Menu

Privacy Notification

SCOPE OF THIS PRIVACY NOTIFICATION

This Privacy Notification sets out the basis which Yellow Ribbon Industries Pte Ltd (“we”, “us”, “our” or “YRI”) may collect, use, disclose, store, or otherwise process personal data in accordance with the Personal Data Protection Act 2012 (“PDPA”). This Privacy Notification applies to personal data in our possession or under our control, including personal data in the possession of organisations which we have engaged to collect, use, disclose or process personal data in connection with our business, website, products, services, events, marketing activities, customer relationships, vendor relationships, recruitment activities, and other dealings with individuals. The Privacy Notification applies to individuals who interact with us, including customers, prospective customers, website visitors, persons who submit enquiries or other information through our website or other digital channels, business contacts, representatives of corporate customers or vendors, job applicants, event participants, and any other individuals whose personal data we may process.

This Privacy Notification should be read together with any additional privacy notices, consent forms, contractual terms, or other notices that we may provide to you in specific circumstances.  To the extent of any inconsistency, the more specific notice or terms relevant to the particular collection, use, disclosure, or other processing of your personal data will apply.

ORGANISATION OVERVIEW

Yellow Ribbon Industries Pte Ltd is a wholly-owned subsidiary of Yellow Ribbon Singapore that provides laundry and linen management services, food and business solutions, and transitional residential programme. It acts as an intermediary with the Singapore Prison Service to carry out the above-mentioned business activities.

PERSONAL DATA COLLECTION AND ITS USAGE

  1. As used in this Privacy Notification: “Personal data” means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access. If you use our website or digital services, we may also collect technical and usage information, including your IP address, device identifiers, browser type, operating system, referring pages, pages viewed, date and time of access, approximate location derived from your device or IP address, and information about how you interact with our website or digital services. Where you provide us with personal data relating to another individual, you represent and warrant that you have notified that individual of the purposes for which we may collect, use, and disclose their personal data, and that you have obtained any consent required under applicable law for us to process that personal data in accordance with this Privacy Notification.
  2. Depending on the nature of your interaction or engagement with us, some examples of your personal data which we may collect and use include name, residential address, email address, telephone number, nationality, gender, date of birth, marital status, photograph, employment information, financial information and other information on certification. Our organisation collects and uses the personal data of the respective individuals in the following ways for specified purposes in order to carry out the activities for which we have been engaged, and for purposes reasonably related to that interaction or engagement:
    1. Employees: We collect and use personal details relating to employees such as (a) name or alias, gender, NRIC/FIN or passport number, date of birth, nationality, and country and city of birth; (b) mailing address, telephone numbers, email address and other contact details; (c) employment and training history; (d) salary information and bank account details; (e) details of employee next-of-kin, spouse and other family members; (f) work related health issues and disabilities; (g) records on leave of absence from work; (h) photographs and other audio-visual information; and (i) performance assessments and disciplinary records. We use this personal data to conduct our business, evaluate performance, provide employee benefits, meet our legal obligations as an employer and otherwise manage and administer our employment relationship with our employees.We may also collect photographs, video recordings, audio recordings and other media in which employees are identifiable (“Media”). Where permitted under applicable law, such Media may be collected and used for purposes connected with the employment relationship, internal communications, training, administration, security, reporting and other legitimate organisational purposes.Where an employee has consented to such use or disclosure, the consent does not automatically cease merely because the employee resigns, retires, has his or her employment terminated or otherwise ceases to be employed by YRI. Subject to applicable law and the terms of the consent, YRI may continue to use or disclose the Media for the notified purposes unless and until the individual withdraws his or her consent by giving reasonable notice in accordance with the section ‘Withdrawing Your Consent’ below.The Media may include photographs, recordings or other materials created previously during the individual’s employment or participation in YRI activities, as well as Media subsequently created by or on behalf of YRI , subject to the purposes notified and any applicable consent.
    2. Job applicants: We collect and use personal data provided by job applicants, their referees and via background checks to be used in connection with assessing the applicants for employment opportunities.
    3. Monitoring of machinery: We may collect and use personal data through using CCTV cameras to assist with monitoring the operation of machinery and security of premises.
    4. Residents: We collect and use personal details relating to residents of Selarang Halfway House (“SHWH”) such as name, date of birth, emergency contact. If relevant, we will also collect medical records and employment placement details. We will also collect and use information relating to these individuals that the Singapore Prison Service (“SPS”) or Yellow Ribbon Singapore (“YRSG”) decide to provide. This information is collected and used to provide the transitional residential programme activities delivered by SHWH. We also collect and use information about a resident's participation in these programme activities.
    5. Customers, supplier and service provider contacts and personnel: We collect and use contact details of individuals within customer, supplier and service provider organisations so that we can communicate with them about our business activities together. Personnel of some supplier and service provider organisations may work more closely with us. As a result, we may need to collect additional details about those personnel in order to vet them and address applicable building and system access and security requirements. Further, if those personnel need access to prison facilities as part of the engagement with us, then the personnel may need to provide additional details. The details required may depend on legal, contractual, operational, and/or the security requirements applying at Changi Prison Complex, Selarang Park Complex and SPS premises, but typically include name, NRIC/FIN or passport number, car licence plate.
    6. Inmate workers: For inmate workers placed with YRI we collect and use personal details as directed by YRSG and SPS for payroll processing and to undertake activities for the placement arrangement as directed by YRSG and SPS.
    7. Visitors: We generally collect and use personal details of visitors to our office premises, SHWH and facilities such as name, identity card number and contact number. These details are collected for security and access management purposes, and other incidental reporting or administrative purposes.
    8. Site visits: We collect additional personal details of individuals who apply for a site visit to our facilities at Changi Prison Complex and Selarang Park Complex. The details required depend on the legal, contractual, operational, and/or security requirements applying at Changi Prison Complex, Selarang Park Complex and SPS premises, but typically include name, NRIC/FIN or passport number, car licence plate.
    9. Business Contact Information: We may collect, use, and disclose business contact information relating to individuals in their professional or business capacity, such as name, position, business telephone number, business email address, business address, and other similar information, for purposes such as managing business relationships, communicating with corporate customers, vendors, partners, and professional contacts, performing contracts, and administering our business operations. Where business contact information is excluded from certain obligations under the Personal Data Protection Act 2012, we may nevertheless handle such information in a responsible manner and in accordance with applicable law. However, information submitted through a website enquiry form will not necessarily constitute Business Contact Information merely because a business email address or business contact number is used. Whether information constitutes Business Contact Information depends on the capacity and purpose for which it is provided.

