Privacy & PDPA Policy

This Privacy & PDPA Policy explains what personal data the Thomson Reserve website collects, why it is used, who it is disclosed to, and the choices available to you under Singapore’s Personal Data Protection Act 2012 (PDPA).

The website is operated for the marketing of Thomson Reserve by the appointed salesperson, Teddy Lim (Associate Division Director, CEA Registration No. R040871B) of ERA Realty Network Pte Ltd (Agency Licence No. L3002382K). References to “we” and “us” mean the appointed salesperson and agency.

1. What we collect

When you submit an enquiry form, we collect the details you provide:

• Your name, mobile number and email address
• Unit types of interest, where you are in your search, and how you would like to be assisted
• Any free-text message or question you choose to include

Alongside your enquiry, we record technical and advertising information collected automatically by the website:

• Advertising click identifiers (gclid, gbraid, wbraid) and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content)
• The page you first landed on, the referring website, and the time of that first visit
• Your browser user-agent string and the country your connection is associated with

The advertising and campaign information above is stored in a first-party cookie on your device named dh_attr, which lasts up to 90 days. It is read only when you submit an enquiry form, so that we can tell which advertisement or referral led to your enquiry. You can delete or block this cookie in your browser at any time; the forms will still work.

The website also loads Google Analytics 4 and the Meta Pixel through a Google Tag Manager container. These set their own cookies and collect standard usage information such as pages viewed, device and browser type and approximate location. They are loaded after you interact with the page, or shortly after the page finishes loading.

To protect the enquiry form from automated abuse, this website uses Cloudflare Turnstile, which runs invisibly — no challenge or checkbox is shown — and evaluates device and browser characteristics to distinguish genuine visitors from bots. This information is not used for advertising. Cloudflare’s handling of it is described in the Cloudflare Turnstile Privacy Addendum.

2. Why we use it

• To respond to your enquiry, arrange viewings, send project updates and assist with property-related requests, by call, SMS, WhatsApp and email
• To record internally, for our own sales follow-up and reporting, how an enquiry progressed
• To measure which advertisements produced genuine enquiries, so that advertising spend can be directed toward the campaigns that work
• To detect and prevent spam or automated form abuse

You may ask us to stop sending follow-up messages at any time.

3. Advertising measurement and hashed identifiers

The enquiry form uses shortened wording for readability. This section provides the full details about the data, purpose, recipients and withdrawal arrangements covered by that consent.

Where you give the consent shown on an enquiry form, we use limited enquiry and outcome information to measure advertising effectiveness. Before any disclosure, your email address is trimmed and converted to lower case, and your mobile number is converted into international format (for example, +65 followed by the number). Both are then converted using SHA-256 into one-way hashed identifiers. A one-way hash cannot be reversed back into your email address or mobile number.

Only the following is disclosed for advertising measurement:

• The hashed identifiers described above
• The advertising click identifier associated with your visit, where one exists
• The time of the enquiry, and a reference that indicates the recorded outcome such as “qualified” or “appointment”

These hashed identifiers may be disclosed to Google LLC for Google Ads advertising measurement and campaign optimisation, and to Meta Platforms, Inc. for equivalent measurement of advertising run on Meta’s platforms. We do not disclose your name, your free-text enquiry message or your raw contact details to these advertising platforms for this purpose.

This measurement information is not used by Google to send marketing messages to you on our behalf. When we send it, we signal that consent has been given for advertising measurement but withhold consent for ad personalisation. Google and Meta process the information under their applicable customer-data and advertising-data terms.

If you do not tick the consent box on the enquiry form, we cannot accept the enquiry through the form. If you would prefer not to have your enquiry used for advertising measurement, you may withdraw that consent at any time after submitting, using the process in section 7 — withdrawal stops any further advertising disclosure.

4. Who we disclose it to

• Static Forms — the form delivery vendor that receives your submission and emails it to the salesperson
• Cloudflare, Inc. — hosts this website and the database in which the enquiry record is stored, and provides the Turnstile bot-protection service described in section 1
• Google LLC — Google Tag Manager, Google Analytics 4 and Google Ads, including the hashed identifiers described in section 3
• Meta Platforms, Inc. — the Meta Pixel and equivalent advertising measurement

We do not sell your personal data, and we do not disclose it to other property agencies or developers except where doing so is necessary to progress a transaction you have asked us to assist with, or where required by law.

5. Transfers outside Singapore

Google LLC and Meta Platforms, Inc. are located outside Singapore, and our hosting and form vendors may process data outside Singapore. Sending your personal data to them is an overseas transfer under the PDPA.

Under the Transfer Limitation Obligation (section 26 of the PDPA), we transfer personal data overseas only where the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA. We rely on the contractual data-protection terms of each recipient for this purpose. Our enquiry database is configured to be stored in the Asia-Pacific region.

6. How long we keep it

• Enquiry records — retained for as long as needed for the purposes above, and for any period required by law or by the agency’s regulatory record-keeping obligations
• Form vendor copy — the form delivery vendor retains a copy of the submission for approximately 30 days
• Attribution cookie — the dh_attr cookie expires 90 days after it is set
• Analytics and advertising platforms — Google and Meta retain data under their own published retention policies, which we do not control

7. Your choices, and how to reach us

Under the PDPA you may:

• Withdraw consent (section 16) — for follow-up communication, for advertising measurement, or for both. Withdrawal does not affect processing already carried out before we received your request, and information already disclosed to an advertising platform cannot be recalled from it.
• Request access (section 21) — to the personal data we hold about you and how it has been used or disclosed in the past year.
• Request correction (section 22) — of personal data that is inaccurate or incomplete.

Send any of these requests through the contact form on this website — state your request in the message field and it will be handled as a PDPA request rather than a sales enquiry. We will respond within 30 days, and will tell you if we need longer. We may need to verify your identity before acting on a request.

8. Protecting your data

We use reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, and we limit access to the enquiry records to the people who need them to respond to you.

9. Changes to this policy

We may update this policy as the website or our advertising tools change. The current version is always published on this page, with the last updated date shown above.