Privacy Policy
What we collect, why we collect it, who else receives it and how long we keep it.
Last updated 25 October 2026 · Erben Group Pte. Ltd. · UEN 202609703M
9B Queen Astrid Gardens, Singapore 266873 · Data Protection Officer: Benedict Kok, Co-Founder, staff@wwbegin.co
01Who we are
WhereWeBegin ("WWB", "we", "us") is a community and content platform for founders, operated by Erben Group Pte. Ltd. (UEN 202609703M), a company incorporated in Singapore. WWB Studios, previously called WWB Media, is our paid services and marketing branch. It is the same company, not a separate one.
This policy explains what personal data we collect through wwbegin.co and at our events, why we collect it, who else receives it and how long we keep it. It is written to meet Singapore's Personal Data Protection Act 2012 (PDPA).
Our Data Protection Officer is Benedict Kok, Co-Founder. For anything about your data, including a request to see, correct or delete it, write to staff@wwbegin.co with "Data request" in the subject line, or use wwbegin.co/my-data. We answer within 30 days, and if we cannot, we will tell you within those 30 days when we will.
Our postal address is 9B Queen Astrid Gardens, Singapore 266873.
02What we collect, and why
We collect personal data in three ways: you give it to us, it is generated automatically when you use the site, or we receive it from another organisation. There is no account to create in order to read this site.
Data you give us.
| What | When | Why we need it |
|---|---|---|
| Name, email, phone (optional), and your message | You send an enquiry through the contact form | To reply, and to keep a record of what was asked so whoever picks it up has the context |
| Name, email and your question | You submit a question to The Hub | To answer it, and to tell you when it has been answered |
| Your photograph, name, contact details, company, role, what you know about and what you are looking for | You check in at a WWB event on one of our tablets | To show who you are on your event pass, to let volunteers and other attendees find you in the room, and to suggest people worth meeting |
| A mathematical summary of your face, if you agree to it | You create a FacePass and accept face check-in | So the tablet recognises you at the next event instead of asking for your email. It is a set of numbers rather than an image, and it is not designed to be reversed into a photograph |
| Name, email, phone, delivery address and postal code | You place a merchandise order | To take the order, post the parcel and send you a receipt |
| Your order contents, amount, and the reference for your payment | You place a merchandise order | To fulfil the order and to keep the accounting records Singapore law requires |
| A screenshot or PDF of your bank transfer | You pay by PayNow or bank transfer and upload proof | To match your payment against your order before we post it. Please hide anything on it we do not need, such as your balance or other transactions |
| Where and when you used your membership card | A partner merchant scans your card | To apply the perk and show you and the merchant a record of it |
| Your device identifier and a push token | You add your membership card to Apple Wallet | To keep the pass on your phone up to date. Apple requires both. Neither identifies you by name |
| A display name you choose, and any photo or drawing you add | You post to an event noteboard | To show it on the board. The name is optional and is remembered on your own device |
Data generated when you use the site. Our traffic measurement records the page, where you arrived from, your approximate location from your IP address, and your device and browser. It is described in the Cookie Policy. Our public forms use your IP address in memory to stop one machine flooding them with submissions; it is not written to our database. The event noteboard stores a one-way hash of the IP address so a board can be cleaned up if someone abuses it.
Data we receive from others. When you register for a WWB event on Luma, we take an export of approved guests who checked in and import it into our own records. It contains your name, email address, phone number where you gave one, and the time you checked in, and it creates or updates a WWB membership record for you. Where a school or programme partner gives us participant details, we receive those too and use them only to run the programme.
What we search for is logged, without an identifier. When you search The Hub we store the words searched, the answer given and whether we found one. We do not store an account, a device identifier or an IP address alongside it. The search text itself is whatever you typed, so if you type your own name or your company into it, that is in the log.
We do not buy personal data, sell it, run advertising or advertising trackers, build profiles for targeting, or ask for your date of birth, identity number or bank credentials.
03Young people
Some of what we do, such as school programmes and campus events, involves people under 18. We do not knowingly collect personal data from anyone under 13 through this website. Where a school or programme partner gives us participant details, they are responsible for obtaining the consent needed from a parent or guardian. That does not remove our own obligations for what we then do with those details.
Face check-in is not available to anyone under 13. This is our own policy rather than a statutory rule. Between 13 and 17 it needs a parent or guardian to agree first, and is refused without that. Where an event may include under-18s, the door asks which of those three bands applies and nothing more precise. Being recognised on the cameras around a venue is not offered to anyone under 18.
If you believe a child has given us data through this site, write to staff@wwbegin.co and we will remove it.
04Who else receives your data
We do not sell or rent your data. Two different kinds of organisation see it, and the difference matters because it changes whose rules apply.
Service providers acting on our instructions. These handle data for us and are not permitted to use it for their own purposes.
