Privacy Policy

1. Purpose and scope

The purpose of this policy is to tell you clearly what happens to information that passes through the custody desk. The policy covers the public website, the enquiry form, the message channel to direct@fscglobal.mom, the scheduling tools used by our counters, the written routine reports we issue and the internal registers that record access to a vault. It does not cover the practices of a client organisation, a courier partner, a broker or an independent vault operator, each of which maintains its own privacy documentation.

Where a client provides information about its own staff, directors or counterparties so that a routine can be scheduled, the client remains responsible for the lawful basis of that sharing. The desk processes the information as instructed, uses it only for the scheduled routine and returns or deletes it in line with the retention periods described below. Where the desk collects information directly from a visitor or a representative, the desk acts as the controller for that information.

The policy is drafted to address the obligations that apply to a professional services firm based in Singapore, including the requirements of the Personal Data Protection Act, and it is also written to be useful to clients who work under the data protection rules of other jurisdictions. Where a specific client contract sets a stricter standard, the contract controls for that client and the desk applies the stricter rule rather than the general one.

2. Who we are

The controller is FSC GLOBAL ASSETS PTE. LTD., a company registered in Singapore and operating an asset custody desk from 22 Sin Ming Lane #06-76 Midview City 573969, Singapore (SG). The desk can be reached by email at direct@fscglobal.mom and by telephone at +17749878976. The developer name used for the website and for the systems that support the desk is FSC Global, and the same team maintains the privacy programme described here.

The desk does not appoint a separate external data protection officer for public enquiries. Instead, a named member of the operations team is responsible for privacy questions, for access requests and for incident handling. That person can be reached through the general contact address, and a request will be routed to the responsible member within one working day. Clients with a dedicated engagement lead should raise privacy questions through that lead so that the context of the routine is available from the start.

The desk operates as a service provider to institutions and does not sell personal information, does not run an advertising network and does not build profiles of visitors for commercial purposes. The website is a description of the service, not a commercial marketplace.

3. Information we collect

The categories of information collected by the desk fall into a small number of groups. Each group exists because a routine cannot be completed without it, and each group is handled under the same access controls.

Contact and enquiry information

When a person writes to the desk, we collect the name, email address, telephone number and any subject or message text provided in the message. If the message is sent through the website form, the same fields are used, and the sending mail application may add a signature block that the sender controls. We do not require a postal address for an initial enquiry, but a client engagement usually requires one for the engagement letter.

Client and engagement information

For a scheduled routine we collect the legal name of the client entity, the names and roles of authorised representatives, the scope of the routine, the vault location, the billing details and the correspondence history. Where an engagement letter is issued, we also collect the signatory name, title and the date of signature. This information is held in the client file for the life of the relationship and for the retention period described later.

Reserve and custody information

A reserve audit, a custody transfer or a logistics week produces detailed records about the units held. These records include unit counts, serial numbers, weights, position numbers, photographs of serial faces, seal numbers, transfer memoranda and receiving sheets. Although the units themselves are physical objects, the records identify a client holding and can reveal commercially sensitive information about the size and composition of a reserve. We treat these records as confidential client information and apply the controls described in the security section.

Access and observation records

Where a vault operator maintains cameras or access readers, the desk may receive extracts that are relevant to a scheduled routine, such as the access log for a given day or a clip that confirms a transfer. Camera footage remains under the control of the vault operator, and the desk receives access only to the specific extract needed for the routine. The desk does not receive continuous footage and does not maintain a live observation feed.

Technical information

The website collects a minimal set of technical information needed to deliver pages and to keep the service reliable. This may include the browser type, the device type, the approximate region derived from the network address and the pages requested. We do not build a user profile from this information and we do not combine it with a client file.

4. How we obtain information

Most information is provided directly by the person it concerns, either through the enquiry form, an email or an engagement document. A client may also provide information about its own staff and counterparties so that access can be arranged or a transfer memorandum can be prepared. Where a routine requires confirmation from a third party, such as a vault operator or a broker, we may receive information from that party.

A small amount of information is generated by our own records as a routine proceeds. Count logs, photographs, seal numbers and signed receiving sheets are created by the counters during the work and are stored in the client file. Technical information is generated automatically when a browser requests a page from the website.

