Privacy Policy

01About us

MILEO LLP (UEN T26LL0601G) is a Singapore-registered marketing studio. This policy explains what personal data we collect, how we use and protect it, and the choices you have. We follow Singapore's Personal Data Protection Act 2012 (the "PDPA") and other applicable laws.

02Our roles under the PDPA

Depending on the work, Mileo acts either as an organisation or as a data intermediary processing personal data on a client's behalf. When we act as a data intermediary, the client's privacy policy governs your rights and we follow the PDPA obligations that apply to data intermediaries.

03What we collect, and why

Website visitors and enquiries

• Your name, email, company, how you heard about us, and your message, when you fill in our enquiry form. We use these only to reply to you.
• Basic request and server data, including IP address, browser details and requested files, processed by our host and content-delivery providers for security and to deliver the site.
• Website usage data, such as pages viewed, general device and browser information, approximate location, referral source and interactions with enquiry links or forms. Google Analytics 4 is loaded only after you choose “Accept analytics”. It helps us understand which pages are useful and whether the site generates enquiries. We have disabled Google signals and ad-personalisation signals in our site configuration.

Vendors and contractors

• Name, email, phone and bank details, from contracts. We use these to run the working relationship and to pay you.

04Our legal bases

We rely on one of these, depending on the situation:

• Express consent. For example, when you send us an enquiry or accept analytics cookies.
• Deemed consent by conduct (s.15 PDPA). When you hand over data as part of a transaction.
• Deemed consent by notification (s.15A PDPA). When we tell you the purpose and you do not object within a reasonable time.
• Legal obligation. Such as keeping tax and accounting records.

05Third parties and overseas transfers

We use the service providers below to run the site and our work. Some process data outside Singapore. We remain responsible for taking the reasonable steps required by section 26 of the PDPA when personal data is transferred overseas.

We do not sell personal data. We disclose it only for the purposes described here, or where required or permitted by law.

06Cookies and browser storage

Google Analytics 4 is not loaded unless you choose “Accept analytics”. If you accept, it may set first-party analytics cookies to distinguish visits and produce aggregated usage reports. We use this information to improve the site and measure enquiry journeys, not for advertising personalisation.

We save your analytics choice in your browser's local storage until you change it or clear your browser data. Unless you have declined analytics, submitting an enquiry form temporarily saves only a timestamp and form identifier in session storage so the Web3Forms success redirect can be recognised. It does not store your name, contact details or message, and we only treat the marker as valid for 30 minutes.

Use “Analytics settings” in the footer at any time. Choosing “No thanks” prevents future GA4 collection and, if GA4 was active, withdraws analytics consent, removes its first-party _ga and _ga_* cookies and temporary enquiry markers, and reloads the page without the Google tag.

07AI and automated processing

We use AI features inside Klaviyo (predictive analytics) and Meta Advantage+ (campaign optimisation). These can tailor what you see based on how you behave. If this may have a significant effect on you, we will explain the use and handle your personal data in accordance with applicable requirements.

08How long we keep it

• Website enquiries: 2 years from your last contact with us.
• Vendor and contractor records: for the length of the relationship, plus 7 years.
• Financial records: 5 years (Income Tax Act 1947).

09How we protect it

We use safeguards appropriate to each system, including encryption in transit, access controls, multi-factor authentication where the service supports it, and prompt removal of access when a person no longer needs it.

10Your rights

You can ask us to do any of the following, at any time:

We will respond to access and correction requests within 30 calendar days.

11Do Not Call Registry

If we run SMS or telemarketing, we check Singapore's Do Not Call Registry (dnc.gov.sg) before each campaign and will not message registered numbers without clear, specific consent. You can add your number at dnc.gov.sg.

12Data breaches

If a breach is notifiable because it causes significant harm or affects 500 or more people, we will report it to the PDPC within three calendar days of our assessment and notify affected individuals where Part 6A of the PDPA requires it.

13Children

Our site is not aimed at children under 13. If we find that we have collected their data, we will delete it. Anyone aged 13 to 17 can give valid consent if they understand what they are agreeing to, in line with the PDPC's Children's Personal Data Advisory Guidelines (March 2024).

14Contact our DPO

For any question, to access or correct your data, to withdraw consent, or to make a complaint, get in touch with our DPO:

15Updates to this policy

We may update this policy from time to time. If we make a material change, we will let you know by email or with a banner on the site.