1. Objective

In the course of conducting its business and providing its services, the Company may gather and process personal data. These can include personal data (any information that can or will lead to identifying you) from customers, suppliers, business contacts, employees, representatives, partners, agencies, authorities, contracting parties, III parties, and other individuals the organisation has a relationship with or may need to contact.

This policy describes how this personal data must be collected, used, disclosed, stored, protected to meet the Company’s data protection standards and to comply with the Personal Data Protection Act 2012 of Singapore (PDPA).

The contents of this policy may be updated from time to time and individuals providing personal data should revisit this policy at least once every quarter.

This Policy is available on request. A version of this statement is also available on the Company’s website.

2. Scope

This data protection policy ensures the Company:

• Complies with PDPA and follow good practices
• Protects the rights of staff, customers and partners
• Is open about how it stores and processes individuals’ data
• Protects itself from the risks of a data breach

 

3. Personal Data Protection Act

PDPA describes how organisations must collect, use, disclose, and store personal data. Data protection includes collection, use, disclosure, and storage of personal data of individuals dealing with the Company.

The policy applies regardless of whether data is stored electronically, on paper, or on any other medium. PDPA is underpinned by 11 key obligations (whether in force or to be notified). According to these obligations, personal data must:

1. Be obtained with consent
2. Be obtained only for specific, lawful purposes
3. Be obtained with notification of purpose
4. Be provided for access and/or correction on request by applicant
5. Be notified to relevant authorities and persons in the event of qualifying as a notifiable data breach
6. Be ported to another organization or platform on request
7. Be accurate, up to date, adequate, relevant and not excessive
8. Be protected in appropriate ways
9. Not be retained or held for any longer than necessary
10. Not be transferred outside Singapore, unless that recipient country or territory or recipient organization also ensures an adequate level of protection
11. Be processed in accordance with requisite policies and practices, complaint handling process, and PDPA regulations
12. Comply with Do Not Call (DNC) provisions

 

4. Corporate Structure

Everyone who works for or with the Company has relevant responsibility for ensuring data is collected, used, disclosed, stored and handled / processed appropriately.

These following people have key areas of responsibility:

• The board of directors is ultimately responsible for ensuring that the Company meets its legal obligations
• The data protection officer (DPO) contact particulars are:

Email:	dpo@tecomart.co
Write in:	Data Protection Officer 10 Jalan Besar, #B1-22 Sim Lim Tower, Singapore 208787

The DPO is responsible for the following:

1. Keeping the board updated about data protection responsibilities, risks and issues
2. Reviewing all data protection procedures and related policies, in line with an agreed schedule
3. Arranging data protection training and advice for the people covered by this policy
4. Handling data protection questions from staff and anyone else covered by this policy
5. Dealing with requests from individuals to see the data the Company holds about them
6. Checking and approving any contracts or agreements with third parties that may handle the company’s sensitive data

 

5. General staff guidelines

1. The only people able to access data covered by this policy would be those who need it for their work
2. Data is not shared informally. When access to confidential information is required within the Company, employees will request it from their line managers
3. The Company has and shall continue to provide training to all employees to help them understand their responsibilities when handling data
4. Employees will keep all data secure, by taking sensible precautions and following the guidelines below:
   
   • In particularly, using strong passwords and never be shared
   • Personal data will not be disclosed to unauthorised persons, either within the company or externally
   • Data will be regularly reviewed and updated if it is found to be out of date. If no longer required, it will be deleted and disposed of
   • Employees shall request help from their line manager or the data protection officer if they are unsure about any aspect of data protection.

 

6. Collection of Personal Data

By interacting with, submitting information to, or signing up with us for products or services offered by us, you agree and consent to the Company (including their related corporations and overseas branches and offices) (collectively, the “Company”), as well as their respective representatives and/or agents (“Representatives”) (the Company and Representatives are collectively referred to herein as “us”, “we”, or “our”) collecting, using, disclosing and sharing amongst themselves your Personal data, and disclosing such Personal data to the Company’s authorised service providers and relevant third parties in the manner set forth in this Data Protection Policy.

It applies to all data that the company holds relating to identifiable individuals, even if that information technically falls outside of PDPA.

We only collect data necessary for fulfilling our product / service requirements. By submitting your data, you are deemed to have given your consent to our collection, use, disclosure, and storage of your personal data. Please let us know if you wish to withdraw or vary your consent. In the event any other use of your personal data is contemplated, we will notify you of the same.

1. Personal data may be collected in the following ways:
1. Form submission, including but not limited to application forms or other forms relating to any of our products or services which may be enquired about or purchased through the Company
2. Any agreement or providing of other documentation or information in respect of your interactions with us, or when you use our services
3. Interaction with our staff, including relationship managers and their assistants, example via telephone calls (which may be recorded), letters, fax, face-to-face meetings and emails
4. Images captured via closed-circuit television cameras (“CCTVs”) while you are within our premises, or via photographs or videos taken by us or our representatives when you attend events hosted by us
5. Use of services provided through our online and other technology platforms, such as websites and apps, including when you establish any online accounts with us
6. Request that we contact you, or include you in an email or other mailing list; or when you respond to our request for additional personal data, our promotions and other initiatives
7. Contact by, and / or response to, our marketing representatives, agents and other service providers
8. Information sought about you and receipt of your personal data from third parties in connection with your relationship with us, for example, from referrers, business partners, external or independent asset managers, public agencies or the relevant authorities
9. Personal data through physical access, internet and information technology monitoring processes
10. Personal data in connection with any investigation, litigation, registration or professional disciplinary matter, criminal prosecution, inquest or inquiry which may relate to you
11. Direct submission by you of your personal data to us
2. When you browse our website and platforms, you generally do so anonymously but please see the section below on cookies. We do not, at our website and platforms, automatically collect personal data, including your email address unless you provide such information or login with your account credentials.
3. If you provide us with any personal data relating to a third party (for example, information of your spouse, children, parents, or a representatives), by submitting such information to us, you represent to us that you have obtained the consent of the third party to you providing us with his/her personal data for the respective purposes.
4. Accuracy: You should ensure and check that all personal data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with products and services you have requested. You agree to inform us immediately of any change of facts or circumstances which may render any information or personal data previously provided inaccurate, untrue or incorrect and provide any information or documentation as we may reasonably require for the purposes of verifying the accuracy of the updated information or personal data.

 

7. Use of Personal Data

Personal data is of no value to the Company unless the business can make use of it. However, it is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or theft. The general staff guidelines are:

• When working with personal data, employees to ensure the screens of their computers are always locked when left unattended.
• Personal data is not shared informally. It should never be sent by email, as this form of communication is not secure.
• Data must be encrypted before being transferred electronically. The IT manager can explain how to send data to authorised external contacts.
• Personal data should never be transferred outside of Singapore unless recipient country and / or recipient organization observes personal data protection through law and policies. Where our servers are outside Singapore, we ensure that the personal data is protected under PDPA (Transfer Limitation).
• Employees should not save copies of personal data to their own devices. Always access and update the central copy of any data.

The Company hereby notifies you of use your personal data for the following purposes:

1. verifying your identity
2. managing the administrative and business operations of the Company and complying with internal policies and procedures and sharing between departments within the Company (including but not limited to facilitating business continuity planning)
3. audit purposes
4. verifying or confirming trade orders and transactions or instructions from you or for your orders
5. facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales) involving the Company
6. matching any personal data held which relates to you for any of the purposes listed herein
7. responding to and resolving complaints and handling requests and enquiries, requests, feedback, and suggestions
8. preventing, detecting and investigating crime, analysing and managing commercial risks
9. project management
10. providing media announcements and responses
11. requesting feedback or participation in surveys, as well as conducting market research and/or analysis for statistical, profiling or other purposes for us to design our products / services, understand customer behaviour, preferences and market trends, and to review, develop and improve the quality of our products and services
12. managing the safety and security of our premises and services (including but not limited to carrying out CCTV surveillance and conducting security clearances)
13. managing and preparing reports on incidents and accidents
14. organising events, seminars or trainings
15. complying with any applicable rules, laws and regulations, codes of practice or guidelines, obligations, requirements or arrangements for collecting, using and disclosing personal data that apply to the Company
16. to assist in law enforcement and investigations by relevant authorities
17. archival management (including but not limited to warehouse storage and retrievals)

 

8. Disclosure of Personal Data

The Company may disclose your personal data, locally or overseas, to:

