Privacy Policy

NbS Praxis Pte. Ltd.
Effective date: October 16, 2026 | Version: 2.0

1. Who we are

NbS Praxis is an independent practice at the climate-and-nature nexus, publishing analysis on Nature-based Solutions (NbS) and Ecosystem-based Adaptation (EbA), and providing information about advisory services and practitioner resources.

NbS Praxis is operated by NbS Praxis Pte. Ltd., a company incorporated in Singapore with Unique Entity Number 202647887M and registered office at 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914. In this Policy, “we”, “us”, “our” and “the Company” refer to NbS Praxis Pte. Ltd.

The Company assumed operation of the publication and responsibility for the subscriber and publication records transferred to it on October 16, 2026. It is the organization responsible for the personal data described in this Policy and, where that terminology applies, the data controller.

Our Data Protection Officer can be contacted at privacy@nbspraxis.com. Postal inquiries should be addressed to the Data Protection Officer, NbS Praxis Pte. Ltd. at 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914.

2. Scope

This Policy explains how we collect, use, disclose, retain and protect personal data in connection with the NbS Praxis website at nbspraxis.com, its weekly briefing and monthly long-form email publications, subscription and contact forms, resource requests and direct correspondence.

Third-party platforms, including social-media services and independent retailers, have their own privacy policies. This Policy applies to information we receive or use from your interactions with us on those platforms; it does not govern the platform’s independent processing.

An advisory engagement or paid product may carry an additional privacy notice describing processing specific to that service. A service agreement does not remove any mandatory data-protection rights.

3. Personal data we collect

Information you provide may include your email address, any name you choose to supply, your subscription preferences, and the contents of your inquiries, replies and attachments. A name is not required to subscribe. We also keep records needed to administer your subscription, consent choices, unsubscribe requests and privacy inquiries.

Our systems and service providers process technical information needed to deliver and protect the website and email publications. Depending on the interaction, this may include your internet protocol address, browser and device information, approximate location derived from technical data, referring page, login or session information, and delivery or security records. The analytics and tracking actually used are described in section 6.

Please do not submit confidential client material, procurement-sensitive information, unpublished institutional documents, or unnecessary personal data about other people through subscription forms or ordinary correspondence. Where an engagement requires such information, agree an appropriate channel and confidentiality arrangements with us first.

4. How we use personal data

We use personal data to provide the publications you request; create and manage subscriptions and access to relevant resources; respond to inquiries and advisory approaches; maintain security and service reliability; handle corrections, complaints and privacy requests; and comply with legal obligations. Where the analytics described in section 6 are enabled, we also use the specified interaction data to understand readership and improve the publication.

Under Singapore’s Personal Data Protection Act 2012 (PDPA), we collect, use and disclose personal data for notified purposes with consent, unless the PDPA or another applicable law permits or requires otherwise. Where we rely on a consent exception, we must meet its applicable conditions. This Policy is not a request for unlimited consent, and accepting the Terms of Use does not by itself authorize unrelated marketing or optional tracking.

Where another applicable law requires a particular lawful basis, additional notice or consent, we will address that requirement for the relevant processing. We will not use personal data for a materially different purpose without first providing the required notice and obtaining any consent required by applicable law.

5. Email communications

When you subscribe, we use your email address to send the NbS Praxis publications you selected and messages genuinely necessary to administer that subscription. Merely contacting us does not enroll you in the newsletter.

Publication emails contain an unsubscribe facility. You may also withdraw your consent by contacting privacy@nbspraxis.com. We will give effect to your request within the period required by applicable law. Withdrawal does not affect processing lawfully undertaken before the request, or information we must retain for a lawful purpose.

Unsubscribing stops publication emails. It does not necessarily stop a security notice about an account you retain, a response you requested, or a communication necessary for a separate transaction with us. We will not treat promotional messages as necessary service messages.

Any separate promotional emails about products, events or services will follow the choices presented to you and applicable consent requirements. We do not sell or rent subscriber email addresses, or provide our subscriber list to another party for that party’s own marketing.

6. Cookies, analytics and email tracking

The website uses Ghost. Its actual hosting arrangement is managed through Ghost(Pro), the official managed hosting infrastructure provided by the Ghost Foundation. Technologies necessary for requested functions, such as sign-in, session management and security, are distinguished from optional measurement or promotional tools.

