Privacy
Policy
1. Terms Of Use Governing Electronic Services
A. RECITAL
- This Terms of Use Governing Electronic Services explains the terms and conditions that apply when you use any Electronic Services (as defined below) that may be provided by us.
- This Agreement will replace all previous terms and conditions relating to the provision of Electronic Services. Nothing in this Agreement will supersede or vary any term set out in other terms and conditions governing our relationship with you. This is especially so when you enter into separate agreements with us for the provision of Products & Services. The terms laid down therein shall apply.
- When you use any of our Electronic Services described in this Agreement, or authorise others to use them, you acknowledge and agree to the entire terms and conditions of this Agreement which forms the basis and entirety of the agreement between you and us.
B. DEFINITIONS
- The following terms shall bear the meanings set out in the table below:-
| Account | means any and all accounts which is accessed by you through Electronic Services and shall include any Account that you may be required to create for the access to any Products & Services. |
| Authorised User | means any person(s) authorised by you or your joint account holder from time to time to use the Electronic Services in relation to your Account. |
| Channel | means any mode of access to our Electronic Services and shall include any Content. |
| Electronic Instructions | means any electronic instructions, communications, instructions, orders, messages, data, information or other materials received by us through Electronic Services, which we reasonably believe come from you or your Authorised User. For the avoidance of doubt, we are under no obligations to verify the veracity and/or authenticity of such Electronic Instructions. |
| Electronic Services | means any services that we may offer to you from time to time via electronic means, including any modification thereof made by us (the scope and nature of which shall be determined at our sole discretion). They may include screening of wallet or transaction addresses, purchase, sale, subscription and/or redemption of any Products or the use of any other Services offered by us whether in or outside Singapore. |
| Electronic Transaction | means any transactions initiated or effected from your Account through Electronic Services. |
| Information | means information regarding the money or other relevant particulars relating to you, or any Authorised User, or the Account or any Electronic Instructions. |
| Provider | include:- (1) any person (individual or non-individual) in Singapore or otherwise, which offer services or products, directly or indirectly through the Electronic Services; (2) any person (legal or natural) to whom we outsource certain functions or activities to allow us to operate our Electronic Services; (2) any government, regulator, law enforcement agency, financial institution, and ancillary service provider (for example, telecommunication, internet access, cloud network, logistics, facilities management, data centres, system hosting, call centres, equipment and software providers), agent or subcontractor involved in our provision of Electronic Services; and (4) our agents or storage or archival service providers for the purpose of making, printing, recording, mailing, storage, and/or filing any documents or items on which such Information appear. |
| Security Codes | means personal identification numbers, passwords, personal identifiers, biometrics identifiers, digital identifiers, other codes and verification procedures whether set by you or us that would allow you access to our Electronic Services. |
| “We”, “Us”, “Our” and “Ours” | means Alpha Ladder Finance and/or its Affiliates, including their successors and assignees, as the case may be. |
| “Affiliates” | means any related entities to Alpha Ladder Finance Pte. Ltd. (“Alpha Ladder Finance”) and may include but are not limited to its parent, sister and/or holding company. |
| “Agreement” | shall mean these Terms and Conditions Governing Electronic Services. |
| “CAMP” | shall mean an online client asset management platform owned and operated by us. |
| “Content” | shall mean to any information, images, links, sounds, graphics, videos, software or other materials including quotes, news and research data that are available through our Electronic Services. |
| “Products & Services” | shall include but are not limited to any services or products offered through Alpha Ladder Finance. |
| “You”, “Your” or “Yours” | shall mean everyone named on your Account, together, individually and includes you and/or any of your Authorised User as the case may be. |
C. AUTHORIZED USER & USE
- Your use and access to our Electronic Services shall be subject to this Agreement. You shall be wholly responsible for all transactions made by you or, from our view, authorized by you, your Authorised User. We shall not have any responsibility to take any further steps to authenticate and/or determine the veracity of any Electronic Instructions issued through the Electronic Services.
- If your Authorised User accesses and/or uses our Electronic Services, we will deal with that person as if it was you using our Electronic Services and you shall ensure that each of your Authorised User is aware of and complies with this Agreement.
- In the event that you have authorised any person to give us Electronic Instructions on your behalf, you will be responsible for their acts and/or omissions, including any and all losses and/or damage arising from Electronic Payment which they may undertake. For the avoidance of doubt, such losses and/or damage shall also include any loss and/or damage that may be incurred as a result of any unauthorized, erroneous, or fraudulent Electronic Instructions issued by such person, whether or not such instructions were made with your knowledge or consent. You acknowledge and agree that we shall not be liable for any such losses and/or damages, except to the extent that they arise directly from our gross negligence, fraud, or willful misconduct.
Furthermore, you shall indemnify and hold us harmless against any claims, liabilities, costs, or expenses (including legal fees) that may arise from the actions or omissions of any person whom you have authorized to issue Electronic Instructions on your behalf.
