Data Security Policy
Overview
Read this policy alongside the Privacy Policy, Data Processing & Compliance Policy, Terms & Conditions, and any signed customer agreement. This policy is for general information only and does not constitute legal or professional security advice.
Security Principles
APAC Leads’ approach to data security is guided by these principles:
- Protect information from unauthorized access, use, disclosure, alteration, loss, or destruction
- Give access only to personnel who need it for their specific role
- Use secure systems, processes, and service providers appropriate to the data involved
- Monitor systems and respond to security incidents promptly
- Review safeguards regularly as threats, technology, services, and regulations change
Administrative Safeguards
Access to APAC Leads’ systems and customer information is controlled by role-based permissions. Each team member receives only the access required to carry out their responsibilities, and those rights are reviewed and removed when no longer needed.
Employees and authorized contractors who handle customer or business data are subject to confidentiality obligations. APAC Leads promotes safe data-handling practices within its team, covering areas such as phishing awareness, credential hygiene, and proper procedures for delivering and disposing of data.
Before engaging third-party providers that will access customer data, APAC Leads assesses their security and confidentiality practices. Contracts with such providers include appropriate security obligations. rocedures for incident response, access reviews, and secure data disposal are maintained and updated as required.
Technical Safeguards
Data exchanged through the APAC Leads website, customer forms, and account portals is transmitted using HTTPS with TLS encryption. Sensitive data held in APAC Leads’ systems is stored with access restrictions appropriate to its classification. [Insert confirmed details about encryption at rest or specific storage controls where applicable.
APAC Leads uses firewalls and malware protection tools to help defend its systems against external threats. Multi-factor authentication is applied to internal systems that hold sensitive data where applicable. Systems and software are kept updated, and security patches are applied in a timely manner.
Logging and monitoring tools are used to record system activity and detect unusual behavior. Alerts are reviewed and acted on as part of ongoing operations. Secure backup procedures are maintained to support recovery in the event of a system failure or data loss incident.
Physical Safeguards
Access to APAC Leads’ office premises and any areas where sensitive systems or records are handled is restricted to authorized personnel. Visitor access to relevant areas is managed and monitored. Physical records and storage media containing sensitive data are disposed of securely.
APAC Leads uses third-party hosting and cloud infrastructure providers, which maintain their own physical security controls, including restricted-access data centers and environmental protections. [Insert confirmed hosting provider details where applicable.
Data Collection and Storage
Customer and business data may be stored in internal systems or cloud infrastructure maintained by approved providers. Access is limited to authorized personnel based on role and business need. Data is retained only as long as necessary for service delivery, contractual obligations, legal requirements, or legitimate business purposes.
When data is no longer required, APAC Leads aims to delete, anonymize, or securely destroy it, subject to applicable backup cycles and legal retention obligations.
Secure Data Transfer and Delivery
All data submitted through APAC Leads’ website forms, portals, and enquiry channels is protected by HTTPS with TLS encryption during transmission. Delivered data is transferred using methods designed to limit exposure, which may include secure download links, password-protected files, encrypted email, or approved file-transfer platforms, depending on the arrangement confirmed in the Order. [Insert confirmed delivery platforms or protocols where applicable.
Download links, passwords, and access credentials provided for data delivery are for the customer’s internal use only. Customers are responsible for keeping these confidential. Before releasing data or making account changes, APAC Leads may verify the identity of the requesting party to reduce the risk of unauthorized disclosure.
Access Controls
Access to customer accounts and data held by APAC Leads is limited to authorized personnel who need it to carry out their work. Access rights are removed or adjusted when circumstances change.
Customers are responsible for managing access on their own side, including controlling which employees, agencies, and contractors can access delivered data and account credentials. Any suspected unauthorized access to an APAC Leads account or delivered data should be reported promptly.
Third-Party Service Providers
APAC Leads works with trusted providers for hosting, email, payment processing, communication tools, and other operational functions. Providers are selected with appropriate security and confidentiality requirements, and access is limited to what is necessary for the specific service. Contracts include relevant security obligations, and APAC Leads oversees its provider relationships on an ongoing basis.
Customers may request information about subprocessors involved in handling their data where relevant to their compliance obligations, subject to confidentiality and commercial considerations.
Incident Response
When a suspected security incident is identified, APAC Leads follows a structured response process: contain the issue, assess the scope and affected data, restore systems and services, notify affected customers and regulators where legally required, and review the incident to improve controls.
Where an incident affects customer data and notification is required or appropriate, APAC Leads will contact the affected customer without undue delay. Customers who discover or suspect a security incident involving data delivered by APAC Leads should report it promptly using the contact details in Section 15.
Customer Responsibilities
Data security is a shared responsibility. Customers are expected to:
- Use strong passwords and enable multi-factor authentication where available
- Keep account credentials, download links, and delivered files confidential and secure
- Limit access to delivered data to authorized personnel only
- Apply appropriate security controls when storing or using data within their own systems
- Comply with privacy and marketing laws when using licensed data
- Report any suspected account compromise or data misuse to APAC Leads promptly
APAC Leads is not responsible for security incidents arising from inadequate controls within a customer’s own environment.
Data Retention and Disposal
APAC Leads retains data only as long as needed to provide services, meet contractual obligations, satisfy legal or regulatory requirements, and resolve disputes. When data is no longer required for those purposes, it is securely deleted, anonymized, or destroyed using methods appropriate to the sensitivity of the information. Specific retention periods are set out in the Data Processing & Compliance Policy and, where applicable, in signed customer agreements.
Security Assurance
APAC Leads follows industry-standard security practices and reviews its safeguards periodically. No system of controls can eliminate all risk, and APAC Leads does not claim to provide a perfectly secure environment. The safeguards described in this policy are designed to reduce risk to a level appropriate to the nature of the data and services involved.
For enterprise customers with specific security review requirements, questionnaire responses, subprocessor details, and other documentation may be available on request, subject to confidentiality requirements. Any confirmed security certifications or audit reports will be listed here: [Insert confirmed certifications or attestations if applicable.]
Policy Updates
APAC Leads may update this policy to reflect changes in technology, services, security practices, or legal requirements. Where updates are material, reasonable notice will be provided through the website or by direct communication. Continued use of APAC Leads’ services following an update constitutes acceptance of the revised policy.
Reporting a Security Concern
When reporting, include the affected URL, account, or service, a description of what you observed, and any relevant evidence. Do not include passwords or sensitive credentials in your report.
Phone: +65-6990-3855
Email: info@apacleads.com
APAC Leads treats all security reports seriously and aims to acknowledge them promptly and in confidence.
Let’s Collaborate with Us!
Tell us about your business needs. Our team will help you find the right data solutions to support your marketing goals and business growth.