We do not purchase contact lists, we do not use data brokers and we do not obtain personal information from social networks for the purpose of marketing. If a message reaches the desk through a shared inbox, we keep only the content of the message and the reply chain, not the other recipients who may have been copied by the sender.

5. Legal bases for processing

The desk relies on a small number of legal bases, and the basis is recorded in the client file at the start of an engagement. For a person who writes to the desk to ask about services, the basis is the legitimate interest of responding to a business enquiry and the steps needed to enter a contract. For an engagement, the basis is the performance of the contract between the client and the desk.

Some processing is needed to comply with a legal obligation. This includes record keeping that a professional services firm must maintain, anti money laundering checks where they apply and the retention of signed transfer memoranda for the period required by the client contract. Where a routine involves a sensitive document, the desk may ask for explicit consent, and consent is recorded in writing before the work begins.

Where the desk relies on consent, the consent can be withdrawn at any time by writing to direct@fscglobal.mom. Withdrawal does not affect work already completed under the consent, and it may mean that a routine cannot proceed because the information is essential to the task. We will explain the consequence before acting on a withdrawal.

6. How we use information

Information is used to answer enquiries, to scope a routine, to prepare checklists and inventories, to run the routine on site, to issue the report and to keep the client file up to date. It is also used to schedule future routines, to send a reminder before an agreed inspection day and to reconcile an invoice against the engagement letter.

We use reserve and custody records to prepare the reconciliation page and the exception list that accompany a routine. We use access records to confirm that a transfer happened at the time stated in the memorandum. We use technical information to keep the website available and to detect abusive requests.

We do not use client information for advertising, we do not sell it to a third party and we do not disclose the existence of a reserve to anyone outside the engagement without a written instruction. Where we would like to describe a routine in a general way for training purposes, we remove names, serials, values and locations before the material is used.

7. Reserve and vault records

A reserve record is the most sensitive category the desk handles, and it receives the strictest controls. Records are stored in a client folder that is accessible only to the counters assigned to that engagement and to the operations lead. Photographs are stored against a position number rather than a client name, so that a misplaced file reveals less if it is ever exposed. The mapping between position number and client is held in a separate register with its own access list.

Where a routine is completed at a vault operated by a third party, the desk receives an extract of the operator register for the day of the work and does not retain a copy of the full operator database. The extract is attached to the routine file and is deleted when the file reaches the end of its retention period. The desk does not copy client data into a personal device, a personal mailbox or a removable disk.

Reserve records may be shared with the client auditors, with a financing counterparty named in the engagement letter, with an insurer named by the client or with a court where disclosure is required by law. Each of these recipients receives only the portion of the record that is relevant to the request, and the disclosure is logged in the client file with the date, the recipient and the reason.

8. Camera and access records

Vault environments are usually covered by cameras for the protection of the operator and the client. The desk does not operate those cameras and does not control the footage. When a routine requires a camera extract, the vault operator provides a copy limited to the relevant time window, and the desk stores that copy only for as long as it is needed to complete the routine report.

Access records such as door reader logs and visitor books are handled in the same way. The desk may review an access log to confirm that a transfer happened during the stated window, and it may attach a redacted extract to the routine file. Names of visitors who are not part of the engagement are removed from the extract before it is stored.

A person who appears in a camera or access record and wishes to know how that record is used should contact the vault operator first, because the operator is the controller for the footage. The desk will cooperate with the operator and with the person concerned to the extent allowed by the engagement and the law.

9. Sharing with third parties

The desk shares information only when it is needed to deliver the service, when the client has instructed it, or when the law requires it. The categories of recipient are limited and are named in the engagement letter.

• Courier and logistics partners, for the movement of crates during a logistics week.
• Vault operators, for the scheduling of a routine and the receiving inspection.
• Professional advisers, such as lawyers and auditors, acting for the client or for the desk.
• Insurers and brokers, when an insurance review evening has been requested.
• Technology providers that host the client file and the scheduling system, under a written data agreement.
• Public authorities, where a legal obligation or a valid court order requires disclosure.

Each provider is selected for its security posture and is bound by a written agreement that limits its use of the information to the service it provides. We do not allow a provider to reuse client information for its own purposes and we require a written notice before a provider changes a subcontractor that touches client data.

The desk does not sell information, does not share it with advertising networks and does not disclose the identity of a client to another client. Where two clients are parties to the same transfer, both receive the transfer memorandum, which is expected and is explained in the engagement letter.

10. International transfers

The desk is based in Singapore and most records remain in Singapore. Some engagements require information to reach a vault, a courier partner or a client office in another country. When that happens, the desk transfers only the portion needed for the task and applies the same access controls that apply at home.

Where a transfer goes to a country with a different data protection standard, the desk relies on a written agreement that includes appropriate safeguards, usually a set of contractual clauses that require the recipient to protect the information and to notify the desk of any incident. The client is informed of the destination country at the scoping stage so that there is no surprise later in the engagement.

A client may ask for a routine to be run without any international transfer. The desk will explain which parts of the routine can still be delivered and which parts would need a different arrangement, and the decision is recorded in the scope note before the work begins.

11. How long we keep records

Retention periods are set by the type of record rather than by a single global rule, because a routine report and an enquiry message serve different purposes. The periods below are the default; a client contract may require a longer period for a signed transfer memorandum or for an audit report.

• Enquiry messages that do not lead to an engagement are deleted after twenty four months.
• Enquiry messages that lead to an engagement are moved into the client file and kept with the engagement.
• Routine reports, reconciliation pages and exception lists are kept for seven years from the date of issue.
• Transfer memoranda, receiving sheets and seal records are kept for ten years.
• Camera and access extracts are kept for the period needed to close the routine, usually ninety days.
• Technical website logs are kept for ninety days and then deleted in rotation.
• Billing records are kept for the period required by tax and company law in Singapore.

When a retention period ends, the record is deleted from the client file and from backups in the normal rotation. Where a legal hold applies, deletion is suspended for the specific record until the hold is lifted, and the reason is recorded in the file. A client may request earlier deletion of a record that is not subject to a legal hold, and the desk will act on the request within thirty days where it is technically possible.

12. Security of information

Security at the desk is built around the same principle as the vault: separate the layers so that no single failure exposes the whole reserve. Client files are stored in an access controlled system with named accounts. Multi factor authentication is required for every account that can reach a client file. Access is reviewed each quarter, and an account that is no longer needed is removed rather than disabled and forgotten.

Data in transit between the desk and a client is encrypted. Data at rest in the client file system is encrypted by the hosting provider, and backup copies are encrypted with a separate key. Photographs are stored in a separate bucket with its own access list so that a routine report can be shared without exposing the full image set.

Staff receive a privacy briefing when they join and a short refresh each year. Counters are trained not to discuss a client reserve outside the engagement and not to carry client documents on a personal device. A visitor to the desk office is escorted and is not left alone with an open file. Physical documents such as signed memoranda are held in a locked cabinet, and the cabinet register is reconciled monthly.

No system is perfect, and the desk does not claim otherwise. What the desk does claim is that a failure will be detected quickly, contained and reported honestly, as described in the incident section below.

13. Cookies and local storage

The website is deliberately light. It does not run an advertising network, it does not load a tracking pixel and it does not set a persistent identifier for analytics. A small amount of local storage may be used to remember a preference, such as whether a visitor has already seen an introduction panel, and that value stays in the browser.

The hosting provider may set a security cookie that is needed to deliver the page and to protect the service from abusive requests. That cookie is not used to build a profile and is not shared with an advertising network. A visitor who blocks cookies can still read every page, although a small feature such as a remembered panel may reset on each visit.

The enquiry form does not store a message on the website. It prepares a message in the visitor mail application, which means the content leaves the browser through the visitor own email service. The desk does not receive the message until the visitor sends it from that application.

14. Your rights and choices

A person whose information is held by the desk may ask to see it, to correct it, to receive a copy in a portable form, to restrict its use or to have it deleted where the law allows. A request can be sent to direct@fscglobal.mom and will be acknowledged within three working days.

