Privacy Policy
This page explains what data UEN Lookup processes, why, and what rights you have. It covers company data built from ACRA's public register, and data about visitors who use the site or the contact form.
Who is responsible
The data controller is Ökrös László EV., a sole proprietorship registered in Hungary, which operates UEN Lookup. Because the controller is established in the European Union, the EU General Data Protection Regulation (GDPR) applies to the processing described here, even though the underlying register is Singaporean.
Privacy questions, corrections and removal requests: use the contact form.
1. Company data from ACRA, GeBIZ, BCA and HDB
Source and what we publish
Company profiles are built from ACRA's Information on Corporate Entities dataset, supplemented with government tender awards from GeBIZ and contractor registrations from BCA, plus HDB property data used only to detect residential addresses. The full list, licences and refresh schedule are on data sources & methodology. For a published company, we show its UEN, name, entity type, status, incorporation date, registered address (see the address note below), SSIC activity codes, former names, auditor, filing due dates, matched GeBIZ tender awards and matched BCA contractor registrations.
Entities we never publish anything about
Sole proprietorships and partnerships are excluded entirely, before anything is stored beyond the filtering step itself — never a page, never a search result, never a row on a category page. Their registered particulars belong to a natural person, not a company. The same applies to a limited liability partnership or limited partnership whose name contains no legal-form or business word (for example, a firm named after its partners): we treat it the same way. See data sources & methodology for exactly how this filtering works and how many entities it excludes.
A registered company's own name can occasionally include what looks like a person's name (a consultancy named after its founder, for instance). That name is still published, because it identifies the company, which ACRA itself publishes as a company record — not because we have judged it to be, or not be, about a specific individual.
What we never import
ACRA's export includes fields we discard while reading the source file, so they never reach our database at all: unit number, level number, other free-text address lines, and the officer count. BCA's registration data includes a phone number and a precise unit-level address, which we also discard on import — we keep only the workhead, grade and expiry date.
Address handling
If a registered address's block and street match an HDB block that HDB's own data flags as residential-only, we publish only the street name and the postal district (D01–D28) — never the block number, unit number or postal code. Every other registered address is shown as ACRA publishes it, minus the unit and level number.
Purpose and legal basis
The purpose is to let suppliers, employers, job seekers and business partners look up a Singapore company's registration status, activity and filing history in a form that is easier to search than ACRA's own systems. The site is intended to be financed by advertising.
The legal basis is our legitimate interest and the legitimate interest of these users (GDPR Art. 6(1)(f)). We have documented a balancing test — see docs/LIA.md in the project source, or request a copy at the contact form. The short version: the data was filed by the company itself with a public regulator as a condition of operating a business, ACRA already publishes it, and we exclude natural-person entities and their addresses entirely rather than redacting fields on a page.
How long we keep it
A company's page exists only while our pipeline's monthly refresh continues to place it in the published set — see data sources & methodology for how that set is chosen. Removing a company from our output does not affect ACRA's own record in any way.
If you ask us to remove a page, we add its UEN, the date of the request and an internal reference to a suppression list for as long as the site operates. That list is what stops the next monthly refresh from republishing it.
Your rights
- Removal and objection (Art. 21 and Art. 17). Use the contact form, topic "Removal request", with the UEN. No justification is required. We remove the page, its entries in category pages and the search index, and add the UEN to the suppression list within 30 days, and confirm by email.
- Access (Art. 15). Everything we hold about a company is on its own page, apart from a suppression-list entry if there is one. We will confirm this in writing on request.
- Rectification (Art. 16). If our page does not match ACRA's current record, tell us and we fix it at the next refresh. If ACRA's own record is wrong, it has to be corrected at the source through ACRA's own channels — we cannot change it.
- Restriction (Art. 18). While we check a disputed page, we can take it offline on request.
Who receives the data
Company pages are public, so anyone who visits the site can see them, and search engines index them. The site is hosted on Cloudflare's network.
2. Visitors
The site's own pages set no cookies and load no advertising script. Cloudflare Web Analytics, which we use to measure traffic, does not use cookies or collect personal data, so it needs no consent banner. The search box runs in your browser against a static index; what you type is not sent to us.
Cloudflare, our hosting and CDN provider, processes your IP address, browser user agent and the pages you request in order to deliver the site and protect it from abuse, and keeps these logs under its own retention rules. Legal basis: legitimate interest in running a secure website (Art. 6(1)(f)).
If a Turnstile challenge is shown on the contact form, Cloudflare Turnstile processes technical signals to tell a human from a bot, without tracking cookies used for advertising.
We plan to show display advertising once the site has enough traffic to be worth setting up. Before that happens we will update this policy and, for visitors from the EEA, the UK and Switzerland, add a consent mechanism before any advertising cookie is set.
3. Contact form
When you use the contact form, we process your name, email address, the topic you select, the UEN if you give one, and your message. We use them only to answer you and to carry out what you asked, such as a correction or a removal. Legal basis: legitimate interest in answering inquiries (Art. 6(1)(f)); for a removal request, also our legal obligation to act on it (Art. 6(1)(c)).
Submissions are stored in Cloudflare KV as a backup in case the notification email is lost. The notification is sent through Cloudflare's e-mail forwarding to a mailbox hosted by Google. We delete the message and your contact details 12 months after the request is closed. For a removal request, only the suppression-list entry described above is kept after that.
Transfers outside the EU
Cloudflare, Inc. and Google LLC are based in the United States. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection (Art. 45).
Complaints
You can complain to the data protection authority of the EU country where you live or work, or to our lead authority, the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11, Hungary; postal address 1363 Budapest, Pf. 9; ugyfelszolgalat@naih.hu; naih.hu. This right is not limited to EU residents. We would appreciate the chance to fix the problem first — use thecontact form.
Changes
When this policy changes, the date at the top changes with it. Changes that affect what we publish about companies are made to this page before the change goes live.