1. Departments within the Company for the above use and purposes
2. Networks
3. Contracting parties
4. Referrers who have referred you to the Company
5. Agents, contractors, vendors, installers, or third-party service providers who provide administrative or operational services to the Company, such as data intermediaries, courier services, telecommunications, information technology, payment, payroll, processing, training, market research, storage, archival, customer support investigation services or other services to the Company
6. Agents, contractors, vendors or other third-party service providers in connection with marketing, products and services offered by the Company
7. Analytics, search engine providers or third-party service providers that assist us in delivering our products, services, websites and platforms as well as improving and optimising the same
8. Any business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or any debt or asset sale) involving any of the Company
9. Professional advisers such as auditors and lawyers
10. Relevant government regulators, government ministries, exchange, statutory boards or authorities or law enforcement agencies who have jurisdiction over the Company or any Company or over any transaction entered by you
11. Any liquidator, receiver, administrator, judicial manager, trustees-in-bankruptcy, custodian or other similar official who has been so appointed, pursuant to bankruptcy, winding-up or insolvency proceedings instituted in Singapore or elsewhere, in respect of you or your assets
12. Third parties who organise promotional or marketing events, seminars or trainings
13. Any other party to whom you authorise us to disclose your personal data to.

The Company will take reasonable steps to protect your personal data against unauthorised disclosure by overseas entities or organizations, check for transfer limitation obligation – by ensuring the recipient country or at least the recipient organization has data protection laws and policies.

 

9. On-going Notifications

1. If you have provided your Singapore telephone number(s) and have indicated that you consent to receiving marketing or promotional information via your Singapore telephone number(s), then from time to time, the Company may contact you using such Singapore telephone number(s) (including via voice calls, text, fax or other means) with information about our products and services (including discounts and special offers).
2. In relation to particular products or services or in your interactions with us, we may also have specifically notified you of other purposes for which we collect, use or disclose your personal data. If so, we will collect, use and disclose your personal data for these additional purposes as well, unless we have specifically notified you otherwise.
3. If you do not wish to receive any calls from us, please let us know and we shall act accordingly.

 

10. Use of Cookies and Related Technologies

1. The Company’s websites and platforms use cookies and other technologies. Cookies are small text files stored in your computing or other electronic devices when you visit our website and platforms for record keeping purposes. Cookies are stored in your browser’s file directory, and the next time you visit the website or platform, your browser will read the cookie and relay the information back to the website, platform or element that originally set the cookie. Depending on the type of cookie it is, cookies may store user preferences and other information.
2. Web beacons (also known as pixel tags and clear GIFs) involve graphics that are not apparent to the user. Tracking links and/or similar technologies consist of a few lines of programming code and can be embedded in our websites or platforms. Web beacons are usually used in conjunction with cookies and primarily used for statistical analysis purposes. This technology can also be used for tracking traffic patterns on websites and platforms, as well as finding out if an e-mail has been received and opened and to see if there has been any response.
3. The Company may employ cookies and other technologies as follows:
   1. tracking information such as the number of visitors and their frequency of use, profiles of visitors and their preferred sites
   2. making our websites and platforms easier to use. For example, cookies may be used to help speed up your future interactions with our websites and platforms
   3. to better tailor our products and services to your interests and needs
   4. collating information on a user’s search and browsing history
   5. when you interact with us on our websites and platforms, we may automatically receive and record information on our server logs from your browser. We may collect for the purposes of analysis, statistical and site-related information including, without limitation, information relating to how a visitor arrived at the website or platform, the browser used by a visitor, the operating system a visitor is using, a visitor’s IP address, and a visitor’s click stream information and time stamp (which may include for example, information about which pages they have viewed, the time the pages were accessed, and the time spent per web page)
   6. using such information to understand how people use our websites and platforms, and to help us improve their structure and contents
   7. using cookies that are necessary in order to enable our websites and platforms to operate, for example, cookies that enable you to log onto secure parts of our websites and platforms
   8. personalising the website and platform for you, including delivering advertisements which may be of particular interest to you and using cookie related information to allow us to understand the effectiveness of our advertisements.
4. Some cookies we use are from third party companies to provide us with web analytics and intelligence about our websites and platforms. These companies collect information about your interaction with our websites and platforms. We use such information to compile statistics about visitors who interact with the websites, platforms and other companies’ online content, to gauge the effectiveness of our communications, and to provide more pertinent information to our visitors.
5. If you do not agree to our use of cookies and other technologies as set out in this Data Protection Policy, you should delete or disable the cookies associated with our websites and platforms by changing the settings on your browser accordingly. However, you may not be able to enter certain part(s) of our websites or platforms. This may also impact your user experience while on our websites or platforms.
6. Third-Party Sites: Our website may contain links to other websites operated by third parties. We are not responsible for the data protection policies or privacy practices of websites operated by third parties that are linked to our website. We recommend you learn about the policies and practices related to data of such third-party websites.

 

11. Data Protection Measures

This policy helps to protect the Company from data security risks.

1. The Company keeps all physical data (non-electronic and electronic forms in data storage devices) confidential and under lock and key. Only authorised personnel are allowed access to that data required for providing the product or service. All personnel data are marked confidential.
2. The Company will take reasonable efforts to protect personal data in our possession or our control by making reasonable security and IT arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. Access of data is restricted to authorised personnel and to seniority of personnel. However, we cannot completely guarantee the security of any personal data we may have collected from or about you or prevent harmful code that enter our website. You should be aware of the risks associated with using websites and take necessary precautions.
3. While all steps will be taken to protect your personal data, security of the information you transmit to us via the Internet or electronic communication or when you use our electronic services cannot be ensured. You should take every precaution to protect your personal data when you use such platforms. We recommend that you change your passwords often, use a combination of letters and numbers, and ensure that you use a secure browser.
4. If applicable, you undertake to keep your username and password secure and confidential and shall not disclose or permit it to be disclosed to any unauthorised person, and to inform us as soon as reasonably practicable if you know or suspect that someone else knows your username and password or believe the confidentiality of your username and password has been lost, stolen or compromised in any way or that actual or possible unauthorised transactions have taken place. We are not liable for any damages resulting from any security breaches, on unauthorised and/or fraudulent use of your username and password.

 

12. Data storage

These rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the IT manager or data controller.

When data is stored on paper, it will be marked “CONFIDENTIAL” and kept in a secure place where unauthorised people cannot see it. These guidelines also apply to data that is usually stored electronically but has been printed out for some reason:

• When not required, the paper or files should be kept in a locked drawer or filing cabinet.
• Employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer.
• Data printouts should be shredded and disposed of securely when no longer required.
• When data is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts:
• Data to be protected by strong passwords that are changed regularly and never shared between employees.
• If data is stored on removable media (like a USB device, external storage medium, CD or DVD), to be kept locked away securely when not being used.
• Data to only be stored on designated drives and servers and to be uploaded only to an approved cloud computing services which are PDPA compliant.
• Servers containing personal data to be sited in a secure location, away from general office space.
• Data to be backed up frequently. Those backups should be tested regularly, in line with the company’s standard backup procedures and where possible to be encrypted and password protected.
• Data should never be saved directly to laptops or other mobile devices like tablets or smart phones.
• All servers and computers containing data should be protected by approved security software and a firewall.

 

13. Data accuracy

It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.

• Data will be held in as few places as necessary. Staff will not create any unnecessary additional data sets.
• Staff will take every opportunity to ensure data is updated by follow up calls or emails and recording them.
• The Company will make it easy for data subjects to update the information the Company holds about them such as on company websites.
• Data to be updated as inaccuracies are discovered.

 

14. Access & Correction Requests

All individuals who are the subject of personal data held by the Company are entitled to:

• Ask what information the company holds about them and why.
• Ask how to gain access to it but must specify the type of data and time range.
• Be informed how to keep it up to date.
• Be informed how the company is meeting its data protection obligations.
• Correct any mistakes or update their personal data in possession of the Company

An individual can contact the Company and request for her/his personal data (Access Request). Access Requests from individuals should be made by email, addressed to the DPO. The DPO may supply a standard request form, although individuals do not have to use this.

Individuals will be charged a reasonable fee per Access Request to defray minimum costs. This may also increase depending upon the extent and effort of procuring the personal data. The DPO will aim to provide the relevant data within 30 calendar days.

The DPO will always verify the identity of anyone making an Access Request before handing over any information. Correction requests will be carried out within 30 calendar days. No charge will be levied for any correction requests.

 

15. Retention of Personal Data

So long as you have a direct or indirect relationship with the Company, your personal data will be held and processed in accordance with this Policy. Once the relationship ends or you withdraw all your personal data, the Company will not retain your personal data unless there are legal and / or business reasons for so doing.

 

16. Governing Law

This Data Protection Policy shall be governed in all respects by the laws of Singapore.

 

Unsolicited Personal Data: In the event information is provided in hard copy or website without our specific collection of data, you agree that you hereby give your consent for our collection, use, and disclosure of this data to fulfill the purpose specified by you / respond to your query. Please let us know if you would like to withdraw your consent using our Data Application Form.

Retention Policy: Personal data will be retained by the Company till purpose is fulfilled. This is subject to sectoral and other written laws which includes law relating to the sector the Company does business in, employment laws, CPF, income tax laws, Limitation Act, and other regulations thereunder.