- We shall have the right to decline to proceed with any Electronic Instructions in the event that:-
- your Electronic Instructions are unclear, incomplete or inconsistent with other Electronic Instructions issued to us by you or Authorised User;
- the Electronic Instructions have lapsed, been rendered invalid due to failure to comply with applicable conditions or are cancelled by a regulatory or governmental body;
- the Electronic Instructions cannot be processed due to any disruptions that are beyond our reasonable control;
- processing the Electronic Instructions might expose us to legal action or censure from any government, regulator or law enforcement agency;
- any Electronic Instructions would cause you to exceed your applicable transaction or Account limits; and/or
- any Electronic Instructions would result in insufficiency of funds in your Account; without incurring any responsibility for loss, liability or expense arising out of so declining to act.
- We will treat all Electronic Instructions as final and unconditional when we receive them through the Electronic Services. This means we shall be entitled (but not obliged or obligated) to effect such Electronic Instructions without any need to seek your further consent and notice to you.
D. ACCESS TO ELECTRONIC SERVICES
- We may make Electronic Services available through different devices (for example, personal computers or mobile devices). The features of Electronic Services may vary and the access and features may differ depending on the type, system specifications and configuration of your device. To protect your Account, we may require a certain standard of specification, software version and such other technical requirements of your device used to access our Electronic Services.
- If you access Electronic Services outside of Singapore, your access may be limited and subject to the relevant laws and regulations of that country. We will not be responsible for any fees, charges and expenses or any other charges which may be imposed by your telecommunication or other service providers in connection with the use of Electronic Services.
- There may be circumstances where we may need to change the frequency and manner of use of our Electronic Services, transaction limits, operating hours and types of facilities and services. In certain situations, we may have to suspend the Electronic Services without giving you prior notice. Under such circumstances, we shall not be responsible for any inconvenience, loss, damage or injury suffered by you or any third party.
E. AUTHENTICATION SERVICE
- From time to time, we may introduce new or different forms of authentication service for you and/or your Authorized User’s authentication when you use our Electronic Services. We may replace the authentication service from time to time without prior notice to you.
F. RESPONSIBLE USE OF OUR ELECTRONIC SERVICES
- You shall ensure that the use our Electronic Services in accordance with all applicable laws, regulations, guidelines and within our reasonable expectations. You shall not use our Electronic Services for any purposes which are not authorised by us, wrongful and/or illegal purposes. In particular, you may not use our Electronic Services for the harvesting or extraction of any data. Where we are aware of any misuse of our Electronic Services by you and/or your Authorised User, we reserve the right to terminate or suspend our provision of Electronic Services to you immediately without any prior notice. In such instances, we shall not be liable for any loss suffered by you or any third party as a result of such termination or suspension.
- Where you or your Authorised User has misused our Electronic Services and caused loss and damage to you and/or any third party, you agree and undertake to fully indemnify us, our Affiliates, Providers and sub-contractors for such loss and damage suffered and shall pay such monies to us upon our demand.
G. RIGHT OF SET OFF
- Unless otherwise stipulated, we may set-off from your Accounts with us any fees, Goods and Services Tax (“GST”), loss, damage or expense suffered by us, as a result of our provision and/or your use of our Electronic Services. This means if you have not paid back the money you owe us under this Agreement or any other agreements that you may have entered with us for the use of our Products & Services, we may use the money in any of your accounts with us to partially or fully repay the money you owe. You agree that such exercise of our right of set off shall not require any further notice.
H. SECURITY & AUTHENTICATION
- For security and authentication purposes, you may be required to create Security Codes in connection with your Accounts and/or Electronic Instructions. You are advised to ensure that your Security Codes and email accounts are sufficiently secure and not easily compromised.
- To ensure that your Account is protected, you agree to:-
- notify us immediately if you change your mobile number or email/mailing address which are used to generate and/or receive any Security Codes;
- notify us immediately if you have lost any of your Security Codes or your device used to generate and/or receive Security Codes or email addresses have been compromised;
- to tell us immediately if any Authorised User to whom the Security Code is given is no longer authorised to use the Electronic Services;
- not disclose your Security Codes to any third party;
- to ensure that your Security Codes are kept in a secure manner and not accessible by any third party;
- to take due care of the devices that you use to generate or receive Security Codes, access online banking and email addresses and ensure that they are not vulnerable to unauthorised access;
- not to use any equipment, device, software or email address which you know or have reason to suspect contains any viruses, malicious code or damaging components which may interfere with or compromise your use of the Electronic Services; and/or
- not to install, or cause to be installed (for example clicking on suspicious links), any malware or viruses that would result in your devices, email addresses or Security Codes being compromised by any third party.
- If you discover or suspect any unauthorised or erroneous transactions from or to your Account, you must notify us immediately. Upon such discovery, you agree to take such steps to protect your Account, including changing any Security Codes, passwords to your email accounts and reporting such incidents to us immediately.
