Privacy Notice — APAC (Australia, Singapore, Japan)

For individuals in Australia, Singapore, Japan and other Asia-Pacific markets. Read alongside our main Website & Marketing Privacy Notice, which this notice supplements.
Effective date: August 2026

This supplement applies if you are located in Australia, Singapore, Japan, or another Asia-Pacific market we operate in. It sits alongside, and does not replace, our main Website & Marketing Privacy Notice.

 

1. Australia — Privacy Act 1988

For individuals in Australia, we handle personal data in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Following the Privacy and Other Legislation Amendment Act 2024, this includes:

  • A right for individuals to complain to us directly, and afterwards to the Office of the Australian Information Commissioner (OAIC), about our handling of their personal data
  • Our obligation to notify the OAIC and affected individuals of an eligible data breach likely to result in serious harm, under the Notifiable Data Breaches scheme
  • From 10 December 2026, a requirement to describe in this notice any use of automated decision-making that uses personal data and could significantly affect an individual, along with the types of data used in that process

Charcoalblue’s turnover means we ___ within scope of the Privacy Act — this should be confirmed with Australian counsel given ongoing reform in this area.

 

2. Singapore — Personal Data Protection Act (PDPA)

For individuals in Singapore, we process personal data in accordance with the PDPA, administered by the Personal Data Protection Commission (PDPC). This includes obtaining consent (or relying on a specific statutory exception) before collecting, using or disclosing personal data, and notifying the PDPC and affected individuals of a data breach that is of a significant scale or likely to cause significant harm.

  • Where we transfer personal data from Singapore to another country, we take steps to ensure the recipient provides a standard of protection comparable to the PDPA, in line with the PDPA’s transfer limitation obligation
  • Marketing calls or texts to Singapore telephone numbers are checked against the Do Not Call registry before being sent

 

3. Japan — Act on the Protection of Personal Information (APPI)

The APPI applies to our handling of personal data belonging to individuals in Japan, even though Charcoalblue does not have a Japanese entity, because the APPI applies extraterritorially to businesses handling data of individuals located in Japan. Under the APPI:

  • We will notify individuals of the purpose of use of their personal data and will not use it beyond that purpose without appropriate steps
  • Where we transfer personal data from Japan to a country not recognised as providing an equivalent level of protection, we will obtain informed consent, disclosing the relevant differences in the destination country’s data protection framework, or otherwise put in place APPI-equivalent safeguards

The APPI is currently subject to a reform bill before the Japanese Diet (submitted April 2026), so this section should be reviewed again once that bill is finalised.

 

4. Contact for APAC privacy requests

Individuals in Australia, Singapore, Japan or other APAC markets can exercise their data protection rights by contacting [email protected], or the Singapore DPO contact above for Singapore-specific requests.