Singapore Privacy Notice

Effective date: [EFFECTIVE DATE]

This notice applies to personal data of individuals in Singapore and adds to the Privacy Policy, as required by the Personal Data Protection Act 2012 ("PDPA").

Data protection officer

You can reach our data protection officer at [DPO NAME OR TITLE], [DPO BUSINESS EMAIL], [DPO BUSINESS ADDRESS].

We collect, use and disclose your personal data for the purposes described in the Privacy Policy: providing the Service, enforcing quotas, billing, security and service communications. By creating an account and using the Service you consent to these purposes, or are deemed to consent where you voluntarily provide data for them. We will ask for your consent before using personal data for any new purpose.

You may withdraw consent at any time by writing to our data protection officer. We will tell you what the likely consequences are; because account data is needed to provide the Service, withdrawing consent for it may mean we can no longer provide your account. We will stop processing within a reasonable time after your request, unless the law requires or allows us to continue.

Access and correction

You may ask for a copy of your personal data in our possession or control, and for information about how it has been used or disclosed in the past year. You may also ask us to correct an error or omission. We respond within 30 days, or tell you within that time when we will be able to respond. We may charge a reasonable fee for an access request and will tell you the amount first.

Accuracy, protection and retention

We take reasonable steps to keep personal data accurate and complete, protect it with reasonable security arrangements, and stop keeping it, or anonymize it, once it is no longer needed for the purposes it was collected for or for legal or business purposes. Retention periods are in the Privacy Policy.

Transfers outside Singapore

Our service providers may process personal data outside Singapore, including in [COUNTRIES]. Before transferring it, we take steps to ensure the recipient is bound by legally enforceable obligations, such as contractual clauses, to give it a standard of protection comparable to the PDPA.

Data breaches

If a data breach is likely to result in significant harm to you, or affects 500 or more individuals, we will notify the Personal Data Protection Commission no later than three calendar days after assessing that it is notifiable, and notify affected individuals where required.

Marketing

We do not send marketing messages to Singapore telephone numbers. [If this changes, we will check the Do Not Call Registry and obtain consent where required.]

Complaints

Please contact our data protection officer first. You may also contact the Personal Data Protection Commission (pdpc.gov.sg).