- Where we are of the view that your Account or your Security Codes might have been compromised, in order to protect your Account, we may:-
- require that you identify yourself by alternative means;
- require any Electronic Instruction to be confirmed through alternative means (in writing given in person at a branch, etc.); and/or
- refrain from acting promptly upon any Electronic Instructions in order to confirm any Electronic Instructions or your identity.
In such circumstances, your Electronic Instructions might not be processed within expected periods and we will not be responsible for any inconvenience, loss, damage or injury suffered by you or any third party.
- In respect of unauthorised or erroneous transactions from your Account, we shall do our best to help you, but we may not always be able to reverse such transactions. To assist us in our investigations and recovery efforts, we may:-
- request that you report unauthorised or erroneous transactions to the relevant law enforcement and/or regulatory authorities and provide us with such report; and/or
- require information relating to such unauthorised or erroneous transactions, including how such transactions occurred; and/or
- require you to report to relevant law enforcement and/or regulatory authorities as the case for any necessary directions and/or assistance.
If you are unable to or decline to provide the requested information above, this would have a negative impact on our recovery efforts.
- Where such erroneous or unauthorised transactions were a result of your authorisation (whether as a result of fraud or otherwise), recklessness or mistake, we will not be liable to you for such losses. Recklessness would include any failure by you to comply with this Agreement.
- In respect of unauthorised or erroneous transactions to your Account, where we are satisfied that such credited sums to your Account was in fact unauthorised or erroneous (including any mistake made by us), we have the right to deduct such sums from your Account without your prior consent. We shall however notify you of such deduction.
- We shall retain the right to decline providing you with any Electronic Services where we have reasons to believe that you do not intend to use our Electronic Services responsibly. In this case, we shall not be obligated to provide you with any reasons whatsoever for such refusal to provide.
I. WARRANTIES, DISCLAIMER AND LIMITATIONS
- We do not provide warranty of any kind of:-
- our Electronic Services, including warranties of accessibility, quality, provision or performance of any goods or services;
- our Content, including warranties of accuracy, adequacy, currency or reliability;
- our hyperlinks to any other websites or content, if any, which are not an endorsement or verification of such websites or content.
- We will not be responsible for any loss suffered by you arising from or in connection with your use of Electronic Services even if we are advised of, or otherwise might have anticipated, the possibility of such loss, damage or expense. In particular, we will not be liable to you for any loss as a result of:-
- any Electronic Services not being available due to system maintenance or breakdown/non-availability of any network;
- the non-delivery, delayed delivery, misdirected delivery or the non-receipt of any Electronic Services.
- any non-processing or delay in processing of Electronic Instructions by us or by any Provider through whom your Electronic Instructions are transacted;
- inaccurate or incomplete Content, reliance on or use of the information provided on any Channel for any purpose;
- any disclosure of any Information which you have consented to us collecting, using or disclosing or where such collection, use or disclosure is allowed under the applicable laws in Singapore;
- any unauthorised and/or unlawful access to our machines, data processing system or transmission link;
- any act of force majeure such as acts of God, war or warlike hostilities, civil commotions, riots, blockades, embargoes, sabotage, strikes, lock-outs, fire, flood, shortage of material or labour, delay in deliveries from sub-contractors; and/or
- any event outside our control.
J. OUR RECORDS
- Our records and any records of the Electronic Instructions including Electronic Services operations maintained by us or by any relevant person authorised by us shall be binding and conclusive on you for all purposes whatsoever. They shall be final and conclusive evidence of any Electronic Instructions, information and/or data transmitted using Electronic Services.
- When we deal with you, we will treat all such records as final evidence and you shall not challenge or dispute the admissibility, reliability, accuracy or the authenticity of the contents of such records merely on the basis that such records were incorporated and/or set out in electronic form or are produced by or were the output of a computer system. You agree to waive any of your rights (if any) to so object. This provision shall also apply to all records maintained by a Provider designated by us.
K. FEES
- We may charge and revise fees for our services (for example, processing and transaction fees relating to our Electronic Services). In most cases, we shall endeavor to notify you in advance of such changes before they become effective, unless it is not practicable to give such advance notice.
- For certain Electronic Services, we may share fees, brokerages, commissions and other charges with our Provider. We are not required to account to you for all or any part of these sums.
- If GST is charged on any payment, you shall pay such GST in addition to all sums payable. You agree to indemnify us against any payments that we are required by law to collect and make in respect of such GST.
L. TERMINATION
- We may stop or suspend any of our Electronic Services immediately without giving any reason. This includes limiting or replacing the Electronic Services as we may tell you from time to time.
- If we need to end this agreement (and close your Accounts linked to our Electronic Services), we may do so at any time without giving any reason or advance notice to you. We shall notify you as soon as practicable by any notification method, including through Electronic Services, local newspapers, displays at our branches or media publications. Such termination shall be effective on and from the date specified in the notice.
