How we handle
your personal data.

1. Who we are

Mayne & Loh Pte. Ltd. (“Mayne & Loh”, “we”, “us” or “our”) is a Singapore company providing retail, operations and customer experience consulting. We are responsible for personal data collected through mayneloh.com and handle it in line with Singapore’s Personal Data Protection Act 2012 (PDPA).

This policy covers the public website only. Personal data shared during a paid engagement is also governed by the engagement agreement. Use of the website itself is governed by our Website Terms.

2. What we collect

We collect personal data only when you give it to us, or when your browser sends it automatically as you use the site.

Please do not send passwords, payment card details, identity numbers, customer lists or other sensitive or confidential information through the website. If a project needs that kind of data, we will agree a secure process first.

3. Why we use it

We use personal data to:

• reply to your enquiry and arrange a working session;
• understand your business problem and prepare a proposal, if you ask for one;
• deliver and administer services you have agreed to buy;
• run the AI assistant demonstrations you choose to use;
• send Learning Hub updates, if you have subscribed;
• keep the website secure, working and useful, including understanding which pages visitors find helpful; and
• meet our legal, tax and regulatory obligations.

We do not sell personal data, and we do not use it for purposes you would not reasonably expect from the context in which you gave it.

4. Consent and withdrawal

By submitting a form, contacting us or using an AI assistant, you consent to us collecting, using and disclosing your personal data for the purposes in section 3 that relate to what you did.

You may withdraw consent at any time by contacting us (section 12). We will stop the relevant use within a reasonable time and tell you what that means, for example that we can no longer continue a conversation about a proposal. Withdrawal does not affect use that took place before it, or uses the law requires or permits without consent.

5. AI assistants and voice

The AI assistants on this site (Annie, Mawar, Matt and Harvey) are software demonstrations, not people. When you use them:

• your typed messages are sent to AI model providers to generate a reply;
• if you use voice, your audio is processed by a voice provider to convert speech to text and text to speech;
• conversation content may be logged so we can review enquiries and improve the demonstrations; and
• if a conversation becomes an enquiry, we may continue it with you directly.

Replies may be inaccurate. Do not rely on them for a consequential decision, and do not share confidential or sensitive information. Richard handles every strategic conversation personally.

6. Who else handles it

We use trusted service providers to run the website and our business. They process personal data on our behalf and only for the services they provide to us. They currently include providers of:

• website hosting and content management (WordPress);
• network delivery and security (Cloudflare);
• AI model and voice services (including ElevenLabs) for the AI assistants;
• email and newsletter delivery (Brevo);
• website analytics;
• messaging (WhatsApp, operated by Meta); and
• email, file storage and productivity tools we use to run the business.

We may also disclose personal data to professional advisers, or where the law requires it, for example to a regulator or court. If Mayne & Loh is restructured or sold, personal data may pass to the new owner under the same protections.

7. Transfers outside Singapore

Several of our providers store or process data outside Singapore, including in the United States and the European Union. Where we transfer personal data overseas, we take steps to ensure it receives a standard of protection comparable to the PDPA, for example through the provider’s contractual commitments and security certifications.

8. Cookies and analytics

The website uses cookies and similar technologies that are needed for it to work, and analytics that help us understand how visitors use the site in aggregate. Analytics data is not used to identify you personally.

You can block or delete cookies in your browser settings. Some features, such as the AI assistants, may not work properly without them.

9. Marketing messages

We send marketing emails only to people who have subscribed, and every email includes a way to unsubscribe. We will not send marketing messages to a Singapore telephone number by call, SMS or WhatsApp unless you have given clear consent, in line with the Do Not Call provisions of the PDPA.

10. Protection and retention

We use reasonable security arrangements to protect personal data, including access controls on our accounts, encrypted connections and reputable providers. No system is completely secure, so we cannot guarantee absolute security.

We keep personal data only as long as it serves the purpose it was collected for, or as the law requires. As a guide, enquiries that do not become engagements are deleted or anonymised within 24 months of our last contact, and engagement records are kept for up to 7 years for tax and legal reasons.

If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commission and affected individuals as the PDPA requires.

11. Access and correction

You may ask us:

• what personal data we hold about you, and how it has been used or disclosed in the past year; and
• to correct personal data that is inaccurate or incomplete.

Send your request to our Data Protection Officer (section 12). We may need to verify your identity first. We aim to respond within 30 days, and will tell you if we need longer. We may charge a reasonable fee for an access request, and will tell you the amount before proceeding.

12. Contact and complaints

For any question, request or complaint about personal data, contact our Data Protection Officer:

If you are not satisfied with our response, you may contact the Personal Data Protection Commission.

13. Changes to this policy

We will update this policy when our website, services, providers or legal obligations change. The current version is always published at this address, with its “last updated” date shown at the top.