.svg "growth_fuel_consulting")
Privacy Policy
Last updated: 25 August 2026
Version: 2.0
1. About this notice
Growth Fuel Consulting Pte. Ltd. (UEN 202307909D) (“Growth Fuel”, “we”, “us”, “our”) is a company incorporated in Singapore with its registered office at 68 Circular Road, #02-01, Singapore 049422. We provide consulting, implementation and managed services for business platforms including HubSpot, Asana, Softr and Aircall.
Our services are provided to businesses, not to consumers. The personal data we handle for our own purposes is largely the business contact information of people acting in their professional capacity.
This notice explains how we handle personal data for which we are responsible as an organisation in our own right, in accordance with the Personal Data Protection Act 2012 of Singapore (the “PDPA”). It applies to:
- visitors to growthfuelconsulting.com;
- prospective, current and former clients, and the individuals who work for them;
- individuals who subscribe to our communications or attend our events;
- applicants for employment; and
- our suppliers, partners and their personnel.
1.1 Data we handle on behalf of our clients
Where we are engaged to configure, migrate, integrate or operate a client’s systems, we handle personal data on that client’s instructions and on its behalf. In that capacity we act as a data intermediary under the PDPA. The client, and not Growth Fuel, determines the purposes for which that data is used.
Our handling of such data is governed by our Master Services Agreement and its Data Processing Addendum, and not by this notice. If your personal data is held within a system that we manage for one of our clients and you wish to exercise your rights in respect of it, please contact that organisation directly. If you are unable to identify the organisation concerned, you may contact us using the details in section 2 and we will forward your request to it.
1.2 Related documents
- Master Services Agreement and Data Processing Addendum
- Our Security and Data Protection Overview, describing our security arrangements — available on request from the contact in section 2
2. Contact details
Data Protection Officer: Bryan Cawse Email: legal@growthfuelconsulting.com Telephone: +65 8180 1130
General legal enquiries: legal@growthfuelconsulting.com
Postal address: 68 Circular Road, #02-01, Singapore 049422
3. Personal data we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, job title, employer, business email address, business telephone number, professional profile information |
| Communications | The content of enquiries, correspondence, form submissions, meeting notes and support requests, including attachments |
| Call and meeting records | Recordings, transcripts and summaries of calls and meetings, as described in section 3.3 |
| Website and device data | IP address, browser type and version, operating system, device type, referring and exit pages, pages viewed, time and date stamps, and cookie and similar identifiers. Where you identify yourself through a form, this includes your company’s domain, used to identify the organisation visiting our site, as described in section 3.4 |
| Engagement data | Subscription status and preferences, email opens and clicks, form submissions, content downloads, event attendance and, where lead scoring is in use, lead scores derived from that activity |
| Client relationship | Service Orders, project records, configuration decisions, meeting minutes, deliverables and related correspondence |
| Billing | Billing contact, billing address, purchase order references, and invoice and payment history. We do not collect or store payment card numbers |
| Recruitment | Curriculum vitae, employment history, qualifications, right-to-work information, references and interview notes |
We do not seek to collect sensitive personal data, and we ask that you do not provide such data to us unless we have specifically requested it.
3.1 Sources
We collect personal data:
- directly from you, when you complete a form, contact us, enter into a Service Order, attend an event or apply for a role;
- automatically, through cookies and similar technologies when you use our website, as described in section 6; and
- from third parties, including:
- HubSpot’s Breeze Intelligence enrichment service, which supplements the contact and company records in our CRM with attributes such as name, job title, company, role, seniority, business location and professional profile links, drawn from HubSpot’s commercial dataset;
- Apollo.io, a commercial business contact database from which we source business contact information;
- referral partners, partner directories, and colleagues at your organisation who provide your business contact details.
Enrichment works in both directions: as described in section 7.1, certain data we collect is also contributed to HubSpot’s commercial dataset.
3.2 Where personal data is not provided
Identity and contact data is necessary in order for us to respond to enquiries and to enter into and perform a contract. Where it is not provided, we may be unable to act on your request. Other data is provided at your discretion.
