Last updated: 20 July 2026 · Applies to mangisbay.com and all Mangis Bay client and prospect communications.
Mangis Bay ("Mangis Bay", "we", "us", "our") is a boutique advisory platform serving the global fund industry, operating between Luxembourg and Singapore, with a founder-led practice led by Christophe Santer. This policy explains how we collect, use, share and protect personal data when you visit mangisbay.com (the "Site"), contact us, engage us for advisory services, or otherwise interact with us.
Data controller: Mangis Bay, Luxembourg. Contact: info@mangisbay.com.
Because Mangis Bay works across Europe and Asia, this policy is written to meet the requirements of three principal regimes: the EU/EEA General Data Protection Regulation (GDPR), Singapore's Personal Data Protection Act 2012 (PDPA), and Hong Kong's Personal Data (Privacy) Ordinance (PDPO). Where these laws differ, we apply the higher standard of protection to all personal data we hold, regardless of where you are located.
This policy applies to prospective, current and former clients, website visitors, newsletter and LinkedIn subscribers, job candidates, and representatives of counterparties we deal with in the course of our advisory and Sales-as-a-Service engagements.
We collect only the data reasonably necessary to respond to your enquiry, deliver our services, or operate the Site.
| Category | Examples |
|---|---|
| Identity & contact data | Name, job title, organisation, email address, phone number |
| Enquiry & engagement data | Message content, service area of interest, meeting notes, correspondence history |
| Technical data | IP address, browser type, device information, pages viewed (collected only where a form is submitted or a font/service is loaded — see Cookies) |
| Client & engagement data | Where we are formally engaged: corporate, governance, financial or operational information you share with us in the course of an advisory mandate, subject to a separate engagement letter and confidentiality terms |
We do not knowingly collect special categories of data (e.g. health, religion, biometric data) through the Site.
We use personal data to: respond to enquiries and scoping-call requests; provide, manage and improve our advisory and Sales-as-a-Service engagements; maintain business records and comply with legal, tax and regulatory obligations; and, where you have agreed, send relevant updates or insights.
Under the Singapore PDPA and Hong Kong PDPO, we collect, use and disclose personal data only for purposes that a reasonable person would consider appropriate in the circumstances, and — where required — with your notification and/or consent.
We do not sell personal data. We share it only where necessary, with:
Given our operations span Luxembourg and Singapore, personal data may be transferred between the European Economic Area, Singapore, Hong Kong and other jurisdictions in which we or our service providers operate. Where personal data originating in the EU/EEA is transferred outside that area, we rely on adequacy decisions or Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary organisational and technical safeguards. Transfers from Singapore and Hong Kong are made in a manner consistent with the PDPA's transfer limitation obligation and the PDPO's cross-border data transfer requirements respectively.
We retain personal data only as long as necessary for the purposes described in this policy: generally, enquiry and prospect data for up to 24 months from last contact if no engagement follows; client and engagement records for the period required by applicable professional, tax and anti-money-laundering obligations (typically 5–10 years after the end of an engagement, depending on jurisdiction); and website form submissions for as long as needed to action and, where relevant, evidence your enquiry. Data no longer needed is securely deleted or anonymised.
If you are located in the EU/EEA, you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure ("right to be forgotten"), subject to legal retention obligations; request restriction of processing; object to processing based on legitimate interests; request data portability; and withdraw consent at any time where processing is consent-based. To exercise any of these rights, contact us at info@mangisbay.com. You also have the right to lodge a complaint with your local supervisory authority, or with Luxembourg's Commission Nationale pour la Protection des Données (CNPD).
If you are located in Singapore, you have the right to: request access to the personal data we hold about you and how it has been used or disclosed in the past year; request correction of an error or omission; and withdraw consent to our collection, use or disclosure of your personal data, subject to legal or contractual restrictions. To make an access, correction or withdrawal-of-consent request, contact us at info@mangisbay.com. You may also lodge a complaint with the Personal Data Protection Commission (PDPC).
If you are located in Hong Kong, you have the right to: make a data access request (DAR) to confirm whether we hold your personal data and obtain a copy of it; and make a data correction request (DCR) where data is inaccurate. We may charge a reasonable fee to cover the cost of complying with a data access request, as permitted under the PDPO. To make a request, contact us at info@mangisbay.com. You may also lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD).
The Site is intentionally lightweight and does not use advertising or behavioural-tracking cookies. It does use a small number of essential technologies:
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, proportionate to the sensitivity of the data involved. Access to client and prospect data is limited to those who need it to perform their role. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
The Site and our services are directed at business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children.
We may update this policy from time to time to reflect changes in our practices or in applicable law. The "last updated" date at the top of this page will always reflect the most recent revision. Material changes will be reflected here; we encourage you to review this page periodically.
For any question about this policy, or to exercise any of the rights described above, please contact us at info@mangisbay.com. We aim to respond to all privacy-related requests within one month, or as required by applicable law.
This policy is provided for general information about our data practices and does not constitute legal advice.