ONESTOP SECURITY PLATFORM

DATA PROTECTION POLICY FOR JOB SEEKER
DATA PROTECTION POLICY FOR EMPLOYER
DATA PROTECTION NOTICE FOR GENERAL PUBLIC

DATA PROTECTION POLICY FOR JOB SEEKERUpdated on 18/08/2021

This Data Protection Policy ("Policy") sets out the basis upon which Onestop Security Platform Pte Ltd  ("we", "us" or "our") may collect, use, disclose or otherwise process personal data of Job Seeker in accordance with the Personal Data Protection Act ("PDPA"). This Policy applies to personal data in our possession or under our control, including personal data in the possession of organisations which we have engaged to collect, use, disclose or process personal data for our purposes.

This Policy is an appendix of our membership application for our online application platform, and should be retained as part of the whole document for the job seeking process.

APPLICATION OF THIS POLICY

1.	This Policy applies to all persons who have applied for any job position with us or provide any information in relation to job application. 

PERSONAL DATA

2.	As used in this Policy, "personal data" means data, whether true or not, about a Job Seeker who can be identified: (a) from that data; or (b) from that data and other information to which we have or are likely to have access.
3.	As a Job Seeker, personal data which we may collect in the context of your employment with us If you are a Job Seeker, personal data which we may collect includes, without limitation, your:
(a)	full name or alias date of birth, nationality;
(b)	mailing address, mobile numbers and other contact details;
(c)	resume, educational qualifications, security officer license number and certifications;
(d)	training history;
(e)	work-related health issues and disabilities;
(f)	photographs; 
(g)	participation in Gift & Take event; and
(h)	any additional information provided to us by you 


COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

4.	We generally collect personal data that (a) you knowingly and voluntarily provide in the course of or in connection with your employment with us, or via a third party who has been duly authorised by you to disclose your personal data to us after (i) you have been notified of the purposes for which the data is collected, and (ii) you have provided consent to the collection and usage of your personal data for those purposes, or (b) collection and use of personal data without consent is permitted or required by the PDPA or other laws. We shall seek your consent before collecting or disclosing any additional personal data and before using your personal data for a purpose which has not been notified to you (except where permitted or authorised by law).
5.	As a Job Seeker, your personal data will be collected, used and may disclosed by us for the following purposes:
(a)	Assessing, evaluating and matching your suitability for employment in any current or prospective position in our client network; 
(b)	performing obligations under or in connection with the provision of our goods or services to our clients (e.g. providing access to their prospective employers on their online application profile for evaluation of your suitability to prospective security positions via OSP online platform application, etc.);
(c)	requesting feedback or participation in surveys, as well as conducting market research and/or analysis for statistical, profiling or other purposes for us to review, develop and improve the quality of our products and services; 
(d)	transmitting to any unaffiliated third parties including our third party service providers and agents, and relevant governmental and/or regulatory authorities, whether in Singapore or abroad, for the aforementioned purposes; 
(e)	ensuring security and safety (e.g. review of CCTV footage, etc.); 
(f)	verifying your identity and the accuracy of your personal details and other information provided; and
(g)	facilitating our compliance with any laws, customs and regulations which may be applicable to us (for example, use for any investigation or proceedings).
6.	The purposes listed in the above clauses may continue to apply even in situations where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under any contract with you).
7.	You have choices regarding our collection, use or disclosure or your personal data. If you choose not to provide us with the personal data described in the notices, we may not be able to perform our obligations with you or facilitate the purposes listed in Clause 5. You have the right to object to the processing of your personal data and withdraw your consent in the manner described under the header "Withdrawing Consent". We may collect, disclose or use your personal data pursuant to an exception under the Personal Data Protection Act or other written law such as during the following situations; (a) to respond to an emergency that threatens your life, health and safety or of another individual and (b) necessary in the national interest for any investigation or proceedings.

WITHDRAWING CONSENT 

8.	The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time it is being withdrawn by you in our OSP online application platform or in writing via email. You may withdraw consent and request us to stop collecting and/or using and/or disclosing your personal data for any or all of the purposes listed above by submitting your request in writing via email to our Data Protection Officer at the contact details provided below or terminating your membership via our OSP online application platform.
9.	Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. In general, we shall seek to process and effect your request within 10 working days after receiving the request.
10.	Whilst we respect your decision to withdraw your consent, please note that depending on the nature and extent of your request, we may not be in a position to process your request. We shall, in such circumstances, notify you before completing the processing of your request. Should you decide to cancel your withdrawal of consent, please inform us in writing via email.
11.	Please note that withdrawing consent does not affect our right to continue to collect, use and disclose personal data where such collection, use and disclose without consent is permitted or required under applicable laws.