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Our database and file storage, including enquiries, orders, membership records and uploaded images | Singapore |
| Vercel | Hosting and delivery of the site, and traffic measurement | Singapore region, on a global network |
| Google Workspace (Gmail) or Resend | Sending our email, such as a reply, an order confirmation or a receipt | United States and globally |
| Groq | The AI that answers Hub searches, and the AI that ranks suggested introductions at an event. It receives your search text, or your role, company, expertise and what you wrote you were looking for. It does not receive your name, email, photograph or face summary | United States |
Organisations that decide for themselves what they do with your data. When you deal with these, their own privacy policy applies as well as ours.
| Who | When they are involved | Their terms |
|---|---|---|
| Luma | You register for a WWB event on their platform | Luma privacy policy |
| HitPay or Stripe | You pay by card or PayNow through a gateway. They take the payment directly and we never see or store your card number | HitPay, Stripe |
| YouTube (Google) | You press play on a video | Google privacy policy |
| CARTO and OpenStreetMap | You open a page with a map. Loading the tiles reveals your IP address to them, as loading any image from another site does | CARTO, OpenStreetMap |
| Apple | You add a membership card to Apple Wallet | Apple privacy policy |
Some of these organisations are outside Singapore. Where we transfer personal data overseas we rely on contractual commitments requiring a standard of protection comparable to the PDPA, as section 26 of the Act requires.
We will also disclose data where the law requires it, such as to a court, a regulator or a tax authority, or to establish or defend a legal claim.
05WWB events
Our events run on a private system used on WWB tablets at the door and on your own phone through a link we give you. It is not reachable from this website and is not indexed by search engines.
Registration. You sign up on Luma, and their privacy policy covers what happens there. We then receive the guest list, as set out above, so your registration details reach us whether or not you check in with us.
FacePass is a profile you can choose to make once and reuse at every WWB event, so you are not retyping the same details. It holds your photograph, your name, how to reach you, your company and role, and what you know about. You can check in without one, and we then hold the same details for that event only.
Your event pass opens from a QR code we give you. The code contains a random token and nothing else: no name, no email and no identifier. It works for the evening and stops working afterwards.
Who sees what at an event. The WWB team and the volunteers working that event can see your profile and what you said you were looking for. Other guests at the same event may see your name, photograph, company, role and what you are looking for. They are not shown your email address or phone number. Tell a volunteer at any point and we will switch that visibility off.
Sharing your contact details is a separate thing. Giving us an email address so we can reach you is not permission to give it to another guest. Your contact details are passed to someone else only where you have asked us to make that introduction.
Photography and filming. We photograph and film at some events for our own coverage, which may be published on our site and social channels. This is separate from the operational cameras and from face recognition, and it is not covered by either of those choices. If you would rather not appear, tell any of our team at the event and we will take you out of the coverage.
How the matching works. We suggest introductions using what you wrote: what you need, what you know about and what you said you wanted from the evening. Part of that uses an AI service to rank suggestions and explain them in a sentence. That service receives your professional details and what you wrote. It does not receive your name, your contact details or your photograph, and a person decides every introduction that is actually made.
What we do with your photograph. It is shown so people can recognise each other in a room, and it is shown to you on your own pass. If you turn on face check-in, a mathematical summary is computed from it for that purpose, and that is described below. We do not use your photograph to estimate your age, gender, ethnicity, mood or personality, and it is not sent to the matching service.
Face check-in at the door is optional and separate. If you agree to it, we store a mathematical summary of your face, computed on the tablet, so the next tablet recognises you. It is used only to identify you at a door. You can refuse it and still check in with your QR code, and you can withdraw it at any time without losing your FacePass. We hold it under tighter restrictions than anything else we keep.
Being recognised in the room is a further, separate choice. At some events we can also recognise you on the cameras around the venue so the team can find you, greet you by name and introduce you to people. It is asked for on its own. You can accept the door and refuse the room, and refusing changes nothing else about your evening.
If you agree to that, we keep the time you arrived, the time you were last seen, and a note of which other guests you had a conversation with and roughly how long for. We do not keep a record of where you walked, and no video is recorded. Those records are held for 30 days, or less if you ask. A conversation note requires both people to have agreed, so nothing of the kind is recorded about someone who did not.
Connections. When an introduction happens we record that two people met, at which event, and how it came about, so we can tell whether our events are doing what they are for. If you ask us to delete your data, your side of those records goes and what remains is an anonymous count.
After an event we may email you a recap of who you met and what they do. It is sent once, to the address on your FacePass, and the link works for 90 days. Another guest's email address appears in it only where they put one on their own FacePass and asked for the introduction.
06Cameras at our events
This section applies to everybody in the room, including people who never come to our tablet: a guest's companion, somebody making a delivery, the venue's own staff. There is a notice at the entrance saying the same thing.
At some events we run a camera system that counts how busy each area is, so the team can see when a room is filling up. It runs on a computer at the venue. No video is recorded or kept, and no footage leaves the building. Not recording footage does not mean no personal data is processed: images of people are processed in the moment, which is why this section exists.
It tells people apart so nobody is counted twice. Somebody who steps outside and comes back should not become two people in the evening's attendance, so the system holds enough to know it is the same person for the length of the event, in memory, and discards it when the event ends. That applies to everybody in view. It cannot put a name to anybody.
