Privacy Policy

Data Direct Pte Ltd is a Singapore-based provider of consumer data, data validation, identity verification, data matching, analytics and marketing-related data products and services. We collect and maintain consumer information and license datasets and services to businesses on a non-exclusive basis.

Our business is not limited to any single customer, reseller or distribution partner. Acxiom is one of the organisations to which we may license data; we also license or disclose permitted information to other independent data recipients, distributors, commercial partners and clients.

Depending on the source, product and stated collection purpose, the information we process may include names, contact details (including postal and email addresses and telephone numbers), date of birth or age, demographic attributes, consumer preferences, marketing interests, participation and response information, and other information relevant to the lawful purpose of collection. Some products may use identifiers for matching, including hashed email addresses. Hashing does not necessarily make information anonymous where a person can still be identified or matched.

Where relevant to digital interactions, we may process IP addresses, cookies or similar identifiers, device and browser information, interactions with webpages or marketing messages, and general location derived from technical information. We do not treat a hashed or pseudonymous identifier as anonymous merely because it is not directly readable.

We do not knowingly collect personal information from children under 18 for our consumer marketing datasets or target advertisements to them. If we discover such information, we investigate and take appropriate removal or suppression action.

We collect information through our own consumer-facing collection channels, websites, forms, registrations, promotions, surveys and digital interactions, as applicable to the relevant dataset. We may also receive information supplied by an individual or, where lawful, from another source or service provider acting on our behalf. The specific collection channel and permissions may vary by product and campaign.

At the relevant collection point, we take reasonable steps to provide the information required by Information Privacy Principle 3, including the purposes of collection, intended recipients, our identity and contact information, and access and correction rights, unless a statutory exception applies. Where we collect information indirectly on or after 1 May 2026, we assess and meet applicable Information Privacy Principle 3A notification requirements or a valid exception.

Our partners and customers collecting information indirectly must independently assess their own legal obligations, including any IPP 3A notice requirements. We may cooperate on notices and records of notification where appropriate, but this policy alone does not discharge every recipient’s duties.

Subject to the purposes communicated at collection and applicable law, we may use information to: maintain and validate consumer records; improve data accuracy; identify duplicates and manage suppression; conduct data matching, identity and contact verification; develop audience insights and segmentation; conduct analytics and modelling; facilitate direct marketing and advertising; administer surveys and promotions; provide data products and services to licensed business customers; meet legal obligations; and protect our systems and rights.

Where we use information to create marketing audiences or derived attributes, the information may be directly provided, validated, matched or inferred depending on the particular field. We do not describe inferred attributes as directly verified unless they are. We do not use personal information for a new purpose unless that use is permitted by law.

Our business model includes the non-exclusive sale, licensing, supply and disclosure of personal information and related data products to multiple independent business customers, authorised resellers, distributors, analytics providers, identity verification providers, advertising and marketing organisations and other commercial partners, where the applicable collection permissions and law permit that disclosure. No recipient receives exclusive rights by virtue of this Privacy Policy.

Intended recipients may include Acxiom and its relevant affiliated entities, as well as other present or future approved commercial partners. We may supply data via licensed data files, application programming interfaces (APIs), data matching or enhancement services, or other approved methods.

Where lawful and authorised by the applicable licence, a recipient such as Acxiom or another approved reseller or partner may process, match, enrich, analyse, distribute, license, sublicense or otherwise disclose the supplied information to its own authorised business customers and partners for permitted purposes, which may include marketing, advertising, consumer insights, data validation, identity verification and analytics. Their customers may in turn use or further disclose information only where the relevant law, collection permissions and contractual terms allow it.

These are descriptions of the types of disclosures we may make, not a representation that every record or field may be sold, disclosed or onward-licensed for every purpose. Each disclosure and onward disclosure must be supported by an applicable legal basis and subject to relevant contractual restrictions, security and privacy safeguards, individual rights and suppression requirements. We do not grant unrestricted rights to onward use or distribution.

Because Data Direct and some commercial recipients operate internationally, personal information may be accessed, stored or disclosed in Singapore, Australia, the United States and other countries in which authorised service providers, partners or customers operate. The specific countries depend on the applicable service and transaction.

When Information Privacy Principle 12 applies, we only make overseas disclosures where its requirements are met, including where the recipient is subject to the New Zealand Privacy Act, comparable safeguards apply, adequate contractual protections are in place, or another permitted statutory basis is available. Where reliance is placed on an individual’s authorisation under the relevant IPP 12 provision, we provide the information required by law about the potentially different level of protection.