    Website enquiries: If you submit an enquiry through our website or other digital channels, we may collect personal data that you provide in the enquiry form or correspondence, such as your name, email address, contact number, organisation/company (where applicable), the nature, category or subject of your enquiry, and any information you choose to include in your message.

    We may collect, use and disclose such personal data for the purposes of receiving, assessing, responding to and following up on your enquiry; verifying or clarifying information provided; maintaining records of enquiries and correspondence; and referring or routing the enquiry and relevant information to the appropriate business group, department, programme, service or personnel within YRI for handling.

    Where your enquiry concerns a business, collaboration or partnership opportunity, we may also use the information to assess, discuss and follow up on that opportunity and to manage any resulting business relationship.

    Enquiries relating to Selarang Halfway House: Where an enquiry relates to Selarang Halfway House (“SHWH”), its residents, programmes, activities or work, we may use and disclose the personal data provided to assess, respond to and follow up on the enquiry and, where appropriate, refer the enquiry and relevant information to personnel responsible for SHWH and/or to Yellow Ribbon Singapore (“YRSG”) or the Singapore Prison Service (“SPS”) where this is reasonably necessary or otherwise permitted or required by law.

    If you provide personal data relating to another individual, including a SHWH resident, you should provide only information reasonably necessary for the enquiry and should not provide NRIC/FIN or passport numbers, financial information, medical or health information or other sensitive personal data unless this is necessary for us to deal with the enquiry and you are authorised or otherwise permitted by law to provide it.

    The general website enquiry form is not intended for job applications or recruitment enquiries. Persons interested in employment with YRI  should use YRI’s designated recruitment channels.