Nobody is identified by name unless they have asked to be. Putting a name to a face happens only for guests who chose it, on the cameras set up for it, and is described in the section above. If you did not choose it, the system shows you to our team as an unnamed guest.
We do not keep a record of where anyone walked, and we do not use the cameras to estimate age, gender, ethnicity or mood.
If you would rather not be in view of a camera, tell any of our team and we will tell you which areas are covered. To have a record about you removed, see Your rights.
07How long we keep it
We keep personal data while there is a reason to, then delete it. These are the periods we work to.
| What | How long | Why that long |
|---|---|---|
| Enquiries and questions | 24 months after our last exchange with you | So we have the history if you come back to us |
| Orders, receipts and proof-of-payment files | 5 years from the end of the financial year | Singapore tax and accounting rules require business records to be kept. The exact period depends on the obligation |
| Event check-in details, where you did not make a FacePass | 30 days after the event, unless the event notice says otherwise | You gave them for one evening |
| FacePass profile, including your photograph | Until you delete it, or 24 months after your last WWB event. We email you a month before that happens | It exists so you do not fill the same form in at every event, and stops being useful once you have stopped coming |
| The face summary used for face check-in | Deleted with your FacePass, or sooner if you withdraw that consent | It only has a purpose while you want to be recognised at a door |
| Arrival and last-seen times, where you agreed to be recognised in the room | 30 days after the event | It is there so the team can run the evening |
| A note that you had a conversation with another guest, where you both agreed | 90 days after the event | Long enough for the recap and for you to ask us who somebody was |
| Headcounts, door counts and how busy each area was | 2 years | Nobody is identifiable in these numbers. They are how we learn whether a venue or a layout worked |
| Your recap of an event | The link works for 90 days | It is a record of one evening, not a permanent page |
| Membership records | While your membership is active, then 12 months | To handle renewals, disputes and rejoining |
| Card visit history | 24 months | So you and the merchant can check a perk was applied |
| Apple Wallet device registrations | Until you remove the pass from your device | The registration is what keeps the pass updated |
| Noteboard posts | Until the event board is taken down, or sooner on request | They exist to be shown at the event |
| Hub search logs | 12 months | Long enough to see a trend |
If you ask us to delete something sooner we will, unless we are required to keep it. An invoiced order is the usual case, and we will tell you where that applies.
08Your rights, and how to use them
Under the PDPA you may ask us for access to the personal data we hold about you, together with information about how it has been used or disclosed in the year before the request. You may ask us to correct anything that is wrong. You may withdraw a consent you have given, on reasonable notice. Withdrawing a consent may mean we can no longer do the thing it was given for, and we cannot post an order without an address.
Some exceptions apply to access and correction requests under the PDPA, and we will tell you if one applies to yours.
We also offer deletion, which is not a statutory right. Singapore's PDPA does not give a general right to have every record erased on demand. We offer it anyway, subject to anything we are required to keep.
Both routes start at wwbegin.co/my-data. You can also write to enquiry@wwbegin.co with "Data request" in the subject. Which route your request takes depends on what you are asking for.
- Deleting your FacePass, or withdrawing a face consent, happens without a person. We send a link to the email address on your record, and the link does it.
- A copy of your data, or a correction, goes to a person, who will confirm who you are before acting. Handing data to the wrong person is the thing these rules exist to prevent. We ask only for what is reasonably needed to be satisfied you are who you say you are, and we do not ask for identity documents as a matter of course.
We respond to an access or correction request as soon as reasonably possible. If we cannot complete it within 30 days, we will tell you in writing within those 30 days when you can expect our response.
What deletion actually does. The record is removed from our live systems when the request is carried out. Copies may remain for a short time in routine backups taken by our hosting providers until those are overwritten in the ordinary course, and we may keep what the law requires us to keep, such as accounting records for an invoiced order.
Every marketing email we send has an unsubscribe link and we honour it. Transactional email, such as an order confirmation or a reply to your enquiry, is not marketing and does not carry one.
If you are in the UK or the European Economic Area, data protection law there may also apply to some of what we do. Write to us and we will tell you what applies to your request and deal with it accordingly.
If we have not dealt with something properly you may complain to Singapore's Personal Data Protection Commission, or to your own supervisory authority if you are in the UK or EEA. We would rather you told us first.
09Keeping it safe
The site is served over HTTPS. Access to orders, member records and event data is limited to the people who need it. Payments by card or PayNow through a gateway are taken by the gateway itself: card numbers do not reach our servers and we do not store them.
No system is completely secure and we do not claim otherwise.
If a data breach happens, we will assess it and notify the Personal Data Protection Commission and affected individuals where the law requires. Under the PDPA a breach is notifiable to the Commission where it is likely to cause significant harm to affected individuals or where it is of a significant scale. Notification to the individuals themselves is a separate assessment and is subject to exceptions.
11Changes to this policy
When we change how we handle data we update this page and change the date at the top. Where a change materially affects you, such as a new category of data or a new purpose, we will say so here.
This version is dated 25 October 2026.