1. Overview
Lydara Pte Ltd ("Lydara") provides training in agency management and consulting services to financial advisory (FA) firms. Because our work involves close contact with FA firms, their representatives, and — in some engagements — data and processes connected to regulated financial advisory activity, we take a security- and compliance-conscious approach to how we collect, handle, and protect information.
This statement describes our current data protection practices and the regulatory context relevant to our services. It is intended to give clients, partners, and FA firms a clear picture of how we safeguard information, and will be updated as our service offerings — including planned AI, IT, and distribution-related services — develop.
2. Data Protection Practices
Lydara's data protection practices are designed around the obligations set out in the Singapore Personal Data Protection Act 2012 (PDPA), including:
- Consent & purpose limitation — personal data is collected only for clearly stated purposes (e.g. training administration, consulting engagements, enquiries) and is not used for unrelated purposes without consent.
- Data minimisation — we collect only the information reasonably necessary to deliver training and consulting services, such as contact details, firm information, and attendance or engagement records.
- Access controls — personal data and client information are accessible only to personnel and consultants who require it to perform their role.
- Confidentiality — engagements with FA firms often involve sensitive business information (e.g. agency structures, performance data); such information is treated as confidential and is not shared outside the engagement team without authorisation.
- Retention & disposal — personal data and client records are retained only as long as necessary for the purposes collected or as required by law, and are disposed of or anonymised thereafter.
- Cross-border transfers — where data is processed by service providers located outside Singapore, we take reasonable steps to ensure a comparable standard of protection, consistent with PDPA requirements on overseas transfers.
[Placeholder] If/when Lydara appoints a formal Data Protection Officer (DPO), name and contact details should be added here, as required under the PDPA for organisations of a certain size or activity profile.
3. Technical & Organisational Measures
We apply a combination of technical and organisational measures appropriate to the size and nature of our operations, including:
- Use of reputable, mainstream cloud and productivity platforms with their own security certifications for email, file storage, and scheduling [e.g. Google Workspace / Microsoft 365 — specify actual tools used];
- Password-protected access to systems containing client or training data, with unique logins per user/consultant;
- Encryption in transit (HTTPS/TLS) for the company website and any web-based forms;
- Limiting the storage of sensitive client information to approved systems rather than ad-hoc personal devices or storage;
- Confidentiality undertakings for consultants and staff handling client and FA firm information;
- Periodic review of access permissions as engagements begin and end.
As a newly incorporated entity, Lydara's security programme is proportionate to its current scale. As the business grows — particularly with the planned introduction of AI and IT-based services — this section should be expanded to reflect additional measures such as formal information security policies, vendor risk assessments, and any relevant certifications (e.g. ISO 27001) that may be pursued.
4. Financial Services Compliance Context
Lydara itself does not provide financial advisory services, hold a Financial Adviser's Licence, or act as an Exempt Financial Adviser. Our role is to provide training and consulting on agency management practices to FA firms, which remain separately licensed and regulated by the Monetary Authority of Singapore (MAS) under the Financial Advisers Act and related regulations.
Where relevant to our engagements, we are mindful of the following compliance context that applies to our FA-firm clients (though the primary regulatory responsibility rests with the FA firms themselves):
- MAS Notice on Cybersecurity (FAA-N16) and related guidelines, which set expectations for licensed financial advisers regarding cybersecurity and technology risk management;
- MAS Guidelines on Outsourcing, which may be relevant where an FA firm engages external consultants or technology providers (such as Lydara, for future IT/AI offerings) in a manner considered "outsourcing" under MAS definitions;
- PDPA obligations of FA firms as data controllers, which Lydara supports by handling any personal data shared with us responsibly and in line with the firm's own instructions and obligations.
This section describes the regulatory context in which Lydara operates as a training/consulting provider to MAS-regulated firms. It does not constitute a representation that Lydara itself holds any MAS licence or is directly regulated by MAS. [Placeholder] As Lydara's services evolve, this section should be reviewed with legal/compliance counsel and expanded accordingly.
5. Third-Party Services
Our website and operations may rely on third-party service providers (e.g. website hosting, email delivery, scheduling tools, analytics, payment processing for future services). These providers are selected with consideration of their own security and data protection practices, and personal data is shared with them only as necessary to provide our services.
[Placeholder] List specific third-party providers once finalised, e.g. hosting provider, email platform, payment processor, analytics tool.
6. Incident Response
In the event of a data breach involving personal data, Lydara will assess the incident and, where required under the PDPA's mandatory data breach notification requirements, notify the Personal Data Protection Commission (PDPC) and affected individuals within the timeframes prescribed by law.
Clients who become aware of, or suspect, a security incident involving information shared with Lydara are encouraged to contact us promptly using the details in Section 8.
7. Future Services: AI, IT & Distribution
Lydara intends to develop additional capabilities in AI-driven tools, IT systems, and distribution channels to support FA firms and agency networks. As these services are developed and launched, this Security & Compliance Statement will be updated to address considerations specific to those offerings, which may include:
- How AI tools process and retain any input data, including whether client or end-customer data is used to train or improve models;
- Data residency and storage locations for any new platforms or systems;
- Additional security certifications or audits relevant to handling FA firm or end-customer data at scale;
- Any applicable MAS outsourcing, technology risk management, or cybersecurity requirements that become relevant as Lydara's role with FA firms expands.
This section is intentionally forward-looking and should be revisited with legal/compliance advice before any new AI, IT, or distribution service is launched, particularly where it involves processing personal data on behalf of MAS-regulated entities.
