checks required by applicable law or professional standards; 

• comply with legal, regulatory, audit and record-keeping requirements; and 

• establish, exercise or defend legal rights, investigate suspected misuse, and protect our rights, users, services and the public. 

We will not use or disclose personal data for a new purpose unless we notify you and obtain consent where required, or a permitted exception under the PDPA applies. We do not use your course content or personal data to train or improve public third-party AI models. Where AI features are provided through external services, we use service configurations and contractual or technical safeguards intended to restrict such use, subject to the feature and provider terms. 

6. Consent and withdrawal 

We rely on consent where required by the PDPA, or on another basis or exception permitted under the PDPA. Where you enter into an agreement with us, we may process personal data that is reasonably necessary to perform the agreement in accordance with the PDPA, including deemed consent by contractual necessity where applicable. 

You may withdraw consent by contacting our Data Protection Officer (DPO) using the details in Section 16. We will explain the likely consequences of withdrawal where relevant and, after a reasonable notice period, cease the relevant collection, use or disclosure unless continued processing is permitted or required by law. Withdrawal may affect our ability to provide a service or feature. 

7. When we disclose personal data 

We do not sell personal data. We may disclose it, as necessary for the purposes described in this Policy, to: 

• our employees and authorised representatives who need it for their work; 

• clients or portal administrators where they operate a programme, account or private learning portal and have authority to receive the information; 

• contractors, data intermediaries and service providers that host, support, process payments for, secure, analyse or help deliver our services; 

• platform and integration providers whose services you choose to use, such as learning, analytics, video, AI, identity, cloud, payment or communications providers; 

• professional advisers, auditors, insurers, regulators, law enforcement agencies, courts or other parties where required or permitted by law; and 

• a successor or transaction counterparty in connection with a reorganisation, merger, financing or transfer of our business, subject to appropriate safeguards. 

We require service providers handling personal data on our behalf to protect it and use it only for authorised purposes, through contractual terms or other appropriate controls. Where we process personal data on behalf of a client organisation, our agreement with that organisation and any applicable data processing terms also govern the processing. 

8. Learning platforms, AI features and private portals 

We may use third-party platforms to provide courses, portals and related digital services. Depending on the platform and features enabled, providers may include Coursebox.ai, Microsoft Azure OpenAI, Google Gemini, Mistral, HeyGen and ElevenLabs, as well as cloud, web-form, website, analytics, payment and video services. The provider and information processed will depend on the service you use and the configuration in place. These providers may process information on our behalf or under their own terms when you interact directly with their services. 

If you use an AI avatar, voice synthesis or voice-cloning feature, we may process the image, video or audio you provide to generate the requested output. Use of these features is limited to people aged 18 or older. Do not upload another person’s likeness or voice unless you have their permission and any other required rights. We do not knowingly process a minor’s likeness or voice through these features. 

Some client programmes may be delivered through a custom-branded or private portal administered by a client. The client may determine the purposes and means of its portal and may provide additional privacy information. We may provide platform maintenance, upgrades, backups or security support as agreed, but the client remains responsible for its own portal operations and notices. Contact the portal operator about its practices; contact us if your request concerns processing we carry out on that operator’s behalf. 

9. Cookies, analytics and third-party integrations 

We may use session and persistent cookies or similar technologies to support sign-in, maintain sessions, remember preferences, protect our services, understand usage and improve the user experience. You can manage or clear cookies through your browser settings. Disabling some cookies may affect site or service functionality. 

Where enabled, analytics services such as Google Analytics may collect website usage information, for example pages visited, approximate location, device or browser information and time on site. We use analytics to understand and improve our website. We do not use targeting or advertising cookies through our website unless we notify you otherwise. Analytics and embedded third-party content may be subject to the provider’s own privacy terms and settings. 

If you connect YouTube or another third-party account, we may access information the integration makes available under your permissions, such as video titles, channel information, playlists or playback details, to provide the requested educational or platform feature. We use such information for that feature and do not sell it. Embedded content may collect information directly under the third party’s own privacy policy. 

10. Overseas transfers and storage. 

Personal data may be stored or processed in Singapore or other countries where our service providers or we operate. Before transferring personal data outside Singapore, we take steps required by the PDPA to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA, unless an exception applies. Safeguards may include contractual data protection obligations and appropriate security measures. Information about relevant service providers and transfer safeguards may be requested from our DPO. 

