BridgeX Consulting Pte. Ltd. runs www.bridgex.sg, where people who want to franchise (franchisees) and F&B brands meet and connect. We handle personal data under Singapore’s Personal Data Protection Act (PDPA). The Platform is for people aged 18 and over only. Data Protection Officer: Tony Liew, dpo@bridgex.sg; the DPO’s contact details were registered with the Personal Data Protection Commission on 18 September 2026.

Franchisees: email and password (the login service stores the password as a one-way hash, which we cannot see, and records the time, IP address and browser of each login); the 5-question screening form (categories, funds range, timeline, awareness of franchise fees, risk acknowledgement) — no name and no phone number; consent records (time, version and text fingerprint); when you enquire: preferred area, experience and involvement (required), how the brand should address you and whether you are a Singapore citizen or PR (optional), a message to the brand (optional), and your mobile number only if you choose to share it with that brand; enquiry progress; data-room viewing records; last activity time. Brands: account email, contact name at self-registration, brand details, data-room material and registration information, the signatory’s name and title and the browser at confirmation; whenever the brand accepts the Listing Agreement (when confirming its listing details, or by ticking the acceptance box when paying), the agreement version accepted, the date and time, the account used and the IP address; payment records returned by Stripe for online payments (payer name, email and billing address — no card number), and verification documents (the brand must have consent for any third-party personal data in them — Listing Agreement 6.5). All visitors: a random browser identifier (not your identity) for aggregate page statistics, including which pages and sections were viewed and whether you were a visitor, registered or screened at the time; local storage for language, unsent form drafts, login state, the brand you selected in the brand portal and the invitation link token. No advertising trackers.

To assess screening, arrange introductions and tell you about their progress; to show brand pages and verify brand information; to send notification emails; to produce aggregate usage statistics; and to keep necessary records for security and accountability. We will not send you promotional messages without your consent.

Brands see your summary when you enquire (category, funds range, timeline, area, experience, involvement, and the optional salutation and citizen/PR answer, your message to the brand and, if you are also a member of a brand on the platform, that fact without naming the brand) — never your full name or contact details; they see your email, and the mobile number you chose to share, only after accepting. BridgeX staff, and the service providers who help us develop, maintain and operate the platform, handle data to the extent their work requires and are bound by confidentiality obligations. Service providers acting for us: Supabase (database, login and file storage, Singapore; its edge functions run at the location nearest to you), Cloudflare (hosting and delivery; like any web service, Cloudflare and Supabase see your IP address in transit), Resend (notification and account emails, Tokyo, Japan), Stripe (online payments by brands; card numbers are handled by Stripe and not stored by us), Microsoft 365 (our email, e.g. dpo@bridgex.sg), Lark (our internal communication tool — information mentioned when we discuss problems passes through it), GitHub (code hosting and deployment; deployments connect to the database with credentials to apply changes, United States). If a brand chooses to send us material by WhatsApp or email, that material is first handled by Meta (WhatsApp) or Microsoft (email). We do not sell your data or give it to advertisers. Transfers outside Singapore: some service providers process data outside Singapore (for example, Resend processes email in Tokyo, Japan; Stripe, Cloudflare, Microsoft and GitHub use global networks). We choose providers that commit to protecting personal data, and they handle it under their own terms of service.

Screening results are valid for 12 months, after which the form must be completed again. Answers to a screening form that was not passed are cleared 12 months after it was declined; answers to a passed form that has expired (including an earlier form replaced by a newer one) are cleared 12 months after the screening expired — only the result and the dates are kept. Franchisee accounts unused for 24 months with no open enquiry in the last 12 months: we clear the screening answers, the area, experience, involvement and optional items entered at enquiry (including the summary sent to brands) and the mobile number — your message to the brand stays as part of the enquiry record — and replace the email in our records with a code derived from a hash of it (the email is no longer shown); the login account itself is not deleted automatically — write to the DPO to delete it. Verification originals: deleted within 7 days after the conclusion on that check, or within 30 days after the listing agreement ends if that is earlier (except where a legal hold applies; a document received after the conclusion is counted from the conclusion made on that document); the verification record (the check, the decision, the date, the reviewer and a list of documents reviewed — no originals) is kept for 3 years; once all checks are complete, the brand may also ask in writing for the originals to be deleted earlier. Consent records are kept for 3 years after the account is deleted, as proof of what you agreed to, and then deleted. Data-room view records are kept for 3 years and then deleted (the cumulative view count shown to the brand is kept). When a brand’s listing ends (is terminated), its brand page and data room stop being shown to anyone at once; data-room content is deleted within 30 days after termination, and so are verification originals, as above. A listing whose term has run out without payment is only hidden, not deleted, and is shown again once payment is received; if payment has still not been received 90 days after it was hidden, it is treated as terminated. Brand profile information is not deleted automatically; the brand can ask the DPO at any time to delete it or its data-room content. Payment and invoice records are kept for at least 5 years as required for tax purposes. Other data is kept while the account exists; you can ask us to delete it at any time.

You may ask to access or correct your personal data, or withdraw consent, by writing to dpo@bridgex.sg; we reply within 30 days. If you withdraw consent, we stop using your data for screening and introductions, and those features will no longer be available to you. You may complain to the PDPC.

Encrypted connections throughout; access limited by account and role; the data room is shown only to screened candidates, with a viewer watermark and a log on every view (if the log fails, nothing is shown); the admin console requires a one-time code to log in.

When this policy changes, the version number and date on this page change too. The version matches the consent on the screening form: this is P-v1.5.