- Unless notified by us in writing and/or otherwise provided in the agreements for relevant Products & Services, you may terminate your use of any Electronic Services by giving us seven (7) days advance written notice. Terminating your use of the Electronic Services shall not affect any rights or obligations accrued before the effective termination date.
M. INTELLECTUAL PROPERTY
- Without our prior written consent, no part or parts of the Channel or the Electronic Service or any Content may be reproduced, distributed, republished, displayed, broadcast, hyperlinked, transmitted, adapted, modified to create derivative works or otherwise commercially exploited in any manner or by any means or stored in an information retrieval system.
- You shall be permitted to view, print or use the Content for personal, non-commercial use only, provided that you do not modify the Content and that you retain all copyright notices and other proprietary notices contained in the Content.
- Trademarks, service marks, and logos (the “Trade Marks”) used and displayed on or through the Channel or the Electronic Services are registered and unregistered Trade Marks of ours and others. You agree not to use any Trade Marks displayed on or through the Channel or the Electronic Service, without our written permission.
N. USE OF THIRD PARTIES
- We reserve the right to use any Provider, subcontractors and/or agents on such terms as we deem appropriate.
O. OTHER TERMS
- This Agreement shall be governed by Singapore law and shall be subject to the exclusive jurisdiction of the Singapore courts.
- No failure to exercise, nor any delay in exercising, on our part any right or remedy under this Agreement will operate as a waiver thereof, nor shall any single or partial exercise of any right or remedy prevent any further or other exercise thereof or the exercise of any other right or remedy. Our rights and remedies in this Agreement are cumulative and not exclusive of any other rights or remedies provided by law.
- If any term of this Agreement is unlawful or unenforceable under any applicable law, it will, to the extent permitted by such law, be severed from this Agreement and rendered ineffective where possible without modifying the other terms of this Agreement.
- In the event of any contradiction or inconsistencies with other terms, this Agreement shall prevail in respect of your use of Electronic Services and resolution of any disputes or issues arising out of your use of our Electronic Services. Where the dispute or issues relates to your Accounts or terms pertaining to the use or provision of the Products & Services, the terms in those agreements executed between us and you shall prevail.
2. Privacy Policy
Applies to: All public‑facing websites, subdomains, application programming interfaces (APIs), mobile applications, and online services operated by the Alpha Ladder Group.
Effective date: 22 September 2025
Last updated: 22 September 2025
A. PARTIES AND ROLES
- For this Policy, Alpha Ladder Group means, individually and collectively, Alpha Ladder Finance Pte. Ltd., MetaComp Pte. Ltd., Asia Green Fund Management Pte. Ltd., and such related entities as we may designate from time to time (“Alpha Ladder,” “we,” “us,” or “our”). Unless stated otherwise, an Alpha Ladder entity acts as organisation/controller for the processing described herein. Where a third party processes Personal Data on our behalf, it acts as a data intermediary/processor. In limited integrations, we and a partner may act as joint controllers with delineated responsibilities memorialised by contract.
- Registered offices and governance. Each Alpha Ladder entity is incorporated under the laws of its place of incorporation and maintains corporate records, board‑approved privacy standards, and a designated Data Protection Officer.
- Processor management. We appoint processors only where they provide sufficient guarantees of technical and organisational measures. Sub‑processors may be engaged subject to contractual controls, transparency, and objection mechanisms where applicable.
- Role changes. Where our role changes (for example, from processor to controller for a specific feature), we will update this Policy or issue a service‑specific notice.
B. SCOPE, CONSTRUCTION, AND RELATIONSHIP TO OTHER TERMS
- This Policy governs how we collect, use, disclose, transfer, and protect Personal Data when you access or use our websites, applications, and services (the “Platform”). It operates alongside our Terms of Use, Cookies Policy, and any service‑specific notices. Where a service‑specific notice imposes stricter or more protective terms, that notice prevails for the covered feature. Capitalised terms not defined here have the meanings given in the applicable service terms.
- This Policy applies whether you access the Platform directly or via third‑party interfaces, and whether data are collected online or, where relevant to Platform operations, through offline interactions that are later digitised.
- Headings are for convenience and do not affect interpretation. References to statutes include amendments and re‑enactments.
- In the event of conflict, statutory notices required by local law for a specific audience prevail for that audience.
