This Privacy Policy explains how Nora Lim ("I", "me") collects, uses, and protects personal data when you visit taleforge.life ("the Site"). The Site is a personal blog operated from Singapore. I aim to comply with the Personal Data Protection Act 2012 ("PDPA") and its subsidiary legislation, including the Do Not Call Registry requirements where applicable.

1. Data controller

The data controller for this Site is Nora Lim, reachable at Blk 26 Tiong Bahru Road #03-05, Singapore 165026, telephone +65 6413 8275, email [email protected]. I am responsible for decisions about how personal data is handled in connection with the Site.

2. Scope

This policy applies to personal data collected through the Site and through direct correspondence (post, telephone, email) initiated because of the Site. It does not apply to third-party websites linked from the Site, including Google Maps when you choose to load embedded maps. Those services have their own privacy notices.

3. What personal data I collect

3.1 Data you provide voluntarily

If you write to me by post, telephone, or email, I receive whatever information you choose to include — typically your name, contact details, and message content. I do not operate contact forms on the Site, so no data is collected through automated submission fields.

3.2 Technical data collected automatically

When you visit the Site, standard web server logs may record your IP address, browser type, referring page, requested URL, and timestamp. I use these logs for security, troubleshooting, and understanding aggregate traffic patterns. I do not currently use third-party analytics services on the Site.

3.3 Cookies and similar technologies

The Site uses cookies to remember your cookie consent preferences. Optional functional cookies enable Google Maps embeds when you accept them. Details appear in the Cookie Policy. Essential cookies are necessary for basic Site function and consent storage.

4. Purposes of collection, use, and disclosure

I collect and use personal data only for purposes a reasonable person would consider appropriate in the circumstances, including:

  • Operating and maintaining the Site;
  • Responding to correspondence you initiate;
  • Remembering your cookie preferences;
  • Protecting the Site against abuse, fraud, or security incidents;
  • Complying with legal obligations in Singapore.

I do not sell personal data. I do not use your data for direct marketing unless you have given clear consent, and I do not currently send marketing messages.

5. Legal basis and consent

Under the PDPA, organisations must obtain consent before collecting, using, or disclosing personal data, unless an exception applies. For cookie preferences, I rely on your explicit choice via the cookie banner. For correspondence you send me, I treat your message as consent to use the data provided to respond. For server logs, I rely on legitimate interests in operating a secure website, balanced against your reasonable expectations when visiting a static personal blog.

6. Disclosure to third parties

I may disclose personal data to:

  • Hosting and infrastructure providers who process data on my instructions to keep the Site online;
  • Google LLC, if you enable functional cookies and load Google Maps embeds — Google may collect data according to its own policies;
  • Authorities or parties where required by law, court order, or to protect rights and safety.

I require service providers to protect personal data and use it only for the services they provide to me. I do not authorise them to use your data for their independent marketing.

7. Overseas transfers

Some service providers may store or process data outside Singapore. Where personal data is transferred overseas, I take steps reasonably required under the PDPA to ensure the receiving organisation provides a standard of protection comparable to the PDPA, such as contractual clauses or selecting providers with recognised safeguards.

8. Retention

I retain personal data only as long as necessary for the purposes described above. Email correspondence is kept while the thread remains relevant and deleted within a reasonable period after resolution unless I am required to retain it longer. Server logs are rotated and deleted on a rolling basis, typically within ninety days. Cookie consent records persist for up to one hundred eighty days, matching the cookie Max-Age.

9. Your rights under the PDPA

Subject to exceptions in the PDPA, you may:

  • Request access to personal data about you that is in my possession or under my control;
  • Request correction of inaccurate personal data;
  • Withdraw consent for optional processing, such as functional cookies, without affecting the lawfulness of prior processing;
  • Request information about how your data has been used or disclosed within the preceding year.

To exercise these rights, contact [email protected] with sufficient detail for me to identify you and locate relevant records. I will respond within a reasonable time and may charge a fee for manifestly unfounded or excessive access requests as permitted by law.

10. Accuracy

I take reasonable steps to ensure personal data is accurate and complete when used. If you believe information I hold about you is wrong, please tell me so I can correct it promptly.

11. Protection

I implement reasonable administrative, technical, and physical safeguards appropriate to the sensitivity and volume of data processed. These include access controls on hosting accounts, encrypted transport (HTTPS where configured), and limited personal access to correspondence. No method of transmission over the internet is completely secure; I cannot guarantee absolute security.

12. Data breach notification

If a data breach occurs that is likely to result in significant harm or affect a significant number of individuals, I will assess the incident and, where required, notify the Personal Data Protection Commission and affected individuals in accordance with the PDPA and applicable guidance.

13. Children

The Site is intended for general audiences and is not directed at children under thirteen. I do not knowingly collect personal data from children. If you believe a child has provided personal data, contact me and I will delete it.

14. Do Not Call Registry

I do not send telemarketing messages to Singapore telephone numbers. If you contact me by phone, I will not add your number to marketing lists. If this practice changes in future, I will honour Do Not Call Registry obligations and obtain required consent before sending specified messages.

15. Third-party links and embeds

Pages may include links to external resources and, with your consent, embedded Google Maps. Those third parties collect and process data under their own terms. I encourage you to read Google's privacy policy if you enable map embeds.

16. Changes to this policy

I may update this Privacy Policy to reflect changes in practice or law. The "Last updated" date at the top will change accordingly. Material changes will be noted on the Site. Continued use after updates constitutes acknowledgement of the revised policy for non-material changes; for material changes affecting consent-based processing, I will seek fresh consent where required.

17. Contact and complaints

For privacy enquiries or complaints, email [email protected] or write to the postal address above. I will investigate and respond within a reasonable period. If you remain unsatisfied, you may contact the Personal Data Protection Commission (PDPC) in Singapore: https://www.pdpc.gov.sg.

This policy is written in plain language where possible. If any section is unclear, contact me and I will clarify without requiring legal counsel on your part. Transparency is part of the obligation, not an optional courtesy.