Privacy Policy

This Data Protection Notice ("Notice") sets out the basis on which Kenneth & Co Lda. ("we", "us", or "our") may collect, use, disclose, or otherwise process personal data of our customers and website visitors in accordance with the Personal Data Protection Act 2012 ("PDPA") of Singapore. This Notice applies to personal data in our possession or under our control, including personal data in the possession of organisations which we have engaged to collect, use, disclose or process personal data for our purposes.

As a subsidiary of Kenneth & Co Pte Ltd, Kenneth & Co Lda. operates under the same data protection standards and governance framework as the Singapore parent company. Any personal data collected through this website (www.kennethac.tl) is processed in accordance with this Notice and the group-wide data protection policies of Kenneth & Co Pte Ltd.

As used in this Notice:

"Customer" means an individual who (a) has contacted us through any means to find out more about any goods or services we provide, or (b) may, or has, entered into a contract with us for the supply of any goods or services.

"Personal data" means data, whether true or not, about a customer who can be identified: (a) from that data; or (b) from that data and other information to which we have or are likely to have access.

Depending on your interaction with us, we may collect personal data including but not limited to:

• Full name and contact details (email address, phone number, mailing address)
• Company name, job title, and business registration details
• Enquiry content submitted through our contact form or newsletter subscription
• Identification documents where required for service delivery (e.g., business incorporation, employment of record)
• Financial information where required for accounting and tax services
• Website usage data collected via analytics tools (see Section 6 — Cookies)

We collect your personal data:

• Directly from you, or via your authorised representative with your consent;
• From third-party partners authorised by you;
• In compliance with applicable laws where consent is not required.

We use your personal data for purposes including, but not limited to:

• Providing, managing, and improving our corporate services including business incorporation, partner identification, employment of record (EOR), accounting & tax, BPO, training, and marketing services in Timor-Leste;
• Responding to enquiries, complaints, and feedback submitted through our website or contact form;
• Sending service updates, newsletters, and marketing communications (only with your explicit consent);
• Verifying your identity and processing payments;
• Conducting internal analytics, reporting, and operational improvements;
• Sharing relevant data with our parent company Kenneth & Co Pte Ltd (Singapore) for group-level reporting and service coordination;
• Complying with legal or regulatory obligations under the laws of Timor-Leste and Singapore.

Disclosure to Third Parties:

We may disclose your personal data to third parties solely for the purposes listed above, including our parent company Kenneth & Co Pte Ltd (Singapore); service providers and vendors who perform functions on our behalf (including CRM platforms, email providers, IT support, and payment processors); government agencies or law enforcement authorities as required or permitted by law. All third parties are contractually required to protect your personal data and use it only for authorised purposes. We do not sell your personal data.

As a subsidiary of Kenneth & Co Pte Ltd (Singapore), personal data collected through this website may be transferred to and processed in Singapore for group-level service coordination and reporting purposes. We ensure that comparable data protection standards are maintained when transferring personal data overseas, in accordance with the PDPA's cross-border transfer obligations.

Some third-party service providers or data storage systems may also be located outside Timor-Leste and Singapore. We will ensure that such transfers are made only to countries or organisations that provide an adequate level of data protection.

By providing your personal data or engaging with us, you consent to the collection, use, and disclosure of your personal data as described in this Notice.

You may withdraw your consent at any time by submitting a written request to our Data Protection Officer (DPO) at [email protected]. We will inform you of the consequences of such withdrawal, which may include our inability to provide certain services to you.

Withdrawal of consent will not affect any collection, use, or disclosure permitted or required by law without your consent.

We may use "cookies", where a small data file is sent to your browser to store and track information about you when you enter our website. Cookies are used to track information such as the number of users and their frequency of use, profiles of users, and their preferred pages. While cookies can tell us when you enter our site and which pages you visit, they cannot read data off your hard disk.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

We may also use third-party analytics tools (including Umami Analytics) to collect anonymised information about your browsing behaviour on our website. These tools help us analyse site usage and improve our services. We do not use advertising tracking pixels (e.g., Meta Pixel, Google Ads) on this website.

We implement reasonable administrative, technical, and physical safeguards to protect your personal data against unauthorised access, use, disclosure, modification, or loss. While we strive to protect your data, no security system is completely infallible. You acknowledge and accept this inherent risk.

You may request access to, or correction of, your personal data by contacting our DPO. We may charge a reasonable fee for access requests and will respond within 30 days.

We retain personal data only as long as necessary to fulfil the purposes outlined in this Notice or as required by applicable law. Once no longer needed, we will securely delete or anonymise your data.

In the event of a data breach involving your personal data, we will promptly take steps to contain and investigate the incident. Where required by law, we will notify the Personal Data Protection Commission (PDPC) of Singapore and affected individuals in accordance with the PDPA's mandatory data breach notification obligations.

We may update this Notice from time to time to reflect changes in our data practices or applicable law. The updated Notice will be posted on this page with a revised "Last Updated" date. Your continued use of this website after such changes constitutes your acceptance of the updated Notice.

For any enquiries, requests, or complaints regarding your personal data, please contact our Data Protection Officer: