PDPA Policy

About this policy

CHANGI GLOBAL PTE. LTD. ("we", "us") is a Singapore-incorporated company (UEN 201527726E) at 11 Collyer Quay, #02-08, The Arcade, Singapore 049317. This policy explains how we manage personal data in line with the Personal Data Protection Act 2012 ("PDPA").

Personal data means information about an individual who can be identified from that information, alone or together with other information we hold. This policy covers our customers, the representatives of our business counterparties, and anyone who contacts us or visits our website.

Personal data we collect

• Enquiries: your name, company, country, email address and phone number, and anything you include in your message.
• Retail transactions: your name, identification details such as your NRIC, FIN or passport number, and the other details needed for customer due diligence and record keeping.
• Business relationships: details of a company's representatives, directors and beneficial owners, and the documents we need for counterparty onboarding and due diligence.

How we use it

We use personal data to:

• respond to your enquiries
• carry out retail money-changing transactions and provide wholesale banknote services
• verify identity, carry out customer due diligence and keep records, as required by applicable Singapore laws and Monetary Authority of Singapore (MAS) requirements
• prevent and detect fraud and other financial crime
• onboard and manage our business counterparties
• comply with the law and with requests from regulators and other authorities

Consent

We collect, use and disclose your personal data with your consent, or where the PDPA or another law allows or requires us to do so without it. By ticking the consent box on an enquiry form, you agree to us using your details to respond to your enquiry.

Customer due diligence is a legal requirement. If you do not give us the information we need, we may be unable to carry out your transaction.

Withdrawing your consent

You may withdraw your consent at any time by giving notice to our Data Protection Officer. We will tell you the likely consequences. Please allow at least 10 business days for us to act on your request.

Withdrawing consent does not stop us keeping or using your personal data where the law requires or allows it, such as customer due diligence records. It may also mean we can no longer provide our services to you.

Who we may disclose it to

Where necessary for these purposes, we may disclose personal data to:

• companies that support our operations and systems, such as IT, website hosting and logistics providers
• banks and other counterparties involved in a transaction
• professional advisers such as auditors and lawyers
• regulators, government agencies and law enforcement authorities, including MAS, as the law requires or allows

We do not sell personal data.

Transfers outside Singapore

Some of the companies that support us, and the systems they use, are outside Singapore. For example, messages sent through our enquiry forms are stored by our website hosting provider and then emailed to our team. When we transfer personal data outside Singapore, we take steps to ensure it receives a standard of protection comparable to the PDPA.

Accessing and correcting your data

You may ask us for the personal data we hold about you and how it has been used or disclosed in the past year, and you may ask us to correct any error or omission. Please send your request in writing to our Data Protection Officer. We may need to verify your identity first.

We will respond as soon as reasonably possible. If we cannot respond within 30 days, we will tell you in writing within that time when we will. We may charge a reasonable fee for access requests and will tell you the amount first. In some cases, the PDPA allows or requires us to refuse a request.

Accuracy, protection and retention

We make reasonable efforts to keep personal data accurate and complete, so please tell us if your details change. We protect it with reasonable security arrangements, as described in our Privacy Policy.

We keep personal data only for as long as we need it for these purposes and for our legal and business needs, including anti-money laundering and countering the financing of terrorism (AML/CFT) record keeping. We then securely destroy it or remove the details that identify you.

Data breaches

If a data breach is notifiable under the PDPA, we will notify the Personal Data Protection Commission (PDPC) and affected individuals as the Act requires.

Marketing messages

We will only send you marketing messages if you have agreed to receive them, and we follow the PDPA's Do Not Call provisions. You can opt out at any time by contacting us.

Contact our Data Protection Officer

For questions, requests or concerns about your personal data, please contact:

Data Protection Officer
CHANGI GLOBAL PTE. LTD.
11 Collyer Quay, #02-08, The Arcade, Singapore 049317
Email: operations@changiglobal.com
Telephone: +65 6291 1450

Data Protection Officer's name or dedicated email

Complaints

If you are unhappy with how we have handled your personal data, please contact our Data Protection Officer first so we can try to resolve it. You may also contact the PDPC at www.pdpc.gov.sg.

Changes to this policy

We may update this policy from time to time. The latest version is always on this page.

Last updated: 1 November 2026