Essential cookies and similar technologies: The website uses strictly necessary cookies and local storage elements operated by Ghost to manage member sign-in states, authenticate sessions, administer free or paid subscriptions, and protect the site against automated abuse and security threats. No consent is required for these essential functional technologies.

Website analytics: We do not use invasive third-party advertising trackers or cross-site behavioral profiling cookies. We rely on Ghost(Pro)’s native, privacy-focused platform metrics and, where enabled, cookie-free aggregate traffic measurement that records overall page views and referral sources without tracking individual readers across external websites or storing persistent third-party advertising identifiers.

Newsletter analytics: By default, Ghost includes standard newsletter delivery and engagement measurement (such as whether an email was successfully delivered and opened, and whether links within the briefing were clicked) using a small tracking pixel and routed links. You can disable email open tracking in your member account settings or by blocking remote images in your email client.

Other integrations and optional technologies: We do not use third-party marketing pixels, social media tracking widgets, or behavioral retargeting technologies on the website. Where an article embeds external media (such as a video or interactive chart), technical data is only shared with that provider as described in section 13.

Your controls: You may manage your subscription preferences and email tracking settings directly through the member portal link at the bottom of any page or newsletter, configure your email client to block remote images, or contact our Data Protection Officer. Where consent is required for a technology or related processing, we will obtain it before that activity starts and provide a means of withdrawal. Rejecting optional processing will not prevent access to functions that do not depend on it. Browser controls may also allow you to block or delete cookies, although blocking necessary cookies can affect requested functions.

The absence of cookies does not, by itself, mean that no personal data is processed. We will update this section before introducing materially different tracking.

7. Service providers and disclosure

We disclose personal data where reasonably necessary to providers supporting our website, publications, communications and administration. Access is limited to what is needed for the relevant function. Where a provider processes personal data on our behalf, we require appropriate confidentiality, security and processing terms.

The principal providers and relevant functions are:

Ghost (Ghost Foundation Pte. Ltd.): Provides managed content management, website hosting, subscriber database management, and newsletter dispatch services. Processes subscriber email addresses, names (if provided), subscription status, engagement metrics, and technical session logs.

Google Workspace (Google Asia Pacific Pte. Ltd. / Google LLC): Provides business email hosting, correspondence management, and secure cloud document storage. Processes the contents of direct email inquiries, replies, attachments, and associated contact details.

Workflow automation and network infrastructure (including Make.com / Celonis Inc. and CDN providers, where enabled): Provides automated internal routing of correspondence or form submissions to secure cloud storage and content delivery network (CDN) security. Processes technical traffic routing logs and incoming correspondence metadata where enabled.

Some recipients, such as independent professional advisers, regulators or a retailer with which you contract directly, may determine their own purposes for processing. Their role and any applicable additional privacy information will depend on the circumstances; they are not all processors acting solely on our instructions.

AI-assisted handling of personal data: We do not enter subscriber lists, member database records, or identifiable private reader correspondence into public artificial-intelligence models, nor do we permit AI providers to train their models on personal data we hold. Where AI-assisted tools are used within our secure workspace environment to assist in summarizing or organizing routine administrative workflows, such processing is strictly governed by enterprise confidentiality terms that prohibit secondary use or model training. The separate disclosure of AI use in editorial production does not itself authorize us to disclose subscriber records or private correspondence to AI providers.

We may also disclose relevant information where required or permitted by law, in connection with legal claims or the protection of rights and safety, or for a genuine business reorganization or transfer. Any such disclosure remains subject to applicable confidentiality, notification, consent and data-protection requirements. A business transfer is not permission for unrestricted use of subscriber data.

8. International data transfers

The Company is incorporated and headquartered in Singapore. Our service providers may store, process or access personal data in other countries, and authorized operational and editorial administration may involve secure remote access. The relevant locations are Singapore, the Asia-Pacific region, the European Union, and the United States (where cloud hosting, email delivery, and infrastructure providers maintain data centers). Remote access from another jurisdiction may form part of these arrangements.

