PDPA POLICIES

The Management and staff of Winfinity (S’pore) Pte Ltd are fully committed to comply with the Personal Data Protection Act as a trusted and responsible company.

We will collect, use and disclose personal data about individuals (whether they are customers or employees) for the intended purposes and to keep their personal data safe.

We will comply with the 9 main data protection obligations of PDPA as follows:

1. Consent Obligation

Only collect, use or disclose personal data for purposes for which an individual has given his or her consent.

Allow individuals to withdraw consent, with reasonable notice, and inform them of the likely consequences of withdrawal. Upon withdrawal of consent to the collection, use or disclosure for any purpose, we must cease such collection, use or disclosure of the personal data.

2. Purpose Limitation Obligation

We may collect, use or disclose personal data about an individual for the purposes that a reasonable person would consider appropriate in the circumstances and for which the individual has given consent.

We may not, as a condition of providing a product or service, require the individual to consent to the collection, use or disclosure of his or her personal data beyond what is reasonable to provide that product or service.

3. Notification Obligation

We are to notify individuals of the purposes for which we are intending to collect, use or disclose their personal data on or before such collection, use or disclosure of personal data.

4. Access and Correction Obligation

Upon request, the personal data of an individual and information about the ways in which his or her personal data has been or may have been used or disclosed within a year before the request should be provided. However, we are prohibited from providing an individual access if the provision of the personal data or other information could reasonably be expected to:

• cause immediate or grave harm to the individual’s safety or physical or mental health;
• threaten the safety or physical or mental health of another individual;
• reveal personal data about another individual;
• reveal the identity of another individual who has provided the personal data, and the individual has not consented to the disclosure of his or her identity; or
• be contrary to national interest.

We are also required to correct any error or omission in an individual’s personal data upon his or her request. Unless we are satisfied on reasonable grounds that the correction should not be made, we should correct the personal data as soon as practicable and send the corrected data to other organisations to which the personal data was disclosed within a year before the correction is made (or, with the individual’s consent, only to selected organisations).

5. Accuracy Obligation

Make reasonable effort to ensure that personal data collected are accurate and complete, if it is likely to be used to make a decision that affects the individual, or if it is likely to be disclosed to another organisation.

6. Protection Obligation

Make reasonable security arrangements to protect the personal data to prevent unauthorised access, collection, use, disclosure or similar risks.

7. Retention Limitation Obligation

Cease retention of personal data or remove the means by which the personal data can be associated with particular individuals when it is no longer necessary for any business or legal purpose.

8. Transfer Limitation Obligation

Transfer personal data to another country only according to the requirements prescribed under the regulations, to ensure that the standard of protection provided to the personal data so transferred will be comparable to the protection under the PDPA, unless exempted by the PDPC.

9. Openness Obligation

Make information about our data protection policies, practices and complaints process available on request.

We do not carry out B2C marketing via Singapore telephone numbers. Nevertheless, we must be aware that the Do Not Call Provisions are in effect. All marketing messages to consumers if any must check against the DNC registry.