Personal Data Protection Policy

This Personal Data Protection Policy (‘Policy’) explains how dahm adr col­lects, uses, dis­closes and retains per­sonal data in con­nec­tion with its web­site at https://www.dahm.sg (‘Website’), enquir­ies, cor­res­pond­ence and engage­ments, and how dahm adr pro­tects that data. It is inten­ded to meet the require­ments of Singapore’s Personal Data Protection Act 2012 (‘PDPA’) and, where it applies, the EU General Data Protection Regulation (‘GDPR’).

dahm adr (Patrick Dahm), 100 Peck Seah Street, #07‑17 PS100, Singapore 079333, e‑mail patrick@dahm.sg, is respons­ible for the pro­cessing of per­sonal data described in this Policy (con­trol­ler within the mean­ing of the GDPR). Patrick Dahm is also dahm adr’s data pro­tec­tion officer under the PDPA and can be reached at the same addresses.

This Policy cov­ers the Website, enquir­ies and cor­res­pond­ence, and engage­ments of dahm adr. Personal data in arbit­ra­tions and medi­ations in which Patrick Dahm acts is, in addi­tion, sub­ject to the applic­able rules, the parties’ agree­ments and the con­fid­en­ti­al­ity of the proceedings.

The Website uses no cook­ies, no ana­lyt­ics, no advert­ising and no track­ing of any kind. It loads noth­ing from other web­sites, except for the spam pro­tec­tion on the con­tact page described below.

The Website is hos­ted by a host­ing pro­vider on serv­ers in Singapore. Whenever you open a page, your browser trans­mits tech­nical data that the server records in log files: your IP address, the date and time, the page reques­ted, the refer­ring page, and inform­a­tion about your browser and oper­at­ing sys­tem. This data is needed to deliver the Website, to keep it stable and secure, and to invest­ig­ate faults and attacks. It is kept only as long as needed for these pur­poses. Legal basis: Art. 6(1)(f) GDPR (legit­im­ate interest in oper­at­ing a secure website).

The Website is pro­tec­ted by the secur­ity plu­gin Wordfence, provided by Defiant, Inc., USA. Wordfence checks every request against fire­wall rules and records the IP address and details of blocked requests and of login attempts. To help pro­tect other web­sites, the IP addresses of attack­ers are shared with Defiant, and Wordfence may look up where an IP address is loc­ated using Defiant’s serv­ers. Legal basis: Art. 6(1)(f) GDPR (legit­im­ate interest in pro­tect­ing the Website and its vis­it­ors against attacks).

If you use the con­tact form, your name, e‑mail address and mes­sage are sent to dahm adr by e‑mail. The Website does not store them. They are pro­cessed as described under ‘Enquiries, Correspondence and Engagements’.

The con­tact form is pro­tec­ted against spam by Cloudflare Turnstile, a ser­vice of Cloudflare, Inc., USA. When you open the con­tact page, your browser trans­mits tech­nical data, such as your IP address and inform­a­tion about your browser, to Cloudflare, which uses it to dis­tin­guish people from auto­mated pro­grams and to improve its bot detec­tion. Cloudflare’s pri­vacy notice for Turnstile is avail­able at https://www.cloudflare.com/turnstile-privacy-policy/. Legal basis: Art. 6(1)(f) GDPR (legit­im­ate interest in pro­tect­ing the form against spam).