Before transferring personal data outside Singapore, we take steps required by the PDPA to ensure that the transferred data receives a standard of protection comparable to that under the PDPA, unless an applicable lawful exception applies. We also address any additional transfer requirements under other laws applicable to the particular data.

The safeguards applicable to our actual arrangements are legally enforceable contractual commitments (including Data Processing Agreements and recognized standard data-protection clauses) with our third-party service providers that require a standard of protection comparable to the Singapore PDPA, combined with strict corporate access controls, multi-factor authentication, and encryption in transit and at rest for authorized remote operational access. These may include enforceable contractual protections or another legally recognized mechanism, where its conditions are met.

You may contact our Data Protection Officer for further information about relevant transfer arrangements and safeguards, subject to lawful confidentiality and security restrictions.

9. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy and applicable legal or business requirements. The appropriate period depends on the data, the purpose for holding it, and any continuing legal obligation or dispute.

Active subscription information is retained while needed to provide the subscription. After an unsubscribe request, we may keep a limited suppression record, such as the email address and unsubscribe status, to avoid sending further publication emails. That does not justify keeping an entire engagement history indefinitely.

Correspondence is retained for as long as reasonably needed to handle the matter and any related follow-up or legal requirement. Analytics and technical records are kept only for periods appropriate to their stated purposes.

When retention is no longer necessary, we delete the information or irreversibly anonymize it. Where deletion from backups is not immediate, remaining copies are protected, are not used for unrelated purposes, and are removed under the applicable backup-deletion cycle. We do not use indefinite archiving as an alternative to deletion.

10. Data security

We apply reasonable administrative, organizational and technical measures to protect personal data against unauthorized access, collection, use, disclosure, copying, modification, disposal, loss and similar risks. Access is restricted to authorized persons who need it for their work, and we assess relevant provider protections.

No transmission or storage system can be guaranteed completely secure. This does not reduce our obligations under applicable law. Where a personal-data breach meets a legal notification threshold, we will notify the relevant authority and affected individuals as required, within the applicable time limits.

11. Your rights and complaints

Subject to applicable law and its exceptions, you may request access to personal data we hold about you and relevant information about its use or disclosure, request correction of inaccurate or incomplete information, and withdraw consent to processing that relies on consent.

Other applicable laws may provide additional rights, such as deletion, restriction, objection or data portability. Their availability depends on the law and the circumstances; this Policy does not suggest that every right applies to every request.

Write to privacy@nbspraxis.com, identifying the request and enough information for us to locate the relevant records. We may request proportionate evidence to verify identity or authority. Please do not send identity documents unless requested through an appropriate channel.

We will respond within the time required by applicable law. Where a permitted fee applies, we will explain it before charging. If we cannot fulfill a request, we will provide an explanation to the extent permitted by law. Withdrawal of consent may mean that we cannot continue a service that reasonably needs the relevant information; we will explain any such consequence.

You may raise a concern directly with our Data Protection Officer. We will review it and respond. This does not prevent you from contacting Singapore’s Personal Data Protection Commission or another competent data-protection authority, and contacting us first is not a condition of making a regulatory complaint.

12. Children’s privacy

NbS Praxis is intended for professional adults and is not directed at children. We do not seek to collect children’s personal data. A parent or guardian who believes a child has provided personal data should contact privacy@nbspraxis.com. We will assess the situation and delete the information or take other steps required by applicable law.

13. External links and embedded content

Our content may link to or embed third-party material, including institutional documents, data portals and video. Following a link takes you to a service governed by its own privacy information. Embedded content may communicate technical information to its provider when it loads, even without a separate visit to that provider’s website.

The embedded services actually used, and any relevant choices before they load, are described in section 6. A third party’s privacy policy does not remove our responsibility for our own decision to collect or disclose personal data through an integration. A link is not an endorsement of the linked party’s privacy practices.

14. Changes to this Policy

We may update this Policy to reflect changes to our processing, providers, services or legal requirements. The effective date identifies the version in force. We will bring material changes to affected readers’ attention through an appropriate website notice or direct communication.

Where a change requires consent or another legal step, we will complete that step rather than treating continued browsing or receipt of an email as automatic consent. An updated policy does not retrospectively authorize earlier processing.