How we handle your data
Privacy notice, in plain language.
This notice describes how leapbuzz handles personal data submitted through leapbuzz.com (enquiry forms, newsletter sign-ups) and collected automatically when you visit the site. It covers the website only. Written for the five jurisdictions our site reaches most: Singapore, Australia, Canada, the United States, and the European Union.
Primary regime
Singapore PDPA 2012
Privacy requests
2-week reply
Data sales
Zero, never
Ad-tracking cookies
None set by us
Privacy notice in detail
1. Who we are
leapbuzz is a brand of Origin Pi Pte. Ltd. (UEN 202300798D), an AI-native marketing and business consultancy registered in Singapore on 6 January 2023. Our registered address is 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051.
For everything in this notice, Origin Pi Pte. Ltd. is the data controller. Our Data Protection Officer can be reached at [email protected] or +65 9296 2186.
2. What this notice covers
This notice explains how leapbuzz collects, uses, and protects personal data when you visit leapbuzz.com or submit information through the site (enquiry forms, newsletter sign-ups). It applies to the website only. Personal data processed inside a consultancy engagement we have with a client sits under the separate written agreement we signed with that client and the data-processing addendum to it.
It is written to comply with Singapore's Personal Data Protection Act 2012 (PDPA), and where applicable: the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Quebec Law 25, the Australian Privacy Act 1988, and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA).
If you do not agree with how we handle personal data on the site, please do not use the site or submit an enquiry. Continued use signals your consent to the practices described here.
3. Personal data we collect
3.1 Data you give us directly
- Enquiry forms: name, work email, mobile (if you choose), company website, and a description of your challenge.
- Newsletter: email address and the preference categories you tick.
- Events: name, contact details, dietary preferences when relevant.
3.2 Data we collect automatically
- Technical: IP address, browser type, device, operating system.
- Usage: pages visited, time on page, click paths, referral source.
- Location: approximate, derived from IP address.
- Cookies: see Section 7 and our Cookies Notice.
3.3 Data from third parties
- Analytics: Google Analytics 4 (anonymised, IP-masked).
- Service providers: Cloudflare (security and form processing), Resend (transactional email delivery).
4. How we use your data
| Purpose | Legal basis (PDPA) |
|---|---|
| Respond to enquiries submitted through the site | Legitimate business interest / consent at form submit |
| Send newsletter and insights you opted in to | Consent (opt-in only) |
| Understand which content readers find useful, anonymously | Legitimate business interest |
| Protect the site against fraud, abuse, and security threats | Legitimate business interest |
| Comply with legal obligations applicable to us | Legal requirement |
You can unsubscribe from any marketing email using the link inside the email, or by writing to [email protected].
5. How we store and protect your data
Form submissions are processed by a Cloudflare Worker running on Cloudflare's global edge network, then forwarded to our internal contact inbox. Resend handles transactional email delivery. Both vendors publish SOC 2 Type II reports.
Technical measures
TLS in transit, encryption at rest, MFA on system access, role-based permissions, regular security audits, intrusion detection.
Organisational measures
Staff data-protection training, NDAs with every contractor and vendor, incident-response plan, 72-hour breach-notification process.
We do not sell your personal data. We do not share it with advertisers or list brokers. We do not run third-party advertising cookies on this site.
6. Your rights under Singapore PDPA
Under PDPA 2012, you can:
- Access the personal data we hold about you (Section 21).
- Request correction of inaccurate or incomplete data (Section 22).
- Withdraw consent for any processing not strictly necessary (Section 16).
- Lodge a complaint with the Personal Data Protection Commission (PDPC) if you believe your rights have been infringed.
To exercise any right, email [email protected]. We respond within two weeks. A reasonable fee may apply for excessive or repetitive requests, as PDPA permits. (Note: new business enquiries through the contact form get a reply within one business day; the two-week window applies to privacy / data-access / correction requests routed through this notice.)
7. Equivalent rights, other markets
European Union (GDPR)
Access, rectification, erasure, restriction, portability, objection, and protection from solely automated decision-making.
California (CCPA)
Right to know, right to delete, right to opt-out of sale (we do not sell), right to non-discrimination.
Quebec (Law 25)
Access, rectification, de-indexing, and explicit consent for sensitive uses.
Australia (Privacy Act)
Full rights under the 13 Australian Privacy Principles, including access and correction.
Canada (PIPEDA)
Right of access, accuracy, and complaint to the Office of the Privacy Commissioner of Canada.
Other jurisdictions
If your local law grants rights not listed here, write to us. We honour equivalent rights where the law applies.
9. Cross-border data transfers
Our suppliers operate in several jurisdictions, including the United States, the European Union, and other regions with reputable data-protection frameworks. We protect cross-border flows through:
- EU Standard Contractual Clauses where data leaves the EEA.
- Compliance with the Australian Privacy Principles for cross-border disclosure.
- Vendor certifications (SOC 2, ISO 27001, equivalents).
10. Retention periods
| Data type | Retention |
|---|---|
| Enquiry-form submissions | 3 years from submission |
| Newsletter contact data | Until you unsubscribe, plus 1 year |
| Website analytics (GA4) | 26 months (GA4 default) |
| Security and bot-mitigation logs | 90 days |
After the retention period expires we delete or anonymise the data.
11. Children
Our services are not directed at children under 16. We do not knowingly collect data from children under 16. If you believe we have, write to [email protected] and we will delete it.
12. Changes to this notice
We may update this notice from time to time. Material changes will be flagged on this page with a new "last updated" date, and where appropriate, communicated by email to active clients and newsletter subscribers.
Questions, requests, complaints
Talk to our Data Protection Officer.
Privacy questions, access requests, and complaints all go to the same address. We respond within two weeks, sooner where the request is simple. (New business enquiries are answered within one business day at /contact.)
If you believe your rights have been infringed, you can also lodge a complaint with the Singapore PDPC, your local data-protection authority, or the supervisory authority in your EU member state.
Data Protection Officer
Origin Pi Pte. Ltd.
60 Paya Lebar Road, #06-28
Paya Lebar Square
Singapore 409051
By using leapbuzz.com and submitting personal data through the site, you confirm you have read this notice and consent to the collection and use of your personal data as described.