11. Protection and retention 

We make reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. Measures may include access controls, encryption in transit, vendor safeguards, staff guidance and periodic review of security practices. No method of transmission or storage is completely secure. 

We retain personal data only for as long as it is needed for the purpose collected or for a legal or business purpose. As general guidelines, enquiry records may be retained for up to 12 months after last contact; client engagement records may be retained during the engagement and for up to 7 years after completion where appropriate for legal, accounting or business records; marketing contacts may be retained until consent is withdrawn or 3 years of inactivity; and analytics data is retained according to the relevant platform settings. Actual retention may vary by record type, legal requirements and contractual obligations. When data is no longer needed, we will delete, anonymise or securely dispose of it. 

12. Data breach response and notification 

If we become aware of a data breach involving personal data, we will take reasonable steps to assess, contain and address it. Where the breach is notifiable under the PDPA, we will notify the Personal Data Protection Commission as soon as practicable and no later than 3 calendar days after assessing that the breach is notifiable. We will notify affected individuals as soon as practicable where required, subject to any applicable direction or exception. If you believe your personal data held by us has been compromised, please contact our DPO promptly. 

13. Marketing and Do-Not-Call 

We may send marketing communications by email or other channels where we have consent or are otherwise permitted by law. You can opt out at any time by using the unsubscribe method provided or by contacting our DPO. We will continue to send essential service or transaction communications where needed. The PDPA’s Do-Not-Call (DNC) provisions generally restrict specified marketing messages to Singapore telephone numbers listed on the DNC Registry, including some business numbers. Before sending a covered message, we will check the Registry or obtain clear and unambiguous consent, unless an applicable exception applies. Messages directed to businesses and not individuals, service messages and other statutory exceptions may be treated differently under the rules. We will identify ourselves as required and act on opt-out requests within the applicable period. 

14. Access and correction requests 

Subject to the exceptions in the PDPA, you may request access to personal data in our possession or control and information about how it was used or disclosed during the 12 months before your request. You may also request correction of an error or omission. Please send your request to our DPO and provide enough information for us to verify your identity and locate the relevant records. 

We will respond as soon as reasonably practicable and within the time required by law. If we cannot respond within 30 days, we will let you know when we expect to respond. We may charge a reasonable fee for an access request where permitted and will inform you before proceeding. We do not charge for correction requests. If we refuse a request, we will explain the reason where required by law. We will take reasonable steps to transmit corrected information to relevant organisations as required by the PDPA. 

15. Children and third-party websites 

Our services are not designed for children to use independently. We do not knowingly collect personal data from a child without appropriate authority or consent where required. If you believe a child has provided personal data to us inappropriately, contact our DPO so we can review and take suitable action. AI avatar and voice-cloning features are restricted to adults as described in Section 8. 

Our services may link to third-party websites or content. Those third parties have their own privacy practices, and this Policy does not govern their services. Please review their privacy policies before providing information to them. 

16. Contact our Data Protection Officer For questions, complaints, consent withdrawal, access or correction requests, or to report a suspected data breach, contact: Data Protection Officer Patrick Loke Beyond Strengths Pte Ltd (UEN 202529940M) 

Email: support@beyondstrengths.com 

WhatsApp: +65 9878 7894 

We aim to acknowledge data protection enquiries within 3 business days and to resolve requests as soon as reasonably practicable, subject to the timeframes and requirements of applicable law. 

16. Contact our Data Protection Officer For questions, complaints, consent withdrawal, access or correction requests, or to report a suspected data breach, contact: Data Protection Officer Patrick Loke Beyond Strengths Pte Ltd (UEN 202529940M) 

Email: support@beyondstrengths.com 

WhatsApp: +65 9878 7894 

We aim to acknowledge data protection enquiries within 3 business days and to resolve requests as soon as reasonably practicable, subject to the timeframes and requirements of applicable law. 

17. Updates to this Policy 

We may update this Policy to reflect changes in law, services or data practices. The latest version and its effective date will be posted on our website. Where a material change affects how we handle personal data, we will provide notice or seek consent where required. Please review this Policy periodically.