DISCLOSURE OF PERSONAL DATA

  1. We may disclose your personal data:
    1. Customers, suppliers and service providers: We share contact details of our relevant employees with customers, suppliers and service providers in order to conduct our business activities and receive supplies and services necessary for those activities such as IT support. We may also share employee details with providers of employee benefits such as medical benefits to enable the service provider to identify the employee.
    2. Financial institutions: We share personal data with financial institutions in connection with invoicing of our customers and payments and other benefits to be made to our suppliers and service providers as well as employees.
    3. Disclosures to YRSG and SPS: We disclose to the SPS details collected for site visits to Changi Prison Complex, Selarang Park Complex and SPS premises, so they can vet proposed visitors. We are required to disclose to YRSG and the SPS certain personal data relating to inmate workers and SHWH residents.
    4. Mandatory and permitted disclosures: We share personal data where required under law such as to comply with our obligations as an employer or a legally enforceable demand. We may also share personal data where permitted to under law. We may share personal data to establish or protect our legal rights, property, or safety, or the rights, property, or safety of others, or to defend against legal claims.
    5. For completeness, we may engage third-party service providers, contractors, agents, and data intermediaries to process personal data on our behalf or to support our business operations. These may include IT service providers, cloud hosting providers, payment processors, customer relationship management providers, marketing service providers, analytics providers, logistics providers, event organisers, professional advisers, and other vendors or service providers. Where we disclose personal data to data intermediaries or service providers, we will require them to protect the personal data they process for us and to use it only for the purposes for which we have engaged them, unless otherwise permitted by law.
    6. Website enquiries: Personal data submitted through our website or other digital enquiry channels may be disclosed or made available to the relevant personnel, departments, business groups, programmes or services within YRI for the purposes of assessing, responding to and following up on the enquiry.
    7. Where reasonably necessary having regard to the subject matter of the enquiry, we may also disclose relevant personal data to YRSG, SPS, our service providers, professional advisers or other relevant parties involved in addressing the enquiry, where permitted or required under the PDPA or other applicable law.

DEEMED CONSENT

  1. We generally collect, use, and disclose personal data with your consent, where consent is deemed under the Personal Data Protection Act 2012, or where such collection, use, or disclosure is otherwise permitted or required under applicable law. We may collect or use your personal data, or disclose existing personal data for secondary purposes that differ from the primary purpose which it had originally collected for pursuant to clauses 2 and 3. If YRI intends to rely on deemed consent by notification for such secondary purposes, YRI will notify you of the proposed collection, use or disclosure of his personal data through appropriate mode(s) of communication.
  2. In addition to and/or as an alternative to obtaining your express consent, we may rely on deemed consent or deemed consent by notification under the PDPA to collect, use, and/or disclose your personal data for the following purposes, particularly if you have voluntarily provided the personal data to us for that purpose in the circumstances, and it was reasonable that you would voluntarily provide that personal data in the circumstances:
    1. verifying your identity, eligibility, appointment details, registration status, or other information required to provide services, administer programs, or process applications which you voluntarily submitted;
    2. contacting you in relation to public-sector services, schemes, programs, consultations, appointments, events, feedback, applications, transactions, or requests that you have participated in or submitted;
    3. updating, reconciling, validating, or correcting records maintained by us or by a public agency to ensure that information used for service delivery, case management, reporting, or administrative purposes is accurate and complete;
    4. managing access to premises, systems, portals, events, training sessions, or service locations, including registration, authentication, attendance-taking, visitor management, and security administration;
    5. facilitating or conducting surveys, service-quality checks, feedback exercises, user research, analytics, or program evaluation relating to services, platforms, initiatives, or programs provided by or on behalf of a public agency, where practicable using aggregated or de-identified information;
    6. supporting audits, compliance reviews, investigations, incident management, complaint handling, dispute resolution, or quality assurance activities relating to services performed for or with a public agency, where practicable using aggregated or de-identified information; and
    7. generating operational, statistical, or management reports for public agencies, including reports on service usage, program participation, transaction status, performance indicators, or service outcomes, where practicable using aggregated or de-identified information.
  3. Before relying on deemed consent by notification, YRI will assess and determine that the collection, use and disclosure of the personal data will not likely have an adverse effect on you, and has implemented reasonable measures to eliminate, reduce, or mitigate any identified adverse effect.
  4. You will be given a reasonable period, and in a reasonable manner, to inform us if you wish to opt-out of our proposed collection, use and disclosure of your personal data for the purposes stated in the relevant notification.
  5. If you do not notify us within the opt-out period that you do not consent, you will be deemed to have consented to our collection, use, or disclosure of your personal data for the purposes stated in the relevant notification, subject to the requirements of the Personal Data Protection Act 2012. After the opt-out period has lapsed, you may still withdraw any consent deemed by notification by giving us reasonable notice of your withdrawal. Upon receiving your withdrawal notice, we may inform you of the likely consequences of the withdrawal and will cease collecting, using, or disclosing your personal data for the relevant purposes, unless such collection, use, or disclosure is otherwise permitted or required under applicable law.

