Privacy Notice

We, Bain Squared Pte. Ltd., a company incorporated in Singapore with registered office at 7 Temasek Boulevard, Suntec Tower One, Singapore 038987, understand that your privacy is important to you. We are committed to respecting your privacy and protecting your personal data. This Privacy Notice describes how we handle and protect your personal data (the "Privacy Notice") when we collect it through our website at bainsquared.com, our applications, and our digital assets (collectively, the "Sites"), and through our externally facing business activities, such as service offerings, events, surveys, and communications.

This Privacy Notice is issued in accordance with the Singapore Personal Data Protection Act 2012 (the "PDPA") and, where applicable, the EU General Data Protection Regulation (the "GDPR") and the UK GDPR.

For the purposes of this Privacy Notice, personal data means information about an identified or identifiable individual, and does not include information that cannot be attributed to an identifiable individual, such as information of an anonymous or aggregated nature. You are not required to share your personal data with us, but failing to do so may result in Bain Squared being unable to properly provide you with our full range of services, communications, or a usable experience with our Sites.

This notice explains our practices. It does not replace consent where consent is required. Contact us if you have questions about how we use your information.

See our Terms of Use for the other terms that apply to your use of our Sites.

Contents

1. Data controller
2. How we collect your personal data
3. Why and how we use your personal data
4. Who we share your personal data with
5. International transfers of personal data
6. How long we keep your personal data
7. How we protect your personal data
8. Your rights
9. Cookies and similar technologies
10. Children
11. Updates to this Privacy Notice
12. Contact us

1. Data controller

Bain Squared Pte. Ltd. is the data controller responsible for the personal data we collect and process through the Sites and through our business activities. For the purposes of the PDPA, we are the organisation that determines the purposes and means of the processing of your personal data. Where the GDPR applies, we act as the data controller, unless we have been engaged by a client to process personal data on their behalf, in which case we act as a data processor under our agreement with that client.

2. How we collect your personal data

We collect personal data in the course of our business activities directly from you and, in some cases, from third parties.

We collect personal data about you when:

• You contact us by email, web form, or telephone to enquire about our services or to request information.
• You sign up to receive our publications, including Perspectives, Squared Reports, Looking Glass, or Field Notes.
• You attend or register for an event, briefing, or roundtable that we run.
• You participate in a client engagement, either as the client signatory or as a member of the client team.
• You apply for a role with us through our Careers pages or through a recruiter we work with.
• You interact with us on professional social media platforms such as LinkedIn.
• You visit our Sites and your browser sends technical information needed to deliver the pages.

We may also receive personal data about you from third parties, including service providers, data vendors, public business registries, and your employer where you are a member of a client team. Where we collect personal data from third parties, we take reasonable steps to confirm that the third party has lawfully collected the data and is authorised to share it with us for the purposes described in this Privacy Notice.

3. Why and how we use your personal data

We use your personal data only for the purposes for which it was collected, or for purposes that are closely related, unless we obtain your further consent or are otherwise permitted by law.

Specifically, we use your personal data to:

• Respond to your enquiries and provide the information or services you have requested.
• Deliver our advisory services and manage our client engagements, including communicating with you, preparing deliverables, and operating the working tools we use during a project.
• Send you our publications and event invitations where you have asked to receive them.
• Run our recruiting process if you have applied for a role with us.
• Operate, secure, and improve our Sites.
• Comply with our legal, regulatory, and professional obligations.
• Detect, prevent, and respond to fraud, security incidents, and other unlawful activity.

Where the GDPR applies, our lawful bases for processing your personal data are: (a) performance of a contract with you or with the client you represent; (b) our legitimate interests in operating, securing, and developing our business; (c) compliance with a legal obligation; and (d) where required, your consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Who we share your personal data with

We do not sell your personal data. We share personal data only as needed to run our business and only with parties that are subject to appropriate confidentiality and data protection commitments.

The categories of recipients we share personal data with include:

• Our personnel, including partners, employees, and contracted operators working on the engagement.
• Clients, where the personal data is collected in the course of delivering services to them.
• Service providers that support our operations, including hosting, email, productivity software, analytics, payments, professional advisers, and recruiting platforms.
• Regulators, courts, and law enforcement, where we are required by law to do so.
• Acquirers or successors, in the event of a reorganisation, merger, sale, or similar transaction.

5. International transfers of personal data

We are headquartered in Singapore and may transfer your personal data to, and store and process it in, jurisdictions outside Singapore, including jurisdictions whose data protection laws may differ from those of your home country.

Transfers outside Singapore require protection comparable to that required under the PDPA, subject to applicable exceptions. Where other data protection laws apply, the relevant transfer requirements must also be met. Contact us for information about the arrangements applicable to your data.

6. How long we keep your personal data

We retain your personal data only for as long as needed for the purposes for which it was collected, to comply with our legal, regulatory, and professional obligations, and to resolve disputes and enforce our agreements. When we no longer need your personal data, we will either delete it or anonymise it so that it can no longer be associated with you.

7. How we protect your personal data

We are responsible for making reasonable security arrangements to protect personal data in our possession or control. The arrangements should reflect the sensitivity of the information and how it is used. No method of transmission or electronic storage is fully secure. Please avoid sending sensitive client or financial information in an initial enquiry.

8. Your rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Access. You may request a copy of the personal data we hold about you.
• Correction. You may ask us to correct personal data that is inaccurate or incomplete.
• Withdrawal of consent. Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
• Deletion. Where the GDPR or UK GDPR applies, you may ask us to delete your personal data in certain circumstances.
• Restriction and objection. Where the GDPR or UK GDPR applies, you may ask us to restrict our processing of your personal data or object to it in certain circumstances.
• Portability. Where the GDPR or UK GDPR applies, you may ask us to provide your personal data in a structured, commonly used, machine-readable format.
• Complaint. You may lodge a complaint with the Personal Data Protection Commission of Singapore or, where applicable, your local data protection authority.

To exercise any of these rights, please contact us using the details in the Contact us section below. We may need to verify your identity before responding.

9. Cookies and similar technologies

Your browser and the services used to deliver the Sites may store or receive technical information. You can manage cookies and local storage through your browser settings. Any optional analytics or marketing technologies will require an appropriate notice and, where required, consent before use.

10. Children

Our Sites and services are intended for an adult business audience. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have collected personal data from a child, please contact us so that we can take appropriate steps to delete it.

11. Updates to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, our services, or applicable law. The current version is always posted at this URL, with the Last updated date at the top of the page. Where the change is material, we will provide a more prominent notice or, where required by law, seek your consent.

12. Contact us

If you have any questions about this Privacy Notice or about how we handle your personal data, or if you would like to exercise any of your rights, please contact us at hello@bainsquared.com or by post at: