GDPR Compliance

Last updated: May 25, 2026

Our Commitment to GDPR

Panto Affis is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR). This page outlines how we handle your personal data in accordance with GDPR requirements.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you provide explicit consent for specific processing activities
• Contract: When processing is necessary to fulfill our contractual obligations to you
• Legal Obligation: When we must process data to comply with legal requirements
• Legitimate Interest: When processing is necessary for our legitimate business interests

Your GDPR Rights

Under GDPR, you have the following rights:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format.

Right to Rectification

You can request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You can request deletion of your personal data when there is no compelling reason for us to continue processing it.

Right to Restrict Processing

You can request that we limit the processing of your personal data in certain circumstances.

Right to Data Portability

You can request that we transfer your personal data to another organization or directly to you in a machine-readable format.

Right to Object

You can object to the processing of your personal data for direct marketing purposes or based on legitimate interests.

Right to Withdraw Consent

Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Data Protection Officer

For GDPR-related inquiries, you can contact our Data Protection Officer:

Email: [email protected]
Address: 42 Robinson Road, #15-06 CPF Building, Singapore 068908

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Active student records: Duration of enrollment plus 7 years
• Marketing communications: Until consent is withdrawn
• Financial records: 7 years as required by law

International Data Transfers

When we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Transfers to countries with adequate data protection as determined by the European Commission
• Other legally approved transfer mechanisms

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and within 72 hours of becoming aware of the breach, as required by GDPR.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: [email protected]

We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months and will inform you of the extension.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR.

Updates to This Page

We may update this GDPR compliance page from time to time to reflect changes in our practices or legal requirements.