RELIANCE ON THE LEGITIMATE INTERESTS EXCEPTION AND OTHER RELEVANT EXCEPTIONS

  1. In certain circumstances, we may collect, use, or disclose personal data without consent where permitted by law. These circumstances may include where the collection, use, or disclosure is necessary to comply with legal obligations, respond to an emergency that threatens life, health, or safety, conduct investigations or proceedings, recover debts, evaluate suitability or eligibility, manage employment relationships, improve our services or business operations, prevent fraud or misuse, protect our legitimate interests, or use publicly available personal data. For instance, in compliance with the PDPA, we may collect, use or disclose your personal data without your consent for the legitimate interests of YRI or approved intermediary. In relying on the legitimate interests exception of the PDPA, YRI will assess the likely adverse effects on the individual and determine that the legitimate interests outweigh any adverse effect. Where we rely on an exception to consent, including the legitimate interests exception or deemed consent by notification, we will take steps required by applicable law, which may include assessing potential adverse effects on individuals, implementing reasonable safeguards, and providing relevant notification where required.
  2. In line with the legitimate interests exception, we may collect, use or disclose your personal data for purposes such as:
    1. Fraud detection and prevention;
    2. Detection and prevention of misuse of services;
    3. Network analysis to prevent fraud and financial crime, and perform credit analysis; and/or
    4. Collection and use of personal data on company-issued devices to prevent data loss.

The purposes listed in the above clause may continue to apply even in situations where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter.

WITHDRAWING YOUR CONSENT

  1. The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time it is being withdrawn by you in writing. You may withdraw consent and request us to stop collecting, using and/or disclosing your personal data for any or all of the purposes listed above by submitting your request in writing or via email to our Data Protection Officer at the contact details provided below. Withdrawal of consent generally operates prospectively after YRI has had a reasonable period to process and implement the withdrawal.
  2. Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. In general, we shall seek to respond to your request within three (3) business days of receiving it.
  3. Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, your request may be subject to exceptions, limitations, and conditions under applicable law, and we may not be in a position to continue providing our goods or services to you and we shall, in such circumstances, notify you before completing the processing of your request. For example, we may be unable to provide access to certain information, may be required or permitted to retain certain personal data, or may be unable to continue providing certain products or services if you withdraw consent for personal data that is necessary for those products or services. Should you decide to cancel your withdrawal of consent, please inform us in writing in the manner described in clause 11 above.

Where you withdraw consent to the future use or disclosure of photographs, video recordings or other Media, YRI will cease the relevant future use or disclosure to the extent required by the PDPA after allowing a reasonable period to process and implement the withdrawal, unless the relevant collection, use or disclosure is otherwise permitted or required under the PDPA or other applicable law.

Withdrawal will not, merely by reason of the withdrawal, require YRI to retrieve, recall, destroy or alter printed or other materials which had already been lawfully published or distributed before the withdrawal became effective.

Where personal data or Media had already been lawfully published or otherwise made publicly available before the withdrawal became effective, copies may have been downloaded, copied, shared, reproduced or otherwise disseminated by third parties. YRI may not be able to retrieve or remove copies which are no longer within YRI ’s possession or control, subject always to YRI’s obligations under applicable law.

