Privacy Policy

Effective date: 21 July 2026 · Last updated: 21 July 2026

1. Introduction

LegalRush Pte. Ltd. (“LegalRush,” “we,” “us,” or “our”) is a Singapore law practice registered under UEN 202439182K, operating from 16 Circular Road, #03-02, Singapore 049368, and the website legalrush.pro (the “Site”). We are committed to protecting personal data in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”) and applicable subsidiary legislation.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and disclose it, how long we retain it, and what rights you have. By using the Site, submitting a rush intake form, visiting our chamber, engaging us for legal services, or otherwise interacting with us, you acknowledge that you have read this Privacy Policy. Where consent is required under the PDPA, we obtain it before collecting or using personal data for the stated purpose.

2. Data controller

LegalRush Pte. Ltd. is the organisation responsible for personal data described in this policy. For data protection enquiries, contact us at [email protected] with subject line “PDPA enquiry” or write to LegalRush Pte. Ltd., 16 Circular Road, #03-02, Singapore 049368. General chamber enquiries may be directed to the same email or +65 6284 3916.

3. Personal data we collect

We collect personal data only where necessary for defined purposes. Categories include:

• Identity and contact data: name, email address, telephone number, company name, job title, and business address submitted via rush intake, email, or engagement letters.
• Communication data: message content, matter type selection, attachments, chronograph stage notes, and correspondence timestamps.
• Client matter data: contracts, corporate records, employment documents, and regulatory filings you provide for legal review — treated as confidential client information subject to legal professional privilege where applicable.
• Technical data: IP address, browser type, device information, referring URL, and pages visited — collected through server logs and optional analytics cookies where you consent.
• Cookie preference data: your cookie consent choices stored locally in your browser for up to six months.
• Billing data: invoice details, payment confirmations, and tax identifiers for corporate clients — not full payment card numbers, which are handled by payment processors.
• Chamber visit data: visitor registration name and contact details, meeting logs, and CCTV footage where signage is displayed at entry.

We do not intentionally collect sensitive personal data through the Site contact form beyond what you voluntarily attach. Please avoid submitting NRIC numbers, medical records, or unrelated third-party personal data via the public form. Secure document transfer instructions are provided after scope confirmation for active matters.

4. How we collect personal data

Personal data is collected through:

• Voluntary submission of the rush intake form processed by send.php and routed to our designated mailbox.
• Direct email, telephone, video conference, or in-person meetings at the chamber.
• Written engagement letters and matter instructions once a solicitor–client relationship is established.
• Automatic collection via server logs when you browse the Site.
• Cookies and similar technologies subject to your consent for non-essential cookies — see our Cookie Policy.
• Third-party corporate registries and public sources where necessary for conflict checks and due diligence with lawful basis.

5. Purposes of collection, use, and disclosure

We collect and use personal data for purposes including:

• Responding to rush intake enquiries and issuing scope letters.
• Delivering legal services under engagement letters — contract review, corporate secretarial work, employment advisory, regulatory memos and related counsel.
• Managing docket chronograph stages and client status communications.
• Conducting conflict checks before accepting new matters.
• Billing, accounting, and compliance with statutory record-keeping obligations.
• Operating, maintaining, and improving the Site.
• Complying with court orders, regulatory requests, and professional conduct rules.
• Protecting the chamber, staff, and clients through access controls and CCTV where permitted.
• Analytics to understand Site usage patterns, only with consent for analytics cookies.

We may disclose personal data to:

• Counsel, trainees, and administrative staff bound by confidentiality and privilege obligations.
• Service providers assisting with hosting, email delivery, document management, and IT support — under data protection agreements.
• External counsel, translators, or expert witnesses where necessary for your matter with appropriate safeguards.
• ACRA, courts, regulators, or law enforcement when required by Singapore law or with your consent.

We do not sell personal data. We do not use client matter data to train public AI models. Transfers outside Singapore occur only where necessary for hosting or specialist support, with contractual safeguards or consent as required.

6. Legal basis and consent

Under the PDPA, we rely on:

• Consent: for rush intake form submissions (consent_pdpa checkbox), optional cookies, and marketing where ever offered.
• Legitimate interests: for conflict checks, chamber security, and aggregated analytics — balanced against your rights.
• Legal obligation: for trust accounting, anti-money laundering checks where applicable, and responses to lawful requests.
• Contractual necessity: for performing legal services you instruct us to provide.

You may withdraw consent by emailing [email protected]. Withdrawal does not affect lawfulness of prior processing. We may continue processing where another legal basis applies, including ongoing matters requiring retention under professional rules.

7. Retention

We retain personal data only as long as necessary:

Data type	Retention period
Rush intake enquiries not converted to matters	24 months from last correspondence
Client matter files	Minimum 7 years after matter closure unless longer required by law or agreement
Financial and trust records	7 years (statutory requirement)
Server logs	90 days
Cookie consent records	6 months (browser local storage)
CCTV footage	30 days rolling unless incident investigation requires longer

When data is no longer needed, we delete or anonymise it securely subject to legal hold requirements.

8. Your rights under the PDPA

Subject to PDPA exceptions, you have the right to:

• Access personal data we hold about you and information about how it has been used or disclosed in the past year.
• Correction of inaccurate or incomplete personal data.
• Withdraw consent for processing that relies on consent.
• Data portability where technically feasible and applicable.

To exercise these rights, email [email protected] with sufficient detail to identify you and your request. We respond within thirty days unless an extension is permitted. A reasonable fee may apply for manifestly unfounded or excessive access requests as allowed under the PDPA.

Access requests relating to active client matters may require identity verification and could be limited where disclosure would affect another person’s rights or legal professional privilege. Correction requests should specify inaccurate fields and proposed corrections. We notify relevant third parties of corrections where required.

If you believe we have not handled personal data properly, you may contact the Personal Data Protection Commission (PDPC) of Singapore after giving us an opportunity to resolve your concern.

9. Data breach notification

In the event of a data breach likely to result in significant harm or affect a significant number of individuals, we will notify the PDPC and affected individuals as required under the PDPA. Our breach response includes containment, assessment, documentation, and remediation. Staff are trained to escalate suspected breaches immediately. If you suspect unauthorised access to personal data held by LegalRush, contact [email protected] without delay.

10. Security

We implement administrative, technical, and physical safeguards including HTTPS on the Site, encrypted storage for matter documents, role-based access controls, staff confidentiality training, and secure disposal of physical records. Client portals and email channels use authentication appropriate to sensitivity. No transmission over the internet is completely secure; we advise against sending highly confidential attachments via the public rush intake form before secure channels are established.

11. Third-party links

The Site may link to external sites such as ACRA, maps, or professional bodies. We are not responsible for their privacy practices. Review their policies before submitting personal data.

12. Children

The Site is not directed at children under thirteen. We do not knowingly collect personal data from children through the Site. Contact us to delete such data if discovered.

13. Changes to this policy

We may update this Privacy Policy to reflect legal, operational, or Site changes. Material updates will be posted here with a revised “Last updated” date. Significant changes affecting consent-based processing may require renewed consent.

14. Contact

LegalRush Pte. Ltd.
16 Circular Road, #03-02, Singapore 049368
Email: [email protected]
Phone: +65 6284 3916
UEN: 202439182K