C. DEFINITIONS
| Personal Data (PDPA, Singapore) | : | data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access |
| Processing | : | any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, erasure, or destruction. |
| Organisation/Controller and Data Intermediary/Processor | : | the party that determines purposes and means of processing, and the party that processes on behalf of the controller, respectively. |
| Business contact information | : | name, title, business telephone, business address, or business email used solely for business communications; treated per PDPA exemptions where applicable. |
| Pseudonymisation/Anonymisation | : | techniques that reduce or remove identifiability. Data that is irreversibly anonymised falls outside this Policy. |
| Deemed consent (by conduct/notification) | : | consent inferred under the PDPA where prescribed conditions are met, including adequate notice and opportunity to opt out. |
| Legitimate interests exception | : | limited PDPA basis for processing where benefits to the public or to us outweigh adverse effects on the individual, with safeguards |
| Notifiable data breach | : | a breach that results in, or is likely to result in, significant harm to affected individuals or affects a significant scale of individuals. |
D. DATA WE PROCESS
- We process Personal Data to the extent permitted by law and necessary for the purposes set out in §6. The categories below are illustrative and may vary by product:-
- Identification and contact: name, address, email, telephone, nationality, date of birth, and—where required—limited identifiers (e.g., masked passport; NRIC/FIN last three digits and letter).
- Account and profile: username, roles, preferences, security credentials, support history, audit trails for account changes.
- KYC/AML/CFT: sanctions screening outcomes, risk ratings, beneficial ownership data, politically exposed person (PEP) flags, source‑of‑funds/source‑of‑wealth artefacts (only where required by law or prudent for risk management).
- Transaction: orders, subscriptions, redemptions, payments, wallet addresses, timestamps, amounts, counterparties, settlement instructions, and reconciliation logs.
- Technical and usage: IP address, device and browser identifiers, operating system, language settings, referrers, page interactions, performance metrics, error logs, event telemetry, and security signals.
- Communications and marketing: consent states, opt‑out preferences, campaign interactions, survey responses, support tickets and call recordings where lawful.
- Regulatory and compliance records: filings, consents, attestations, and audit artefacts linked to Platform use.
- Open‑source and public data: information from publicly available sources for verification or risk assessment, subject to law.
- Sensitive inferences. We do not intentionally infer sensitive attributes (e.g., health, religious beliefs) from Platform use. If such inferences would arise incidentally, we apply minimisation and suppressive controls.
E. COLLECTION PATHS
- Direct: registration, forms, onboarding, support, identity verification, and other user‑initiated interactions.
- Automatic: cookies, local storage, SDKs, beacons, and server logs (see Cookies Policy).
- Third‑party: business partners, payment and identity providers, professional advisers, analytics vendors, and competent authorties where lawful.
- Derived: internal analytics that derive usage patterns or risk scores from raw telemetry under strict access and purpose controls.
- Combined sources. Where we combine data from multiple sources, we do so to the minimum extent necessary for the stated purpose and apply additional controls when linkage could increase risk.
F. PURPOSES AND LEGAL BASES UNDER THE PDPA
- We process Personal Data only for specified purposes and in reliance on recognised bases under Singapore’s Personal Data Protection Act 2012 (PDPA) and attendant regulations. Illustrative mappings follow:-
- Service delivery and operations — account creation, feature enablement, troubleshooting, and support. Basis: consent or deemed consent (by conduct or contractual necessity), as appropriate.
- Compliance and risk management — KYC/AML/CFT checks, sanctions screening, fraud detection, audit and record‑keeping, regulatory filings. Basis: compliance with law; PDPA exceptions.
- Security and integrity — authentication, access control, monitoring, incident response, resilience engineering, and service continuity. Basis: legitimate interests exception or deemed consent, subject to safeguards.
- Improvement and analytics — usage measurement, product research, quality assurance, experiment management, and error diagnostics. Basis: consent for non‑essential analytics; or legitimate interests exception with balancing and transparency.
- Communications — transactional notices, service announcements, policy updates. Basis: deemed consent/contractual necessity; or consent where required.
- Marketing (optional) — information about products or services similar to those you use. Basis: consent where required; opt‑out always available. We comply with Do Not Call (DNC) obligations for voice/SMS/MMS where applicable.
- Corporate transactions — mergers, acquisitions, financing, restructuring, or asset transfers, subject to confidentiality. Basis: PDPA business asset transaction exception and other applicable bases.
- Legal obligations and claims — responses to lawful requests; enforcement of terms; protection of rights, safety, and property. Basis: compliance with law and PDPA exceptions.
- We invoke deemed consent by notification and the legitimate interests exception only after assessing residual risks and implementing proportionate safeguards and transparency, consistent with PDPA requirements.
- If we subsequently contemplate a purpose incompatible with the original one, we will seek fresh consent or apply another valid basis permitted by law after notifying you where required.
- Declining consent. If you decline non‑essential cookies or marketing, core functions continue to operate but certain features may be unavailable.
G. COOKIES AND SIMILAR TECHNOLOGIES
- We use cookies and analogous technologies to operate the Platform, remember preferences, enhance security, and—where permitted—perform analytics and measure campaigns. Controls are described in our Cookies Policy and on‑site consent tools.
- Where recognised by law, we treat Global Privacy Control (GPC) signals as an opt‑out of sale/sharing for targeted advertising to the extent technically feasible. Do Not Track signals are not standardised and may not be honoured.
