Privacy Policy

Last updated: 2 November 2026

Genworx Pte Ltd ("Genworx", "we", "us", "our") respects your personal data. This policy explains what we collect through genworx.sg and our related services, why we collect it, who we share it with, and the rights you have under Singapore's Personal Data Protection Act 2012 (PDPA).

We are the organisation responsible for the personal data described here.

Our details

Genworx Pte Ltd, UEN 201421289Z
7030 Ang Mo Kio Ave 5 #09-30, NORTHSTAR@AMK, Singapore 569880
Data protection contact: privacy@genworx.sg
Telephone: +65 6645 4568

The short version

We collect only what we need to reply to you, run your account, or deliver a service. We do not sell your data, we do not run advertising or analytics trackers, and we do not use your information to build a profile of you. Most of what we hold comes from a form you filled in yourself.

What we collect

When you contact us

If you use our contact form we collect your name, email address, subject and message, along with the time you submitted it.

If you apply to our partner programme we collect your company name, company UEN, contact name, email address, telephone number, the services you are interested in reselling, and your message.

We use this only to respond to your enquiry and to keep a record of the conversation.

When you hold an account

For customers and administrators with a login we store your name, email address, a hashed password, your role, and — if you enable two-factor authentication — an encrypted TOTP secret and hashed recovery codes.

We never store your password in a readable form. Passwords are hashed with bcrypt; two-factor secrets are encrypted at rest with AES-256-GCM.

When you place an order

If you buy through our store we record the email address, order contents, total, currency and a payment reference.

We accept payment by:

PayNow to our UEN, or by bank transfer to our corporate account — you receive the instructions by email after placing the order;
Online card payment through our payment gateway, when enabled.

We do not receive or store your card number. If you pay online, card details are entered on and handled entirely by the payment gateway's own systems. If you pay by PayNow or bank transfer, we receive only the payment reference and the amount — the bank handles the transaction.

Technical information

Our web server processes the IP address of each request. We use it to keep the service secure and available — specifically to rate-limit form submissions and block automated abuse. We do not use it to track you across other websites, and we do not build behavioural profiles.

We do not use advertising cookies, analytics services, social media pixels, session recording, or fingerprinting.

Cookies

We use one cookie: a session cookie that keeps you logged in to the administration area.

Name: __Secure-genworx.session-token
Purpose: authentication only
Contents: a signed token identifying your session — it does not contain your password
Lifetime: your session; removed when you log out or the token expires
Flags: HttpOnly, Secure and SameSite, so it cannot be read by JavaScript or sent cross-site

Visitors who are not logged in receive no cookie from us. There is no cookie banner because there is nothing to consent to beyond a strictly-necessary login cookie.

Why we use your data

We process personal data for these purposes:

To answer your enquiry — responding to a message you sent us.
To provide services you have engaged us for — hosting, managed IT, support, and the administration of your account.
To take payment and keep the accounting records we are required to keep.
To keep our systems secure — detecting and blocking automated abuse, and maintaining audit logs of administrative actions.
To meet legal obligations, including tax and accounting requirements.

Where the PDPA requires consent, we rely on the consent you give when you submit a form or create an account. You may withdraw that consent at any time by writing to privacy@genworx.sg; if you do, we may be unable to continue providing a service that depends on the data concerned.

Who we share it with

We do not sell, rent or trade personal data. We share it only with service providers who help us operate, and only as far as needed:

Our email provider — to deliver notifications and replies.
Our payment gateway — when you pay online by card. They handle card data directly; we never see it.
Our bank — when you pay by PayNow or bank transfer. They process the transfer and we receive only the payment reference and amount.
Cloudflare Turnstile — a bot-protection check on our forms, if enabled. It receives your IP address and challenge response.
Our hosting and infrastructure providers, who process data on our instructions.

These providers are bound to use the data only for the purpose we engaged them for.

We may also disclose data where we are required by law, by a court order, or by a regulator such as IMDA or the PDPC.

Where your data is held. Our website and hosted services run on infrastructure in Singapore. Where a service provider operates outside Singapore, we transfer data only as the PDPA permits, and we require an equivalent standard of protection.

How long we keep it

We keep personal data only as long as we need it:

Enquiries and partner applications — retained while we deal with your enquiry, and for a reasonable period afterwards in case you come back to us.
Account data — for as long as your account exists, and afterwards only as long as needed to close it properly.
Order and invoice records — retained for the period required by Singapore tax and accounting law.
Server and audit logs — kept for a short operational period, then discarded.

When data is no longer needed we delete or anonymise it.

Keeping it secure

We take reasonable technical and organisational measures to protect personal data, including:

encryption in transit (HTTPS/TLS) across the site;
hashed passwords and encrypted secrets at rest;
two-factor authentication available on administrative accounts;
role-based access control, so staff see only what their role requires;
audit logging of administrative actions;
rate limiting and bot protection on public forms.

No system is completely secure. If a data breach occurs that is likely to harm you, we will notify you and the Personal Data Protection Commission as the PDPA requires.

Your rights

Under the PDPA you may:

ask what personal data we hold about you and request a copy;
ask us to correct anything inaccurate or incomplete;
withdraw consent to our use of your data;
ask us to stop sending you marketing communications;
ask us to delete data we no longer have a reason to keep.

Write to privacy@genworx.sg and we will respond within a reasonable time, and in any event within the period the PDPA allows. We may need to verify your identity before acting on a request. We may charge a reasonable fee for an access request where the law permits.

If you are unhappy with how we have handled your data, you may contact the Personal Data Protection Commission at www.pdpc.gov.sg.

Marketing

We do not add you to a mailing list because you contacted us. If we ever send you marketing material, it will be because you asked for it, and every message will include a way to stop receiving it.

Children

Our services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18.

Links to other sites

Our site links to third-party websites, including customer portals and reference material. This policy covers only genworx.sg. Once you follow a link elsewhere, that site's own privacy policy applies.

Changes to this policy

If we change how we handle personal data we will update this page and change the date at the top. Where a change materially affects you, we will take reasonable steps to let you know.

Contact us

Questions about this policy, or about how we handle your data:

privacy@genworx.sg · +65 6645 4568

Genworx Pte Ltd, 7030 Ang Mo Kio Ave 5 #09-30, NORTHSTAR@AMK, Singapore 569880