Privacy Policy

1. Who we are, and what this covers

Vested is a company incorporated in Singapore. We operate an online marketplace at vested.com.sg that enables franchise owners and business sellers to list opportunities, and enables buyers to browse those listings and connect with them. In the course of doing so, we may provide support for deal-brokering, advisory services, and private document exchange.

This Privacy Policy explains how we collect, use, disclose and protect personal data under the Personal Data Protection Act 2012 (Singapore) ("PDPA"). It applies to everyone who uses the Platform: Buyers, Franchise Owners, Sellers, and visitors who do not hold an account.

This Policy forms part of the Additional Terms referred to in our Buyer (Investor), Seller and Franchise Owner Terms of Use. Words defined in those Terms have the same meaning here.

When you request or consent to connect with another platform user (such as a prospective buyer, business seller, or franchise owner), we disclose the necessary details to enable that connection or facilitate the deal.

Each receiving party acts as an independent organization regarding the personal data provided to them. We are not responsible for the independent actions, data management practices, or privacy compliance of external buyers or sellers once information has been transferred to them. Any requests regarding data held by another user should be directed to that user directly.

2. What we collect

2.1 If you register as a Buyer

• Account. Email address, and account credentials (stored in secure hashed format).
• Profile. Full name, mobile number, and available capital details.
• Buying context. Information regarding your buying entity (individual or company), timeline, operational preferences, preferred lease terms, experience, and industry background. You may provide some of this prior to completing account registration.

2.2 If you register as a Franchise Owner or Seller

• Contact. Brand or business name, contact name, email address, mobile number, and account credentials.
• Entity. When a company is registered in Singapore, your Singapore UEN will be verified against public business registries.
• Listing information. Operational and financial information you choose to publish, and answers to standard buyer questions. You are responsible for its accuracy under your Terms of Use.
• Documents. ACRA records, trademark records, franchise or transfer agreements, information packs, and supporting files you upload. These are stored securely and accessible only by authorized personnel. Documents uploaded for deal rooms/listings are shared at the user's own risk, and that Vested is not liable for downstream breaches by prospective buyers.

2.3 If you enquire without registering

If you use our enquiry or "list your franchise" forms, we collect your contact details (company email, company name, country of registration, registration number, full name, mobile number) so we can respond.

2.4 When you use the Platform

• Pages viewed, listings opened, filters applied, and steps completed on the site.
• Usage progress through our guides, checklist entries, and free-text notes.
• Technical and log information sent by your browser in the ordinary course of accessing the Platform.

2.5 Payment information

When payment features or fees apply under our Fee Schedule, payment processing will be handled securely by specialized third-party payment processors. We do not store full credit card or sensitive financial details on our primary servers.

3. Why we use data

• To create, operate, and maintain your account.
• To publish Listings and make them available to prospective Buyers.
• To pass enquiries to Franchise Owners or Sellers at your request.
• To verify business details and carry out identity checks where appropriate.
• To send transactional communications (e.g., account updates, notifications, listing statuses).
• To analyze platform usage, optimize operational performance, and improve our services.
• To maintain platform security, prevent fraud, and enforce our Terms.
• To comply with legal obligations and regulatory obligations.

We do not sell personal data.

4. Consent, and withdrawing it

We rely on your consent to share your details with sellers or partners as described in Section 5. Certain basic processing does not depend on consent and continues while your account exists, including core account operations, security maintenance, and legal compliance.

5. Who we disclose it to

5.1 Franchise Owners and Sellers

When buyers request a meeting or submit an enquiry for a specific listing, your basic details (such as full name, email, and mobile number) are shared with that Franchise Owner or Seller.

Once sent, those parties act as independent data controllers under applicable privacy laws. Under their Terms of Use, they may use those details solely to respond to your specific enquiry unless they obtain separate consent from you. Vested does not provide any warranty over third-party compliance.

5.2 Partners and syndication

Listings (and the public contact information included within them) may be displayed on partner platforms, co-branded portals, or in promotional materials as outlined in our Terms of Use. We do not syndicate non-public Buyer enquiry data to third-party ad networks or unrelated lead brokers.

5.3 Service providers

We engage trusted third-party service providers to assist in operating our Platform. These providers process data only on our instructions and for necessary operational purposes, including:

• Hosting & Database Management: Cloud infrastructure, authentication, and file storage providers.
• Communications: Transactional email and internal operational notification services.
• Verification Services: Public registry query providers (e.g., ACRA/data.gov.sg) for verifying UENs.
• Payment Processing: Certified payment gateway providers.
• Analytics & Operational Tools: Systems used to analyze aggregate platform usage and operational signals.

5.4 Legal and corporate disclosures

We may disclose personal data where required by law, regulation, court order, or governmental request; to enforce or defend legal rights; or in connection with a merger, acquisition, restructuring, or asset sale, provided the receiving entity agrees to respect data protection standards comparable to those in this Policy.

6. Transfers outside Singapore

Some of our service providers store or process personal data outside Singapore. Where cross-border data transfers occur, we take reasonable steps to ensure appropriate safeguards are in place (such as contractual protections) so that the transferred data receives a standard of protection comparable to the requirements under the PDPA.

7. Cookies and tracking technologies

We use essential cookies and similar technologies to keep you signed in, remember your preferences, and maintain session security. We also use operational cookies/analytics identifiers to collect aggregated usage information to understand platform interactions and improve performance.

You can manage or disable cookies through your browser settings, though some features of the Platform may not function properly without essential cookies.

8. Security

We employ technical and organizational security measures designed to safeguard personal data, including data encryption in transit, access controls, and secure password hashing. While we take reasonable measures to protect your data, no internet transmission or electronic storage system can be guaranteed to be 100% secure.

9. Your rights

Subject to applicable exemptions, conditions, and statutory limitations under the PDPA, you have the following rights:

• Access: Request access to your personal data held by us, and details on how it was used or disclosed within the 12 months preceding your request.
• Correction: Request correction of inaccurate or incomplete personal data.
• Withdrawal of Consent: Withdraw consent for future processing upon giving reasonable notice.
• Account Deletion & Data Erasure: Request account deletion. Upon request, we will cease retaining your personal data or remove identifiers, except where continued retention is authorized under law, required for regulatory compliance, or necessary for our legitimate business and dispute-defense purposes.

10. Contacting our Data Protection Officer

To submit a rights request or privacy inquiry, contact our Data Protection Officer at dpo@vested.com.sg.

Please note:

1. Identity verification is required prior to fulfilling requests.
2. As permitted under the PDPA, we may charge a reasonable administrative fee for access requests to cover processing costs.
3. Withdrawing consent for core data processing may result in the immediate suspension or termination of your platform account or deal room access.

11. Changes to this policy

We reserve the right to update or modify this Privacy Policy periodically to reflect changes in our business practices, operational requirements, or applicable law.

Any updates will be posted directly on the Platform with a revised "Effective Date" at the top of this Policy. Where required by applicable law or where changes are material, we may also notify you by displaying a prominent notice on the Platform or through updated Platform terms.

Your continued access to or use of the Platform after any such updates take effect constitutes your acknowledgment and acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy regularly.