Privacy Policy

1. Who We Are

cosantesis is a car hire and arrival services company registered and operating in Singapore. Our registered address is 152 Beach Road, #07-10, Gateway East, Singapore 189721. For data-related enquiries, you may contact us at [email protected].

We act as the data controller for personal information collected through our website and service bookings. We do not appoint a separate Data Protection Officer but designate a responsible staff member for PDPA compliance oversight.

2. Information We Collect

We collect personal data only when it is reasonably necessary for the purposes described in this policy. This may include:

• Contact details — name, email address, phone number
• Booking information — service selected, travel date, number of passengers, special requirements (such as child seat needs)
• Flight information — arrival time and flight number, provided voluntarily for arrival transfer coordination
• Usage data — pages visited, referral source, browser type, device type (collected via cookies and analytics tools)
• Communications — messages sent through our contact form or email

We do not collect sensitive personal data such as national identification numbers, financial account details, or health information as part of our standard service.

3. How We Use Your Data

Personal data collected is used for the following purposes:

• Processing and coordinating bookings and service requests
• Communicating with you about your booking, including confirmations and scheduling updates
• Monitoring flight arrival times to adjust service timing
• Responding to enquiries submitted through our contact form or email
• Improving the quality and functionality of our website through aggregate analytics
• Meeting legal and regulatory obligations

We rely on the following legal bases for processing: consent (where you have provided it), contractual necessity (to fulfil a booking), and legitimate interests (to operate and improve our services, provided these interests do not override your rights).

4. Data Retention

We retain personal data only as long as necessary for the purpose it was collected, or as required by applicable law:

• Booking records — retained for up to 3 years following the service date, for business continuity and dispute resolution purposes
• Contact form submissions — retained for up to 12 months if no service engagement follows
• Analytics data — retained in aggregate, anonymised form; no individual records kept beyond 26 months

When data is no longer required, we delete or anonymise it in a secure and thorough manner.

5. Sharing Your Data

We do not sell personal data. We may share information with the following parties, strictly where necessary:

• Service staff and drivers — names and arrival details shared to coordinate your journey
• Analytics providers — aggregate, anonymised usage data (e.g. Google Analytics)
• IT and hosting providers — to maintain and operate our website securely
• Regulatory or legal authorities — where required by Singapore law

Where third-party service providers process personal data on our behalf, we ensure appropriate data processing agreements are in place.

6. Cookies

Our website uses cookies to support basic functionality, measure aggregate visitor behaviour, and, if enabled, serve relevant content. You can manage cookie preferences at any time via our Cookie Policy page.

Essential cookies are necessary for the website to function and cannot be disabled. All other cookies are optional and subject to your consent.

7. Data Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data transmitted via our website
• Access controls limiting staff access to personal data on a need-to-know basis
• Regular review of data handling practices

No digital system can be guaranteed entirely secure. In the event of a data breach that is likely to result in significant harm, we will notify affected individuals and the Personal Data Protection Commission (PDPC) in accordance with the Mandatory Data Breach Notification requirements under the PDPA.

8. Your Rights

Under Singapore's PDPA, you have the right to:

• Access — request confirmation of whether we hold your personal data, and receive a copy
• Correction — request that inaccurate or incomplete data be corrected
• Withdrawal of consent — withdraw consent at any time for data processed on that basis, without affecting prior processing
• Data portability — request a copy of data you have provided to us in a structured, commonly used format
• Erasure — request deletion of personal data where no legal obligation requires us to retain it

To exercise any of these rights, contact us at [email protected]. We will respond within 10 business days. If you are dissatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

9. Children

Our services are intended for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18 years of age. If you believe we have inadvertently received data from a minor, please contact us and we will remove it promptly.

10. Third-Party Links

Our website may contain links to external sites, such as Google Maps. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any external services you visit.

11. Policy Updates

We may update this policy from time to time to reflect changes in our practices or applicable law. Significant changes will be noted at the top of this page with a revised effective date. Continued use of our website following an update constitutes acceptance of the revised policy.

12. Contact

For any privacy-related questions, requests, or concerns:

• [email protected]
• cosantesis, 152 Beach Road, #07-10, Gateway East, Singapore 189721