If you con­tact dahm adr, whether through the con­tact form, by e‑mail or oth­er­wise, dahm adr pro­cesses the per­sonal data you provide, such as your name, con­tact details, pos­i­tion and the con­tent of your mes­sage. Where you enquire about an appoint­ment or engage­ment, this may include the names of the parties, coun­sel and other per­sons involved in the matter.

dahm adr uses this data to answer your enquiry, to check for con­flicts of interest and avail­ab­il­ity, and, if appoin­ted or engaged, to per­form the engage­ment and to admin­is­ter its prac­tice. Legal basis: Art. 6(1)(b) GDPR for steps towards and the per­form­ance of an engage­ment; Art. 6(1)(c) GDPR where legal oblig­a­tions apply; oth­er­wise Art. 6(1)(f) GDPR, in par­tic­u­lar for con­flict checks con­cern­ing per­sons who have no con­tract with dahm adr (legit­im­ate interest in ensur­ing inde­pend­ence and impartiality).

dahm adr keeps this data as long as needed for these pur­poses, includ­ing for con­flict checks in later mat­ters, and as long as stat­utory reten­tion peri­ods require.

dahm adr does not sell per­sonal data. It dis­closes per­sonal data only as described in this Policy: to its host­ing and e‑mail ser­vice pro­viders; to Defiant (Wordfence) and Cloudflare (Turnstile) as described above; in an engage­ment, to the parties, coun­sel, co-arbit­rat­ors, insti­tu­tions admin­is­ter­ing the pro­ceed­ings and oth­ers involved, as far as the engage­ment requires; and where the law or a court order requires it.

dahm adr is based in Singapore, where the Website is also hos­ted. Singapore is not covered by an adequacy decision of the European Commission. Cloudflare and Defiant may pro­cess data in the USA. For Cloudflare, the trans­fer relies on the European Commission’s adequacy decision for the EU – US Data Privacy Framework (Art. 45 GDPR), under which it is cer­ti­fied; for Defiant, which is not cer­ti­fied, it relies on stand­ard con­trac­tual clauses (Art. 46(2)(c) GDPR). Where per­sonal data is trans­ferred out of Singapore, dahm adr takes appro­pri­ate steps to ensure a stand­ard of pro­tec­tion com­par­able to that under the PDPA.

dahm adr secures the per­sonal data you provide on com­puter serv­ers in a con­trolled, secure envir­on­ment, pro­tec­ted from unau­thor­ised access, use or dis­clos­ure. dahm adr will not share your per­sonal data with third parties except with your per­mis­sion, as described in this Policy, or if required by law or a court order.

Under the GDPR, you have the right to access your per­sonal data (Art. 15 GDPR), to have it cor­rec­ted (Art. 16 GDPR) or erased (Art. 17 GDPR), to restrict its pro­cessing (Art. 18 GDPR), and to receive it in a port­able format (Art. 20 GDPR). Under the PDPA, you may request access to and cor­rec­tion of your per­sonal data. Where pro­cessing is based on your con­sent, you can with­draw it at any time with effect for the future (Art. 7(3) GDPR; sec­tion 16 PDPA).

Right to object: where pro­cessing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relat­ing to your par­tic­u­lar situ­ation (Art. 21 GDPR).

dahm adr relies on you to ensure that your con­tact inform­a­tion is accur­ate; please let it know of any changes. Please send all enquir­ies, requests and noti­fic­a­tions to patrick@dahm.sg. You also have the right to lodge a com­plaint with a data pro­tec­tion super­vis­ory author­ity, in par­tic­u­lar in the EU mem­ber state where you live or work (Art. 77 GDPR), or with Singapore’s Personal Data Protection Commission.

You are not obliged to provide per­sonal data. Without con­tact details, how­ever, dahm adr can­not answer your enquiry, and without the inform­a­tion needed for con­flict checks, it can­not accept an appoint­ment. No auto­mated decision-mak­ing, includ­ing pro­fil­ing, takes place.

The Website con­tains hyper­links to other web­sites, the data pro­tec­tion and pri­vacy prac­tices of which may dif­fer from those of dahm adr. dahm adr is not respons­ible for the con­tent and pri­vacy prac­tices of such web­sites and encour­ages you to con­sult the pri­vacy notices of those sites.

dahm adr updates this Policy when changes in how it pro­cesses per­sonal data, or in the law, require it. The cur­rent ver­sion is always avail­able on this page.

Last updated: 11 October 2026