Two documents, not one. Terms of use govern the contractual relationship with visitors; the privacy notice discharges the notification obligation under the Personal Data Protection Act. Merging them produces a document that satisfies neither, and the privacy notice is the one a regulator will actually read.
Website Terms and Privacy Notice
[COMPANY NAME]
Two documents, not one. Terms of use govern the contractual relationship with visitors; the privacy notice discharges the notification obligation under the Personal Data Protection Act. Merging them produces a document that satisfies neither, and the privacy notice is the one a regulator will actually read.
| Item | Detail |
|---|---|
| Operator | [COMPANY NAME], UEN [UEN], of [ADDRESS] |
| Website | [URL] |
| Data Protection Officer | [NAME], [EMAIL], [PHONE] |
| Version and date | [NUMBER], effective [DATE] |
| Does the site sell to consumers? | [Yes — additional protections apply / No] |
| Does the site set non-essential cookies? | [Yes — consent banner required / No] |
| Are visitors outside Singapore expected? | [Yes — consider other jurisdictions / No] |
Part A
Terms of Use
1. Acceptance
1.1These terms govern your use of [URL] (the "Site"), operated by [COMPANY NAME]. By using the Site you accept these terms.
1.2We may amend these terms by posting a revised version. The version in force is the one published when you use the Site.
2. Use of the Site
2.1You may use the Site for lawful purposes only. You shall not:
(a)use it in any way that breaches applicable law or infringes another’s rights;
(b)introduce malicious code, or attempt to gain unauthorised access to the Site or any system connected to it;
(c)scrape, harvest or systematically extract content, or use automated means to access the Site, except as permitted by our robots file;
(d)reproduce, republish or redistribute Site content except as permitted in Clause 3; or
(e)use the Site in a way that impairs its availability for others.
2.2We may suspend or withdraw the Site, or any part of it, without notice. We do not guarantee uninterrupted availability.
3. Intellectual Property
3.1All content on the Site — text, graphics, logos, images, software and data — is owned by us or our licensors and is protected by intellectual property law.
5 more pages in the Word file
This is page 1 of the Word document, exactly as it appears when you open it. Fields shown like THIS are placeholders for you to complete.
These notes accompany the template and explain the drafting choices, the compliance points and the mistakes most often made with this document. They appear as a final page in the Word file, intended to be deleted before the document is executed.
Terms of use are contractual; the privacy notice discharges the statutory notification obligation. Merging them buries the privacy content in legal boilerplate that nobody reads, and it is the privacy notice a regulator or a complainant will focus on. Keep them as clearly separated parts, or as separate pages.
Appointing an officer is mandatory and the business contact information must be made available. The privacy notice is the natural place. A notice with no named contact, or a generic address nobody monitors, is among the first things checked.
Purposes described as "business purposes" or "to improve our services" notify nothing and will not support any later use. The table in Clause 8 forces each category of data to have a stated purpose, basis and retention period — and completing it honestly usually reveals data being collected for no articulated reason.
Consent is not the only basis, and it is often the weakest. Where legitimate interests or business improvement is relied on, an assessment must be carried out and documented before reliance, and the reliance disclosed. The basis column is not decoration.
Retention limitation requires data to be disposed of once the purpose has ended. A notice with blank or indefinite retention periods advertises that the obligation is not being met. If you cannot state a period, you do not have a retention practice.
Consent required as a condition of a service, beyond what is reasonably needed to provide it, is not valid. A single tick box covering both service delivery and marketing is the classic failure. Ask separately.
Marketing to Singapore telephone numbers by call or text engages the Do Not Call obligations in addition to data protection consent. A person may have consented and still be on the register. Clause 12.3 states the practice; enforcement in this area is common.
Strictly necessary cookies do not need consent; functional, analytics and marketing cookies generally do. A banner that sets all cookies on page load and offers only an "accept" button is not obtaining consent. Provide a genuine choice and honour it.
Analytics and advertising cookies frequently transfer data to third parties in other jurisdictions. Identifying them, with links to their own policies, is both good practice and necessary for the transfer disclosure in Clause 10.
Where hosting, email, analytics or support providers are outside Singapore, personal data is being transferred, and the recipient must be bound to a comparable standard of protection. This is usually addressed contractually. List the countries honestly — most companies transfer more widely than their notice admits.
Respond as soon as reasonably possible, and where that exceeds thirty days, tell the individual when you will respond. Have a process before the first request arrives, and log requests and outcomes.
Where the site sells to consumers, statutory protections apply regardless of the terms, and unreasonable exclusions may be unenforceable. Clause 5.1 preserves statutory rights. A terms page that purports to exclude everything is both ineffective and a poor signal.
Comments, reviews, uploads and forum posts all raise ownership, licensing and moderation questions. Clause 4.4 covers the basics; a site with substantial user content needs more, including a takedown process.
A new analytics tool, a chat widget, a payment provider or a marketing platform each changes what data is collected and who receives it. The notice drifts out of date silently. Tie the review to any change in the technology stack, not only to an annual calendar.
Reflects Singapore law current as of {{DATE OF USE}}. The Personal Data Protection Act has been amended and further provisions may come into force, and Do Not Call and consumer protection requirements change — have both parts reviewed by a lawyer, particularly where the site sells to consumers, targets visitors outside Singapore, or processes sensitive data.
This is a ready-to-use template provided for convenience. Laws and requirements change, and every situation is different — please have it reviewed by a qualified professional (a lawyer, corporate secretary, or accountant as relevant) before you rely on it.