3.3 Recording of calls and meetings
We record and transcribe calls and meetings held in the course of providing our services. Recording is a routine part of how we maintain project records, and is not exceptional.
Participants are notified before recording commences. Any participant may ask that a session is not recorded, or that recording is stopped, and we will comply with that request.
Recordings, transcripts and any summaries generated from them are held within Google Workspace and, where a call is conducted by telephone, within Aircall. Access is restricted to personnel engaged on the relevant matter. Retention is described in section 9. Where we introduce an automated transcription or note-taking service, it will be listed in section 7.1 before we begin using it.
3.4 Identifying visiting organisations (buyer intent)
Our website uses HubSpot’s tracking code, which supports a buyer-intent feature that helps us understand which organisations are visiting our site. The data involved is: your IP address, a visitor identifier, the date and time of the visit, the pages visited and, only where you have identified yourself to us through a form, your company’s email domain.
This data is collected only where you have accepted analytics cookies under section 6. If you decline analytics cookies, it is not collected. The data is processed by HubSpot and is also used by HubSpot as described in section 7.1.
4. Purposes for which we use personal data
| Purpose | Basis under the PDPA |
|---|---|
| Responding to enquiries and preparing proposals | Consent, including deemed consent where personal data is provided voluntarily for that purpose |
| Providing, managing and supporting our services | Consent, and necessity for the performance of a contract |
| Maintaining records of our engagements, including recordings and transcripts | Necessity for the performance of a contract, and the Legitimate Interests Exception |
| Invoicing, collecting payment and managing debt | Necessity for the performance of a contract, and the Legitimate Interests Exception |
| Sending marketing communications about our services | Consent, and compliance with the Do Not Call Provisions in respect of Singapore telephone numbers |
| Understanding which organisations visit our website, and enriching our contact and company records | Consent in respect of analytics cookies, and the Business Improvement Exception |
| Measuring the performance of our website and communications | Consent in respect of non-essential cookies, and the Business Improvement Exception |
| Improving our services, developing new services and understanding client requirements | Business Improvement Exception |
| Protecting our systems and detecting or preventing fraud and misuse | Legitimate Interests Exception |
| Meeting legal, tax, accounting and regulatory obligations, and establishing or defending legal claims | Required or authorised by law, and the Legitimate Interests Exception |
| Recruitment | Consent, and steps taken with a view to entering into an employment relationship |
| Evaluating, negotiating or completing a merger, acquisition or sale of our business or assets | Business Asset Transaction Exception |
Where we rely on your consent, you may withdraw it at any time by contacting our Data Protection Officer. Withdrawal does not affect the lawfulness of anything done before it takes effect. We will inform you of the likely consequences of withdrawal, including where it means we are no longer able to provide a service to you.
5. Marketing
We send communications to business contacts regarding our services, events and published material. Every marketing email includes an unsubscribe link, and you may also opt out at any time by contacting our Data Protection Officer.
Before sending marketing messages to Singapore telephone numbers, we check the Do Not Call Registry maintained by the Personal Data Protection Commission, unless we hold clear and unambiguous consent in evidential form or an applicable exemption applies. This includes telephone numbers obtained from third-party sources such as Apollo.io, which are screened against the Registry before any call or message is made.
Where we use lead scoring to determine which enquiries our team addresses first, it does not produce any legal or similarly significant effect, and a member of our team decides in all cases whether and how contact is made.
6. Cookies and similar technologies
Cookies are small files placed on your device. Our cookie banner uses HubSpot’s consent categories, and no cookie in a consent-required category is set before you give consent.
| Category | Function | Consent required |
|---|---|---|
| Necessary | Maintaining site security and core functionality, and recording your cookie preferences | No |
| Analytics | Identifying which pages are visited, how long visitors remain, and how they arrive, so that we may improve the site. Includes the visitor-identification data described in section 3.4 | Yes |
| Functionality | Remembering choices you make and providing enhanced features, such as live chat | Yes |
| Advertisement | Recognising returning visitors, associating website activity with a contact record, and measuring campaign performance | Yes |
The cookie used by our website chat facility is treated as a necessary cookie where our chat consent setting requires it in order for the chat to function, and otherwise falls within the functionality category.
