How we handle your personal data.

Last updated: 3 November 2026

1. Who we are

Gerrard & Co is a brand name of Gerrard & Co Consulting Pte. Ltd. (UEN: 202602579D), a company incorporated in Singapore with its registered office at 152 Beach Road, #23-02, Gateway East, Singapore 189721. In this policy, “we”, “us” and “our” refer to Gerrard & Co Consulting Pte. Ltd.

2. What personal data we collect

We collect personal data that you provide to us directly, for example when you use the contact form on this website, email or call us, connect with us on LinkedIn, or engage our services. This may include your name, company, job title, email address, telephone number, and the content of your enquiry or correspondence.

If you become a client, we may also collect personal data about you and your company's officers and staff to the extent needed to perform the engagement, such as identification details required for our own know-your-client checks, and business and financial information you provide to us.

This website does not use advertising or tracking cookies. If we introduce analytics tools, we will update this policy.

3. Why we collect, use and disclose it

We collect, use and disclose personal data for the following purposes:

• to respond to your enquiry and communicate with you;
• to assess whether and how we can assist your business;
• to provide our services, manage the engagement, and bill for it;
• to maintain our business records and comply with our legal, regulatory and professional obligations, including under the PDPA, the Companies Act 1967, and anti-money laundering requirements;
• with your consent, to send you occasional updates about our services or insights that we believe may be of interest; and
• for any other purpose for which you have given consent, or that is permitted or required by law.

4. Consent

By submitting the contact form, or by otherwise providing personal data to us, you consent to our collecting, using and disclosing that data for the purposes set out above. You may withdraw your consent at any time by contacting us using the details in section 10. We will explain the likely consequences of withdrawing consent, which may include being unable to continue to respond to your enquiry or provide services to you. Withdrawal does not affect our right to collect, use and disclose personal data where that is permitted or required under the PDPA or other applicable law.

5. Who we share it with

We do not sell personal data. We may disclose personal data to:

• service providers who process data on our behalf, such as Microsoft (email), Cloudflare (website hosting and contact form processing) and our professional advisers, each of whom is bound by contractual obligations to protect the data;
• your own appointed advisers, auditors, bankers or investors, where you have asked us to work with them;
• regulators, law enforcement and other authorities where required by law; and
• any other party with your consent.

In the course of an engagement, we may access and process personal data held in a client's accounting, banking, payroll and other business systems, and may use productivity and analysis tools, including AI-assisted tools, to carry out our work. We do so only as agreed with the client, under the terms of our engagement letter.

6. Transfers outside Singapore

Some of our service providers, including Microsoft and Cloudflare, store or process data on servers outside Singapore. Where we transfer personal data outside Singapore, we ensure that the recipient is bound by legally enforceable obligations, such as standard contractual clauses or recognised certification, to provide a standard of protection comparable to that under the PDPA.

7. Protection and retention

We protect personal data in our possession or under our control with reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. These include access controls, encrypted storage and transmission where available, and limiting access to those who need it.

We retain personal data only for as long as it is needed for the purposes for which it was collected, or as required by law. Enquiry data that does not lead to an engagement is normally deleted within 12 months. Client engagement records are retained for the period required by our legal and professional obligations, typically not less than five years after the end of the engagement.

8. Accuracy

We take reasonable steps to ensure that personal data we collect is accurate and complete. Please tell us if your details change.

9. Access and correction

You may request access to the personal data we hold about you, information about how we have used or disclosed it in the past year, and correction of any error or omission. We may charge a reasonable fee for access requests, and will tell you in advance if so. We will respond to requests as soon as reasonably possible and in any case within 30 days.

10. Contact and complaints

Questions, requests and complaints about personal data should be directed to our Data Protection Officer:

Data Protection Officer
Gerrard & Co Consulting Pte. Ltd.
152 Beach Road, #23-02, Gateway East, Singapore 189721
Email: privacy@gerrardco.com.sg

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.

11. Changes to this policy

We may update this policy from time to time. The current version is always available on this page, with the date of the last update shown at the top.