- Mobile identifiers. Where our mobile apps use advertising or analytics identifiers, your device OS provides additional controls to reset or limit tracking.
H. DISCLOSURES AND RECIPIENT CATEGORIES
- We disclose Personal Data on a need‑to‑know basis with appropriate safeguards to:-
- Alpha Ladder Group entities for group operations and shared services;
- Service providers and professional advisers for hosting, storage, IT, support, payments, identity verification, analytics, marketing (where enabled), and compliance tooling;
- Business counterparties in connection with corporate transactions, subject to contractual confidentiality;
- Credit reference agencies for credit assessments where required;
- Regulators, courts, and public authorities to comply with law or enforce rights; and
- Other parties where you have instructed or consented to disclosure.
- Processor obligations. Processors act on our documented instructions, implement security measures, restrict sub‑processing without approval, assist with data subject requests and breach notifications, and return or delete data on termination.
- Emergency disclosures. We may disclose limited information to address an imminent threat to life or safety, consistent with law.
I. CROSS‑BORDER TRANSFERS
- We operate globally. When Personal Data is transferred outside Singapore, we comply with the PDPA Transfer Limitation Obligation by ensuring a standard of protection comparable to that under the PDPA, including through contractual protections, intra‑group rules, or recognised certifications. Where such measures are infeasible, transfers proceed only if a PDPA exception applies (e.g., vital interests, performance of a contract, or explicit consent after notice of risks).
- Typical safeguards include contractual clauses with audit rights, encryption in transit and at rest, access segregation, and incident reporting commitments.
- Localisation constraints. If a jurisdiction mandates local storage for specific records, we comply by using approved regional facilities while maintaining global oversight.
J. SECURITY, RETENTION, AND ACCURACY
- Security: We apply administrative, technical, and physical safeguards proportionate to risk, including encryption in transit, multi‑factor authentication for internal systems, role‑based access controls, network segmentation, secure development practices, security training, and periodic access reviews. We maintain incident response procedures and, where a notifiable data breach occurs, notify the PDPC and affected individuals as required by law. No method of transmission or storage is perfectly secure; residual risk cannot be reduced to zero.
- Retention: We retain Personal Data only as long as necessary for the purposes in §6 or to meet legal and regulatory obligations (e.g., anti‑money‑laundering record‑keeping). We maintain and periodically review retention schedules, apply legal holds when required, and securely dispose of data that no longer requires retention.
- Accuracy: We take reasonable steps to ensure Personal Data is accurate and complete, having regard to its purpose. Please keep your information current and notify us of changes. We may request documentation to validate corrections where appropriate.
- Backups and logs: Backup sets and security logs may persist for longer periods to support continuity and forensic analysis, subject to access and encryption controls.
K. YOUR RIGHTS AND CHOICES
- Subject to law, you may: (i) access your Personal Data and obtain information about our processing; (ii) correct inaccurate or incomplete Personal Data; (iii) withdraw consent where processing relies on consent (without affecting processing prior to withdrawal); and (iv) opt out of direct marketing at any time using in‑message links or by contacting us. You may also raise a concern or complaint with the Personal Data Protection Commission (PDPC) or your local authority. We request that you contact us first so we can address your concerns.
- Process and timelines. To exercise these rights, contact our Data Protection Officer using the details in §17. We may request information to verify identity and locate data. Where permitted, we may charge a reasonable fee for access requests. We target a response within thirty (30) calendar days or will inform you if more time is reasonably required.
- We may decline requests that would adversely affect the privacy of others, reveal confidential business information, or conflict with legal obligations. Where we decline a request, we will provide reasons unless prohibited by law.
L. AUTOMATED DECISION‑MAKING
- We do not rely on solely automated decisions that produce legal or similarly significant effects without human oversight. Where automated scoring or risk detection is used (e.g., fraud controls), it is limited to the minimum necessary, governed by documented testing and periodic review, and supplemented by avenues for human reconsideration.
M. CHILDREN
- The Platform is not directed to children. We do not knowingly collect Personal Data from children contrary to law. If you believe a child has provided Personal Data to us, contact us so we can act appropriately, including deletion where required.
N. EXTERNAL WEBSITES
- The Platform may contain links to third‑party sites. Those sites are governed by their own privacy policies. We are not responsible for their practices; review their policies before use.
O. GOVERNANCE AND ACCOUNTABILITY
- We maintain records of processing, implement privacy‑by‑design practices, and require data‑protection terms with processors. Where a deployment materially elevates risk, we conduct an internal risk assessment and, where appropriate, a privacy impact assessment, and document commensurate controls.
- Training and oversight. Personnel with access to Personal Data receive role‑appropriate training. Access is granted on a least‑privilege basis and reviewed periodically.
- Vendor due diligence. We evaluate suppliers’ security and privacy posture during onboarding and at intervals thereafter.