A banner is presented when you first visit our website, setting out the cookies we use and the choices available to you. You may also block or delete cookies through your browser settings, although parts of the site may not then function as intended.
We do not use cookies to collect sensitive personal data, and we do not use cookies to serve advertising for other organisations. Information collected through the HubSpot tracking code is shared with HubSpot and used by it as described in section 7.1.
7. Disclosure of personal data
We do not sell personal data. As explained in section 7.1, certain data is contributed to HubSpot’s commercial dataset in connection with the enrichment and buyer-intent features we use; we receive no payment for this, and you may object to it as described in section 12.4.
7.1 Service providers
We disclose personal data to service providers that process it on our behalf. These currently are:
| Provider | Purpose |
|---|---|
| HubSpot, Inc. | Customer relationship management, marketing, website hosting and forms; data enrichment (Breeze Intelligence); and identification of visiting organisations (buyer intent) |
| Google LLC | Email, calendar, file storage, collaboration, video meetings and meeting recordings |
| Asana, Inc. | Project and task management |
| Slack Technologies / Salesforce, Inc. | Internal messaging |
| Zapier, Inc. | Workflow automation |
| Aircall SAS | Business telephony and call recording |
| Softr GmbH | Application platform |
| PandaDoc, Inc. | Electronic signature and document execution |
| Cloudflare, Inc. | Network security and secure access to our systems |
| Osome | Accounting, bookkeeping and statutory filings |
| Anthropic, PBC | AI assistant (Claude) used in our internal work and service delivery, under commercial terms with a data processing agreement; not used to train AI models |
Each provider is engaged under written terms requiring it to process personal data in accordance with our instructions and to protect it appropriately.
How HubSpot’s enrichment and buyer-intent features work. These features are contributory. When we use them, the data points involved — for contacts: name, work email, job title, company, role, seniority, business location and professional profile links; for website visits: the visitor-identification data described in section 3.4; and email engagement signals such as delivery, opens and clicks — are added by HubSpot to its commercial dataset and may be used by HubSpot to enrich the records of its other customers. Where any new provider is adopted, including an automated note-taking service, the table above will be updated before that provider begins processing personal data.
7.2 Our personnel
Certain members of our team are located in Malaysia and are engaged through an employer of record. They access personal data held in our systems in the course of providing our services.
The employer of record is engaged under written terms requiring it to comply with applicable data protection laws, to implement and maintain appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or alteration, and to ensure that personnel involved in the processing of personal data are aware of their data protection obligations and bound by appropriate confidentiality obligations.
7.3 Other recipients
We may also disclose personal data to:
- our professional advisers, including lawyers, accountants, auditors and insurers, where required in order to advise us;
- courts, regulators, law enforcement agencies and government bodies, where disclosure is required or authorised by law;
- a prospective or actual purchaser, investor or successor in connection with a merger, acquisition, reorganisation or sale of assets, subject to obligations of confidentiality; and
- any other party at your request or with your consent.
8. Transfers outside Singapore
Several of the service providers listed in section 7.1 host data outside Singapore, principally in the United States and the European Union. Certain of our personnel are located in Malaysia, as described in section 7.2. Personal data may therefore be transferred to, stored in and accessed from those jurisdictions.
Before transferring personal data outside Singapore, we take steps to satisfy ourselves that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that required under the PDPA. In practice this means entering into written data protection terms with each service provider and with the employer of record engaging our overseas personnel, and conducting appropriate due diligence before engagement.
9. Retention of personal data
We retain personal data for as long as it is required for the purpose for which it was collected, or for as long as retention remains necessary for legal or business purposes. In determining the appropriate period we consider the volume and sensitivity of the data, the potential consequences of unauthorised use or disclosure, whether the purpose may be achieved by other means, and any applicable legal, tax, accounting or limitation period requirements.