Before acting on a request, the desk may ask for enough information to confirm identity, because a reserve file is sensitive and a wrong disclosure would be worse than a delayed one. The desk will not ask for more than is needed to confirm identity and will not use the request itself as a reason to collect additional information.

Where a request concerns a routine report that is also held by the client, the desk may ask the client to confirm the request so that the two records stay consistent. Where a request concerns a record that must be kept by law, the desk will explain the obligation and will restrict the record rather than delete it. A person who is not satisfied with a response may raise the matter with the relevant data protection authority in their jurisdiction.

15. Privacy for Children

The desk provides professional services to institutions and does not offer a consumer product. The website is not directed at children, and the desk does not knowingly collect information from a person under the age of eighteen. Where a visitor believes that a child has sent information to the desk, the visitor should write to direct@fscglobal.mom and the message will be deleted without being added to a client file.

Where a routine takes place at a site that includes family accommodation, the desk asks the site operator to keep children away from the working area and does not record images of children in the routine file. If a child appears in a camera extract provided by an operator, the desk will ask for the extract to be redacted before it is stored.

16. Messages and marketing

The desk sends service messages to a client when a routine is scheduled, when a report is issued and when a follow-up is needed. These messages are part of the service and are sent to the representative named in the engagement letter. The desk does not send a marketing newsletter and does not add a visitor to a mailing list after a single enquiry.

Where the desk would like to share a general update about the vault inspection window or about a change in the service, the message is sent only to clients who have agreed to receive it, and every message includes a way to stop future updates. A request to stop updates does not affect service messages that are needed to deliver an active engagement.

The desk does not use a purchased list, does not run a cold calling programme and does not track whether a recipient opened a message. If a person receives a message that appears to come from the desk but was not expected, the person should forward it to direct@fscglobal.mom so that the desk can investigate and warn other clients if needed.

17. Mobile devices and field work

Counters use a managed tablet to capture counts, weights and photographs during a routine. The tablet is encrypted, requires a passcode and a hardware key, and is wiped remotely if it is lost. Client data is not stored on a personal phone, and a counter is not permitted to photograph a vault or a document with a personal camera.

Field notes are synchronised to the client file at the end of each session, and the local copy is cleared once the sync is confirmed. Where a vault has no network coverage, the counter records the session in an encrypted local store and syncs at the first available connection. A routine is never left with unsynced data overnight unless the client has approved the arrangement in writing.

A lost or stolen device is treated as a security incident, and the client is told as soon as the desk has enough information to describe the exposure. The incident process described below applies in full.

18. Incident notification

If the desk becomes aware of an incident that affects client information, the operations lead assembles a small response group, contains the incident and establishes what was affected. The client is told within seventy two hours of confirmation, or sooner where the exposure is immediate and the client can act on the warning.

The notice describes what happened, which records were involved, what the desk has done so far and what the client should do. The desk avoids speculation and does not delay a useful warning while waiting for a complete picture. A written follow-up is issued within ten working days with the root cause and the corrective actions taken.

Where the law requires notification to a regulator, the desk makes the notification and informs the client of the content. A post incident review is added to the client file, and the lessons are folded into the annual privacy briefing so that the same failure is less likely to repeat.

19. Changes to this policy

This policy is reviewed at least once a year and whenever the desk changes a system, a provider or a routine in a way that affects the handling of information. The current version is always available on this page, and the date at the top of the page shows when it was last updated.

Where a change is material, clients with an active engagement receive a short notice that summarises the change and points to the new version. A change does not reduce the protection that applies to a record already held unless the client has agreed in writing, and a change that would require a new legal basis is explained before it takes effect.

Earlier versions are kept in the client file archive and can be provided on request. If a person wishes to know which version applied on a particular date, the desk can confirm that from the archive without charge.

20. How to reach us

Privacy questions, access requests and complaints can be sent to the desk at any time. The desk prefers email because it leaves a written record, and a telephone call is welcome when a matter is urgent.

A request is acknowledged within three working days and answered within thirty days, unless the matter is complex and needs more time, in which case the desk explains the delay before the thirty day period ends. The desk does not charge a fee for a first request, although a reasonable fee may apply where a request is clearly excessive or repetitive.