For the avoidance of doubt, material which has merely been prepared or printed but has not yet been published or distributed when a withdrawal becomes effective will be considered separately by YRI in accordance with the PDPA and other applicable law.

ACCESS TO AND CORRECTION OF PERSONAL DATA

  1. If you wish to make (a) an access request for access to a copy of the personal data which we hold about you or information about the ways in which we use or disclose your personal data, or (b) a correction request to correct or update any of your personal data which we hold about you, you may submit your request in writing or via email to our Data Protection Officer at the contact details provided below.
  2. Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.
  3. We will respond to your request as soon as reasonably possible. In general, our response will be within three (3) business days. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the PDPA). For security reasons, we reserve the right to take steps to authenticate the identity of the requesting party before responding to your query or request.

PROTECTION OF PERSONAL DATA

  1. To safeguard your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, we have introduced appropriate administrative, physical and technical measures such as:
    1. Minimised collection of personal data;
    2. Authentication and restricting access controls (such as good password practices, need-to-basis for data disclosure, etc.);
    3. Data anonymisation;
    4. Encryption of data;
    5. Secured LAN, VPN, up-to-date antivirus protection, and other IT security measures with regular review by our IT Service intermediary;
    6. Deploying physical and technological safeguards to restrict access;
    7. Secured disposal of personal data after the purpose has ceased; and/or
    8. Regular training of our staff to limit human error that might pose a breach incident.

ACCURACY OF PERSONAL DATA

  1. We generally rely on personal data provided by you (or your authorised representative). In order to ensure that your personal data is current, complete and accurate, please update us if there are changes to your personal data by informing our Data Protection Officer in writing or via email at the contact details provided below.

RETENTION OF PERSONAL DATA

  1. We may retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws. Photographs, video recordings and other Media, and records of the consent relating to them, may be retained for so long as such retention continues to serve the purposes for which they were collected or another legal or business purpose permitted by law. Historical corporate records, including annual reports and records of corporate events, may be retained in accordance with YRI’s applicable records-retention requirements.
  2. We will cease to retain your personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for legal or business purposes.
  3. Withdrawal of consent does not of itself require YRI to delete or destroy personal data which YRI is otherwise permitted or required to retain under the PDPA or other applicable law.

TRANSFERS OF PERSONAL DATA OUTSIDE OF SINGAPORE

  1. We generally do not transfer your personal data to countries outside of Singapore. However, if we do so, we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPA and under appropriate safeguards as required under the PDPA, while concurrently implementing administrative, technical, and policy measures in accordance with the PDPA. Our current practice is that we do not transfer any personal data outside of Singapore, except in the following limited circumstances:
    1. Contact details of our personnel may be disclosed to suppliers and prospective suppliers of materials to be used in our business who are located outside of Singapore;
    2. If our personnel are travelling outside of Singapore for work, their personal details necessary to make such travel arrangements and booking make be disclosed to relevant parties outside of Singapore; and
    3. We use verified, cloud-based platforms or services to support our operations. While we configure such platforms or services to store your personal data in Singapore as far as practicable, your personal data may be accessed or processed by the cloud service provider’s affiliates or authorised sub-processors located outside of Singapore for their purposes of providing, maintaining, and securing their services to us.

DATA BREACH NOTIFICATION

  1. We take reasonable steps to protect personal data in our possession or under our control. However, if a data breach occurs, we will take steps to assess the incident, contain the breach, mitigate potential harm, and determine whether the breach is notifiable under the Personal Data Protection Act 2012.
  2. Where we determine that a data breach is notifiable, we will notify the Personal Data Protection Commission and, where required, affected individuals, in accordance with applicable legal requirements. We may also notify other regulators, law enforcement agencies, contractual counterparties, or affected third parties where required or appropriate.
  3. If we notify you of a data breach, we may provide information about the nature of the breach, the personal data affected, steps we have taken or will take in response, and measures you may take to protect yourself, where appropriate and practicable.