In practice:
- Business contact information is retained for as long as we maintain, or reasonably expect to maintain, a business relationship.
- Contact records and associated engagement data are reviewed periodically. Records are removed where there is no continuing business relationship and no reasonable prospect of one.
- Records relating to a client engagement, including project documentation, correspondence, recordings and transcripts, are retained for the duration of the relationship and thereafter for as long as they remain relevant to supporting that client or to the establishment or defence of legal claims. As a guide, this is ordinarily up to around six years, reflecting the limitation period for contract claims in Singapore, after which records are reviewed and deleted unless a specific reason to retain them applies.
- Accounting and tax records are retained for the statutory period, being a minimum of five years.
- Recruitment records relating to unsuccessful applications are retained for twelve months.
- Aggregated and anonymised information that does not identify any individual is not personal data and may be retained indefinitely.
10. Security
We make reasonable security arrangements to protect personal data in our possession or under our control against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. These arrangements are appropriate to the nature of the personal data concerned and to the harm that might result from a security breach, and we keep them under review as our business and the threat environment develop. No method of transmission or storage is entirely secure.
Our Security and Data Protection Overview, describing these arrangements, is available on request from our Data Protection Officer.
11. Data breaches
Where a data breach occurs that results in, or is likely to result in, significant harm to affected individuals or that is of significant scale, we will assess it promptly and notify the Personal Data Protection Commission and affected individuals in accordance with the PDPA, and will notify any affected client without undue delay.
12. Your rights
12.1 Rights under the PDPA
You have the right to:
- request access to the personal data we hold about you, together with information about the ways in which it has been used or disclosed in the twelve months preceding your request;
- request correction of personal data that is inaccurate or incomplete; and
- withdraw consent to our collection, use or disclosure of your personal data.
A reasonable fee may be charged in respect of an access request. Where we intend to charge a fee we will inform you of the amount before proceeding, and you may withdraw your request at that point. We aim to respond within fourteen business days. Where we are unable to respond within thirty days, we will inform you within that period of the time by which we expect to respond.
12.2 Individuals outside Singapore
We apply the same standards to all personal data we handle, wherever the individual concerned is located. If you are in a jurisdiction whose law affords you additional rights in respect of your personal data, please contact our Data Protection Officer and we will respond in accordance with applicable law.
12.3 Making a request
Requests should be directed to our Data Protection Officer at legal@growthfuelconsulting.com. In order to protect your personal data, we will take reasonable steps to verify your identity before acting on a request, which may involve requesting further information from you. We do not use NRIC, FIN or passport numbers to verify identity, and we will not ask you to provide them for that purpose.
12.4 Objecting to enrichment
You may ask us not to enrich your contact record. On receiving such a request we will suppress enrichment on your record in our CRM and correct or delete enriched data as you ask. Removal from HubSpot’s own commercial dataset is handled by HubSpot; we will direct you to HubSpot’s opt-out process, and where you exercise it, HubSpot labels our corresponding record so that enrichment does not resume.
13. Automated decision-making
We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.
14. Children
Our website and services are directed at businesses and are not intended for children. Consistent with the Personal Data Protection Commission’s guidelines, we treat anyone aged 18 or younger as a child, and we do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact our Data Protection Officer and we will delete it.
Where we deliver services to clients whose systems contain personal data relating to children, including clients in the education sector, that data is handled on the client’s instructions under our Master Services Agreement and Data Processing Addendum, and not under this notice.
15. Third-party websites
Our website contains links to other websites, including those of our partners. We are not responsible for the privacy practices of those websites and we encourage you to review their notices.
16. Changes to this notice
We may amend this notice from time to time. The current version and its effective date appear at the head of this document. Where an amendment materially affects the way in which we use personal data, we will take reasonable steps to notify affected individuals in advance. Previous versions are available on request.
17. Complaints
If you are dissatisfied with the way in which we have handled your personal data, please contact our Data Protection Officer in the first instance so that we may seek to resolve the matter.
If you remain dissatisfied, you may lodge a complaint with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.