- Audit and assurance. We may commission independent reviews of our controls and require analogous assurance from key processors.
P. CHANGES TO THIS POLICY
- We may update this Policy to reflect changes in law, technology, or our practices. Material changes will be signposted on the Platform. The Last updated date above indicates the latest revision. Continued use after changes take effect signifies acknowledgement of the updated Policy.
Q. Contact
Data Protection Officer (DPO)
Alpha Ladder Group
Email: dpo@alphaladder.com
For questions, concerns, or requests regarding this Policy or our handling of Personal Data, contact the DPO. We will respond in accordance with applicable law.
3. Cookies Policy
Applies to: All public‑facing websites, subdomains, and networked services operated by the Alpha Ladder Group.
Effective date: 22 September 2025
Last updated: 22 September 2025
A. INTRODUCTION
- This Cookies Policy (the “Policy”) sets out a comprehensive governance framework for our deployment of cookies and cognate tracking technologies across Alpha Ladder Group web properties. It articulates the taxonomy of technologies in scope, the purposes for which they are utilised, the legal bases we rely upon across key jurisdictions, and the mechanisms by which users may exercise agency over such technologies.
- For definitional clarity, Alpha Ladder Group includes, without limitation, Alpha Ladder Finance Pte. Ltd., MetaComp Pte. Ltd., and Asia Green Fund Management Pte. Ltd. References to “we,” “us,” or “our” denote one or more of these entities acting individually or collectively, as context requires.
- This Policy operates in concert with our Privacy Policy, which governs the processing of personal data that may be derived from or associated with cookie‑originating information.
B. DEFINITIONS
| Term | Meaning |
| Cookie | A text token placed on a user device by a web server that enables persistent or session‑scoped state management, including re‑identification of a browser instance across requests. |
| Session cookie | A transient token that expires upon termination of the browser session. |
| Persistent cookie | A token with a pre‑defined expiry that remains stored on the device until deleted or until expiry, whichever occurs first. |
| First‑party cookie | Set by the top‑level domain currently visited. |
| Third‑party cookie | Set by a non‑top‑level domain embedded within the visited page (e.g., analytics or advertising networks). |
| Similar technologies | Functionally analogous instruments such as local storage, IndexedDB, software development kits (SDKs), tracking pixels/web beacons, and device fingerprinting techniques. |
| Consent Management Platform (“CMP”) | The on‑site interface that records, stores, and signals a user’s consent state and preference granularity for non‑essential categories. |
| GPC signal | A Global Privacy Control browser signal indicating the user’s opt‑out preference for certain downstream data sharing or targeted advertising where recognised by law. |
C. SCOPE
- This Policy applies to all Alpha Ladder Group websites, microsites, and web services that reference it.
- Where a specific product introduces additional cookie categories or non‑standard processing, a product‑specific addendum may supplement this Policy.
- In the event of inconsistency with localised notices required by law, the stricter or more protective notice prevails for users in that jurisdiction.
D. TECHNOLOGIES IN SCOPE
- Our services may deploy cookies and similar technologies to maintain state, secure sessions, personalise interfaces, measure performance, and detect misuse. Because modern pages include third‑party resources, your browser may receive tokens from multiple domains during a single visit.
- We may also implement SDKs in mobile or embedded contexts and use web beacons to register that a given resource or message has been rendered. These instruments are treated as in‑scope and governed by the same purpose limitations and user controls.
E. PURPOSES AND RATIONALE
- We categorise cookies and similar technologies by primary purpose: (a) Strictly Necessary — enable core functionality such as authentication, load balancing, network routing, fraud prevention, and security event logging. These are indispensable for service delivery; (b) Functionality — remember user choices (e.g., locale, display preferences) and provide enhanced, user‑requested features; (c) Analytics — generate aggregated insights into service usage, performance, referrers, and error conditions to inform product decisions and reliability engineering; (d) Security & Compliance — detect anomalous behaviour, enforce rate‑limits, and maintain audit artefacts required by regulatory standards; (e) Surveys & Feedback — track participation and prevent duplicate submissions for research and controlled experiments; (f) Advertising/Marketing (where enabled) — attribute campaigns, cap frequency, and, where permitted, tailor content. These are disabled absent a valid legal basis in the relevant jurisdiction.
Typology and Illustrative Lifespans
| Category | Primary Purpose | Illustrative Uses | Typical Lifespan |
| Strictly Necessary | Core operation and security | Session ID, CSRF token, load‑balancer affinity | Session to 24 months |
| Functionality | Preference persistence | Language/region, cookie‑banner state, UI density | Session to 12 months |
| Analytics | Performance and usage metrics | Page timing, navigation flows, error rates | Session to 26 months |
| Security & Compliance | Abuse prevention and auditability | Bot detection, rate limiting, audit flags | Session to 24 months |
| Surveys & Feedback | Research quality control | Survey completion flags, experiment cohorts | Session to 12 months |
| Advertising/Marketing* | Attribution and reach measurement | Click‑through attribution, frequency capping | Session to 13 months |
F. DATA ELEMENTS AND LINKAGE
- Cookies typically encode pseudonymous identifiers. Associated telemetry may include IP address, device and browser identifiers, operating system, referrer, timestamps, interaction events, and coarse geolocation derived from network data.