CHILDREN’S AND MINORS’ PERSONAL DATA

  1. Our products, services, and website are not intended for children or minors, unless expressly stated otherwise. We do not knowingly collect personal data from children or minors without appropriate consent from a parent or legal guardian where such consent is required by law.
  2. If you are a parent or legal guardian and believe that a child or minor has provided personal data to us without appropriate consent, please contact our Data Protection Officer. We may take steps to verify the circumstances and, where appropriate, delete or restrict the processing of the relevant personal data.
  3. Where we offer products, services, events, or programs that involve children or minors, we may collect and process personal data relating to children or minors for purposes that are reasonable and necessary for those activities, and we will take appropriate steps to protect such personal data.

THIRD-PARTY WEBSITES AND LINKS

  1. Over the course of our engagement with you or our provision of products and/or services to you, our website, communications, or digital services may contain links to third-party websites, platforms, applications, or services that are not operated or controlled by us. This Privacy Notification does not apply to those third-party websites, platforms, applications, or services.
  2. We are not responsible for the privacy practices, content, security, or data handling practices of third parties. You should review the privacy policies and terms of use of any third-party website, platform, application, or service before providing personal data to them or using their services.

COOKIES AND OTHER TECHNOLOGIES

  1. Our website and digital services may use cookies, pixels, web beacons, tags, analytics tools, and similar technologies to operate our website, remember your preferences, understand how users interact with our website, improve our services, personalise content, measure the effectiveness of our communications, and support security and fraud prevention. Cookies are small files that are stored on your browser or device when you visit a website. Some cookies are necessary for our website to function properly, while others help us analyse usage, improve performance, or provide more relevant content. Where information collected through cookies or similar technologies constitutes personal data, we will handle that information in accordance with this Privacy Notification and the PDPA.
  2. You may be able to manage or disable cookies through your browser settings. If you disable certain cookies, some parts of our website or digital services may not function properly.
  3. We may use analytics tools, automated systems, or other technologies to analyse usage patterns, improve our website and services, personalise your experience, manage customer relationships, detect security incidents, prevent fraud, and support our business operations. Where we use automated processing, analytics, or profiling in a way that involves personal data, we will do so for purposes that are reasonable and appropriate in the circumstances and in accordance with applicable law. We will not make decisions based solely on automated processing that produce legal or similarly significant effects on you, unless such processing is permitted by law and appropriate safeguards are in place.

DATA PROTECTION OFFICER

  1. You may contact our Data Protection Officer if you have any enquiries, feedback or complaints about our personal data protection policies and procedures, or if you wish to make any request, in the following manner:Data Protection Officer, Yellow Ribbon Industries Pte Ltd;

    Email: privacyofficer@yri.com.sg
    Contact No.: +65 6592-0224
    Post: Attention to Data Protection Officer
    Yellow Ribbon Industries Pte Ltd, 27 Loyang Way, Singapore 508728

  2. We will review and respond to your query or complaint within a reasonable time. We may request additional information from you where necessary to verify your identity, understand and/or investigate your query or complaint. Where appropriate or legally applicable, we may also inform you of the outcome of our review and any steps we have taken or propose to take in response, or refrain from doing so.

EFFECT OF PRIVACY NOTIFICATION AND CHANGES TO PRIVACY NOTIFICATION

  1. This Privacy Notification should be read together with any specific notice, consent form, contractual provision or other notification provided to you in relation to a particular collection, use or disclosure of personal data, including any employee consent for the use of photographs, video recordings and other media. Where a more specific notice or consent applies to a particular activity, that notice or consent will apply to that activity to the extent of any inconsistency.
  2. We may revise this Privacy Notification from time to time. You may determine if any such revision has taken place by referring to the date on which this Privacy Notification was last updated. Your continued use of our services constitutes your acknowledgement and acceptance of such changes. However, where your consent is required under any applicable law for any changes in purpose of collecting, using, or disclosing your personal data, we will obtain your consent and inform you of such changes via our communications to you before processing your data for that purpose.
  3. Governing Law and Jurisdiction: This Privacy Notification and our handling of personal data are governed by the laws of Singapore, unless other applicable laws apply. Any dispute arising out of or in connection with this Privacy Notification or our handling of personal data will be subject to the exclusive jurisdiction of the courts of Singapore, unless otherwise required by applicable law.

Effective date: 15 October 2026
Last updated: 14 October 2026