Privacy Request Form

Effective date: Pending confirmation
Last updated: 12 September 2026

Use this form to request access, correction, deletion, portability or another privacy action concerning personal data controlled by ASTRA LOGIC TECHNOLOGY PTE. LTD. in connection with GTO Fisher.

You do not have to use this form. A clear email containing the necessary information is sufficient. Read the Privacy Policy for details about data, legal bases, retention, regional rights and exceptions.

1. Where to send the request

Preferred method
Email: support@gtofisher.com
Subject: Privacy Request

Postal method

ASTRA LOGIC TECHNOLOGY PTE. LTD.
Data Protection Contact
36 Robinson Road, #21-01
City House
Singapore 068877

Keep a copy of the submitted request. Do not send passwords, authentication codes, a complete payment-card number or an original identity document.

2. Requester information

Copy the fields below into an email or use the equivalent online form if available.

Name (optional unless reasonably needed to identify your data):
GTO Fisher account email:
Alternative reply email, if needed:
Country and state/province of residence:
Account identifier, transaction identifier or support reference, if available:
Preferred response format: email / portable electronic file / another accessible format (describe)
Accessibility or communication adjustment requested, if any:

Do not include information unrelated to the request.

3. Right or action requested

Select all that apply:

• [ ] Access / know — provide a copy of my personal data and information about its use or disclosure.
• [ ] Correction — correct inaccurate or incomplete personal data.
• [ ] Deletion / erasure — delete eligible personal data and explain any information that must be retained.
• [ ] Portability — provide eligible data I supplied in a structured, commonly used, machine-readable format.
• [ ] Restriction — restrict eligible processing while an issue is reviewed or as otherwise required by law.
• [ ] Object — stop eligible processing based on legitimate interests.
• [ ] Withdraw consent — stop future processing based on a specified consent.
• [ ] Marketing opt-out — stop marketing communications.
• [ ] AI improvement opt-out — withdraw optional use of private content for product or model improvement. Core features should remain available.
• [ ] Sale/share/targeted-advertising opt-out — record my choice. GTO Fisher currently states that it does not sell personal data or share it for cross-context behavioural advertising.
• [ ] Automated analysis question — explain or correct an educational profile, score or recommendation.
• [ ] Appeal — review a previous privacy-request decision.
• [ ] Complaint — investigate a concern about how personal data was handled.
• [ ] Other privacy action — describe below.

4. Scope and details

Describe the request and the data, feature, conversation, date range or event involved:

For a correction, state the current value and the accurate replacement:

For a consent withdrawal, identify the consent or setting:

For an appeal, include the prior request reference, decision date and why you believe it should change:

Requested outcome:

Attach only material reasonably needed to understand the request.

5. Request on behalf of another person

Complete this section only if you are an authorised agent, parent, guardian or legal representative permitted by applicable law.

Representative’s full name:
Organisation, if any:
Representative’s email and postal contact:
Name and account email of the person concerned:
Nature and scope of authority:
Evidence of authority attached or available through a secure method:

We may verify authority directly with the person concerned unless law permits or requires another method. A general power to communicate may not be enough to receive a copy of personal data. We minimise the representative’s data and keep evidence only as long as reasonably needed for the request and legal records.

6. Identity and account verification

We verify a requester proportionately to the sensitivity and risk of the request. Verification may include:

• sending a confirmation link or code to the account email;
• asking the requester to sign in through the ordinary account flow;
• confirming recent account or transaction information that we already hold; or
• requesting limited additional evidence through a secure channel when the first methods are insufficient.

We will not ask for a passport, national identity card or other government document unless we explain why a less intrusive method cannot reasonably verify the request and provide a secure method. If a document is necessary, you may be able to redact information not needed for verification.

We may deny or limit a request if identity or authority cannot be reasonably verified, while explaining the available next step where law requires it.

7. Declaration

By submitting the request, you confirm that:

• the information supplied is accurate to the best of your knowledge;
• you are the person concerned or are lawfully authorised to act for that person; and
• you understand that we may contact you to verify identity, authority or scope.

Typed name (optional unless necessary for representative authority):
Date:
Signature (needed only for a paper form or where law requires):

8. What happens next

We will:

1. acknowledge or log the request;
2. verify identity and authority proportionately;
3. clarify scope if needed;
4. search relevant systems and assess applicable rights and exceptions;
5. take the required action or explain the decision; and
6. provide an appeal or complaint route where required.

We may respond in stages where that makes a large request clearer, provided applicable deadlines are met.

9. Response times

We respond within the time required by the law that applies. This is normally:

• within one month for an EEA or UK data-subject request, subject to a lawful extension for complexity or number of requests;
• as soon as reasonably possible for Singapore access or correction; if we cannot respond within 30 days we inform you within that period of the expected response time; and
• within 45 calendar days for verified California access, correction or deletion requests, with a permitted additional 45 days when properly explained; opt-outs have a shorter applicable deadline. Other regions follow their own time limits, including applicable Brazilian access and Canadian response periods.

We log the date received and apply the correct local clock. We do not automatically pause every deadline while verifying identity or clarifying scope. Any permitted pause or extension is limited to what the applicable law allows and is explained to you. Opt-out signals and simple marketing opt-outs do not require identity-document verification.

10. Fees

Privacy requests are normally free. Where law permits, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded, excessive or repetitive. Before charging, we will explain the basis and estimate. We will not label a request excessive merely because it may reveal an inconvenient result.

11. Possible limits and retained data

A right may be subject to exceptions needed to protect:

• another person’s rights or confidential information;
• account and system security;
• fraud, prohibited real-time assistance or abuse investigations;
• freedom of expression or a lawful exception;
• tax, accounting, transaction and regulatory duties;
• legal privilege and the establishment, exercise or defence of claims; or
• data already irreversibly anonymised and no longer reasonably linkable to a person.

When deletion applies, active-system data is normally deleted within 30 days and restricted backup copies expire within up to 90 additional days, unless a shorter period applies or lawful retention is required. We will explain material retained categories where required.

12. Delivery and security

We normally deliver a response to the verified account email or through a secure account or transfer channel. A download may expire and may require authentication. Do not forward a data export unless you intend to disclose its contents.

If a response contains another person’s data, confidential security information or legally protected material, we may redact or provide a summary where permitted rather than disclose it.

13. Appeals and complaints

If you disagree with a decision, reply with the subject “Privacy Appeal” and include the request reference and reasons. Where reasonably practicable, a person not responsible for the original decision will conduct the review.

You may also complain to a competent data-protection or privacy regulator where applicable, including the Personal Data Protection Commission Singapore or the authority where you live, work or believe an infringement occurred. Contacting us first is encouraged but not required where law gives a direct complaint right.

14. Records about the request

We use request information to verify, respond, prevent fraud, demonstrate compliance and handle complaints or legal claims. We retain a limited request log and material response records for the relevant compliance and limitation period, even if other account data is deleted.

15. Contact

Email: support@gtofisher.com
Suggested subjects: Privacy Request, Privacy Appeal or Privacy Complaint

ASTRA LOGIC TECHNOLOGY PTE. LTD.
Data Protection Contact
36 Robinson Road, #21-01, City House
Singapore 068877