- Analytics outputs are ordinarily aggregated or de‑ Where linkage to an account is necessary (e.g., for fraud investigation), we confine linkage to the narrowest scope consistent with the stated purpose and applicable law.
- We do not commingle cookie‑derived identifiers with directly identifying data unless you are authenticated or another lawful basis applies and has been communicated.
G. Legal Bases and Consent Mechanics
- Consent regimes. In the EEA/UK (ePrivacy/PECR) and comparable jurisdictions, non‑essential categories (e.g., Analytics, Marketing) are deployed only after affirmative consent via our CMP.
- Singapore (PDPA). We rely on deemed consent for strictly necessary cookies and certain functional use cases; we obtain express consent where required for non‑essential categories.
- Legitimate interests. For essential security, fraud prevention, and service continuity, we may rely on legitimate interests balanced against user rights, except where local law mandates consent.
- Consent may be withdrawn at any time via the Manage Cookies control (typically in the footer or banner) or through browser settings; withdrawal does not affect prior lawful storage.
- Where applicable law recognises the GPC signal, we treat it as an opt‑out of sale/sharing or targeted advertising to the extent technically and legally feasible. Do Not Track signals are not standardised and may not be honoured.
H. FIRST‑ AND THIRD‑PARTY SETTING; ROLES
- We set first‑party cookies for our own operational purposes. Third parties may set cookies to deliver analytics, security tooling, survey infrastructure, and, where enabled, advertising services.
- Depending on the integration, we may act as controller or joint controller with such providers for cookie‑derived data. Provider‑specific notices govern their independent processing.
I. USER CONTROLS
- On‑site controls. Use the Manage Cookies interface to accept, reject, or granularly configure non‑essential categories.
- Browser controls. Modern browsers allow blocking, limiting, or clearing cookies. Blocking all cookies may impair authentication and critical functionality.
- Third‑party opt‑ Certain providers offer product‑specific opt‑outs for analytics or interest‑based advertising; availability and scope vary by provider and jurisdiction.
- Mobile contexts. Device operating systems expose controls for advertising identifiers and app tracking; consult your device documentation.
J. RETENTION AND REVIEW CADENCE
- Session cookies expire upon browser closure. Persistent cookies expire on a pre‑set schedule or upon user deletion.
- We maintain a cookie inventory, subject to periodic review, to ensure durations remain proportionate to purpose. Where law constrains lifespan (e.g., 13‑month caps for certain marketing cookies), we implement those limits.
- Independent of cookie TTLs, we apply data‑minimisation and storage‑limitation principles to downstream telemetry derived from cookies.
K. CROSS‑BORDER TRANSFERS AND JURISDICTION‑SPECIFIC NOTICES
- EEA/UK. Non‑essential cookies are set only after consent. Where cookie‑derived personal data are transferred outside the EEA/UK, we implement appropriate safeguards consistent with applicable law.
- Singapore (PDPA). We provide clear notification of cookie use, rely on deemed consent where appropriate for essential functions, and obtain express consent for non‑essential categories.
- United States. State privacy laws may afford opt‑out rights for targeted advertising or “sale/share” of personal information. Use the Manage Cookies link or GPC where supported; we effectuate recognised signals as required by law.
- Other regions. Local rules may impose divergent consent and disclosure requirements; we adapt our CMP and notices accordingly.
L. CHILDREN
- Our services are not directed to children. We do not knowingly deploy profiling or marketing cookies for users known to be children under applicable law. If you believe a child has provided personal data, contact us using the details in the Privacy Policy.
M. ACCESSIBILITY AND INCLUSIVE DESIGN
- We intend our CMP and notices to be perceivable and operable with assistive technologies. Please notify us of accessibility issues so we can remediate and improve.
N. GOVERNANCE AND ACCOUNTABILITY
- We maintain records of processing activities related to cookies and similar technologies, including purpose mapping, data categories, retention, and transfer mechanisms.
- Where a deployment materially changes risk (e.g., introduction of new tracking vendors or cross‑context behavioural advertising), we assess impact and, where required, complete a privacy impact assessment.
O. UPDATES
- We may revise this Policy to reflect changes in law, technology, or business needs. Substantive changes will be signposted on our sites. The Last updated date reflects the operative version. Continued use after publication constitutes acknowledgement of the revised terms.
P. CONTACT
- Direct questions concerning this Policy or our use of cookies and similar technologies to the contact channels listed in our Privacy Policy.