Recipients who make subsequent cross-border disclosures are responsible for complying with legal requirements applicable to those disclosures. Contractual arrangements may impose safeguards for onward transfers.

Individuals may request that Data Direct stop processing their personal information for targeted advertising purposes, including the creation, selection or use of marketing audiences for targeted advertising. Requests may be made using the privacy contact details below. We will assess and action these requests in accordance with applicable law and the opt-out commitments described in this policy.

Individuals may also request that Data Direct cease selling, licensing or otherwise disclosing their personal information to third parties for direct marketing or advertising purposes. This choice applies to Data Direct’s non-exclusive licensing activities, including prospective disclosures to Acxiom and other authorised business customers, resellers and partners. We will implement applicable requests in our own systems and relevant future licensing or disclosure activities, subject to legal and contractual requirements.

Data Direct maintains a global suppression framework for recording and implementing relevant consumer opt-outs. We take reasonable steps to apply suppression to future uses and distributions for the relevant purposes and, where appropriate, communicate suppression updates or instructions to authorised data recipients. An opt-out request cannot necessarily reverse a lawful disclosure already made; downstream recipients remain responsible for their own lawful processing and for actioning requests applicable to them.

Commercial electronic messages sent by us or by parties using our information must comply with applicable laws, including New Zealand’s Unsolicited Electronic Messages Act 2007 where relevant. That includes applicable consent, sender-identification and unsubscribe requirements. The New Zealand Privacy Act 2020 does not establish an across-the-board statutory opt-out-of-sale right equivalent to certain United States state privacy laws; the sale and licensing opt-out described above is a Data Direct policy commitment, to the extent implemented and applicable. Individuals also retain their statutory access, correction and other applicable rights.

Individuals may request access to personal information we hold about them and request correction where they believe it is inaccurate, incomplete, out of date or misleading. We respond in accordance with the Privacy Act 2020, including applicable time frames, verification requirements and lawful exceptions. If we do not agree to a requested correction, individuals may have the right to attach a statement of correction sought.

Individuals may also contact us to raise a privacy concern, ask about the source of their information or request deletion or suppression. Deletion is assessed in light of applicable legal requirements and any legitimate retention basis; it is not an unconditional statutory right in every circumstance. We investigate complaints and explain the outcome. Individuals may also complain to the New Zealand Office of the Privacy Commissioner (www.privacy.org.nz).

We take reasonable steps appropriate to the circumstances to maintain accurate, complete and up-to-date information before use or disclosure, taking into account the purpose for which it is held. Our datasets and segments may be reviewed and refreshed on different schedules, which may range from weekly to monthly depending on the data product and source.

We use administrative, organisational and technical safeguards appropriate to the information and risks involved, including access controls and measures designed to prevent unauthorised access, misuse, loss, modification or disclosure. No transmission or storage method can be guaranteed absolutely secure.

We investigate suspected privacy breaches, take appropriate containment and remediation steps and notify the New Zealand Privacy Commissioner and affected individuals where the Privacy Act 2020 requires notification of a notifiable privacy breach.

We retain personal information only for as long as reasonably necessary for the purposes for which it may lawfully be used, or for applicable legal, contractual, security, dispute-resolution or compliance obligations. Retention periods and review cycles may vary by dataset and category of information.

When information is no longer required for a lawful purpose, we take reasonable steps to securely delete, destroy or de-identify it, subject to appropriate exceptions. We may retain limited suppression information where necessary to honour opt-out requests and prevent future re-contact or re-disclosure.

Our websites and digital communications may use cookies, tags, pixels, web beacons and similar technologies for website operation, analytics, performance measurement and permitted marketing activities. Technical information may include IP address, device/browser details, page interactions and approximate location. Where required, we provide notice or seek consent through the relevant interface. Further information may be provided in our Cookie Policy or at the collection point.

We may amend this Privacy Policy as our activities or the law change. The current version will be published on our website with an updated effective date. Where a material change requires fresh notice or consent for particular information or uses, we will take appropriate steps rather than relying solely on publication of the revised policy.

Data Direct Pte Ltd, 68 Circular Road, #02-21, Singapore 049422.

For privacy questions, access or correction requests, marketing opt-outs and complaints, please use the contact or opt-out facilities published at https://datadirect.com.sg/ or email [email protected].

This policy covers the New Zealand activities of Data Direct. The identity and contact details of individual authorised recipients may also be described in relevant collection notices and customer-facing policies.