Privacy policy
This policy describes how EQΦS (EQPhiS) Asia collects, uses and protects your personal data, in compliance with the Singapore Personal Data Protection Act 2012 (PDPA).
1. Data controller
2. Data collected
2.1 Data provided by you
- Contact form: name, email, message, segment of interest.
- Pre-diagnostic / order: information about your situation, financial or strategic data necessary for analysis.
- φ simulator: values of the 9 sliders and context data voluntarily provided (mode, organization size).
2.2 Automatically collected data
- IP address, browser type, pages viewed, visit duration, referrer.
- Strictly necessary technical cookies for site operation.
No advertising cookies or third-party tracking (Google Analytics, Facebook Pixel, etc.) is used by default.
3. Purposes and legal bases
- Answer your requests (contact, quote, pre-diagnostic) — legal basis: pre-contractual measures.
- Execute ordered missions — legal basis: contract performance.
- Commercial communications (if you consent) — legal basis: consent.
- Anonymized audience measurement — legal basis: legitimate interest (service improvement statistics).
- Legal obligations (accounting, tax) — legal basis: legal obligation.
4. Retention
- Prospect data (contact not followed by a mission): 3 years from last exchange.
- Client data (mission performed): 5 years after mission end (accounting obligation).
- Simulator data: not retained beyond the session, unless you explicitly request a deeper analysis.
- Technical logs: 12 months.
- Accounting documents: 10 years (accounting records).
5. Data recipients
Your data is never sold, rented or transferred to third parties for commercial purposes. Possible recipients are:
- The EQΦS (EQPhiS) Asia teams authorized to handle your request.
- Strictly necessary technical sub-contractors (PDPA-aligned Singapore host, payment processor, email tool).
- Administrative or judicial authorities upon legal requisition.
All sub-contractors are bound by a contract compliant with PDPA article 28.
6. Transfers outside Singapore
The Growth Agency LLC being located in the United States, certain data may transit outside Singapore. In this case:
- Transfers are governed by the contractual safeguards equivalent to the PDPA transfer requirements (Decision 2021/914);
- The Data Privacy Framework (DPF) is applied where the sub-contractor adheres to it;
- The most sensitive data (NDA, client dossiers) remains hosted in Singapore.
7. Security
EQΦS (EQPhiS) Asia implements appropriate technical and organizational measures:
- TLS 1.3 encryption in transit and AES-256 at rest.
- Per-client isolation (dedicated environment for sensitive missions).
- Systematic mutual NDA before any exchange.
- Secure erasure certified compliant with NIST SP 800-88.
- The EQΦS calculation engine (Codex Universalis) runs entirely locally — no data leaves it to a third party for computation. Deliverable drafting may rely on AI tools whose standard policy excludes any training on your data.
7.1 Post-purchase questionnaires
Answers submitted through our questionnaires (audit, coaching, pre-diagnostic) are encrypted directly in your browser before being sent, using asymmetric encryption (libsodium, sealed box): only a public key is used to encrypt, and the private decryption key exists solely on the personal machines of Olivier Delhomme and Sébastien Beldent — never on the server, never in the receiving mailbox. Your answers are only readable after local decryption by one of the two founders.
8. Your rights
In accordance with PDPA articles 15 to 22, you have the following rights:
Right of access
Obtain confirmation that your data is processed and receive a copy.
Right of rectification
Correct any inaccurate or incomplete data.
Right to erasure
Request deletion of your data ("right to be forgotten").
Right to restriction
Temporarily restrict processing.
Right to object
Object to processing based on legitimate interest.
Right to portability
Receive your data in a structured format, or have it transferred.
Automated decisions
Refuse a purely automated decision concerning you.
Post-mortem instructions
Define the fate of your data after your death.
To exercise your rights, write via the contact form with the subject "PDPA". Reply within 30 days maximum.
You also have the right to lodge a complaint with the Singapore Personal Data Protection Commission (PDPC) (pdpc.gov.sg) or your national data protection authority.
9. Cookies
The site uses only strictly necessary cookies for its operation (language preferences, session). No third-party audience measurement, advertising or social network cookies are dropped without your explicit consent.
You can configure your browser to refuse these cookies, but some features may be degraded as a result.
10. Changes
This policy may evolve to reflect legislative or technical developments. Any change is published on this page with an update to the date below.
Last update: 11 June 2026