ACCESS TO AND CORRECTION OF PERSONAL DATA

12.	If you wish to make:
(a)	an access request for access to a copy of the personal data which we hold about you through our online application platform, you access your own information through OSP’s online application platform using your own login details provided to you during the registration process for OSP’s online application platform.
(b)	information about the ways in which we use or disclose your personal data by submitting your request in writing via email to our Data Protection Officer at the contact details provided below; or
(c)	a correction request to correct or update any of your personal data which we hold through our online application platform using your own login details. The correction request records are captured in the OSP online application platform. Job Seeker will only be allowed to proceed with their correction request only if they agree to the terms and conditions specified in OSP online application platform.


PROTECTION OF PERSONAL DATA

13.	To safeguard your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, we have introduced appropriate administrative, physical and technical measures such as up-to-date antivirus and firewall protection, encryption and the use of privacy filters to secure all storage and transmission of personal data by us, and disclosing personal data both internally and to our authorised third party service providers and agents only on a need-to-know basis.
14.	You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While security cannot be guaranteed, we strive to protect the security of your information and are constantly reviewing and enhancing our information security measures.

ACCURACY OF PERSONAL DATA

15.	We generally rely on personal data provided by you (or your authorised representative). In order to ensure that your personal data is current, complete and accurate, please update us if there are changes to your personal data by informing our Data Protection Officer in writing via email at the contact details provided below.

RETENTION OF PERSONAL DATA

16.	We may retain your personal data for until you request that your data to be removed to fulfil the purposes for which they were collected, or as required or permitted by applicable laws.
17.	We will cease to retain your personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purposes for which the personal data were collected, and are no longer necessary for legal or business purposes.

TRANSFERS OF PERSONAL DATA OUTSIDE OF SINGAPORE

18.	We generally do not transfer your personal data to countries outside of Singapore. However, if we do so, we will obtain your consent for the transfer to be made and will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPA.

DATA PROTECTION OFFICER

19.	You may contact our Data Protection Officer if you have any enquiries or feedback on our personal data protection policies and procedures; or if you wish to make any request, in the following manner:
        Contact Person:  Data Protection Officer
        Email: bruno.ang@osp.sg

EFFECT OF POLICY AND CHANGES TO POLICY

20.	This Policy applies in conjunction with any other policies, notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of your personal data by us.
21.	We may revise this Policy from time to time without any prior notice. You may determine if any such revision has taken place by referring to the date on which this Notice was last updated. Your continued employment and participation in our recruitment process constitute your acknowledgement and acceptance of such changes.

DATA PROTECTION POLICY FOR EMPLOYERUpdated on 22/12/2020

Any person or entity that is accessing OSP platform to post a job or utilizing the Services for any reason related to the purpose of seeking candidates for employment is known as "Employer". 

Onestop Security Platform Pte Ltd ("we", "us", or "our") imposes this Data Protection Notice ("Notice") with obligations on the Employers so as to ensure the Onestop Security Platform Pte Ltd‘s own compliance with the Singapore Personal Data Protection Act ("PDPA"). 

1.	DEFINITIONS

1.1	In this Agreement, unless the context otherwise requires, the following terms shall have the meanings assigned to them below:

1.1.1	"Employer" means a person or entity that is accessing a Site to post a job or utilizing the Services for any reason related to the purpose of seeking candidates for employment. 

1.1.2	"OSP" means Onestop Security Platform Pte Ltd;

1.1.3	"OSP Personal Data" means Personal Data of Job Seekers which OSP discloses to the Employer including data of OSP's Job Seekers such as Name, Medical Data, Security Officer License Number and Contact Details;

1.1.4	"PDPA" means the Personal Data Protection Act 2012; 

1.1.5	"Job Seeker" means the Security Officer who is a member of OSP's application platform; and

1.1.6	"Personal Data" means data, whether true or not, about an individual who can be identified:
(a)	from that data alone; or
(b)	from that data and other information which the Employer has or is likely to have access.

2.	HANDLING AND PROTECTION OF PERSONAL DATA

2.1	Compliance with PDPA. The Employer shall comply with all its obligations under the PDPA at its own cost. 

2.2	The Employer shall not disclose or copy OSP's Personal Data unless with permission form OSP or until the Job Seeker has been employed by the Employer.

2.3	The Employer shall only use OSP Personal Data, until the Job Seeker has been employed by the Employer, for the following :
(a)	strictly for the purposes of fulfilling its obligations and for Job Seeker  search required under this Agreement;
(b)	with the OSP's consent; or
(c)	when required by law or an order of court, but shall notify the OSP as soon as practicable before complying with such law or order of court at its own costs.

2.4	Transfer of personal data outside Singapore.
The Employer shall not transfer OSP Personal Data to a place outside Singapore without the OSP's prior written consent, until the Job Seeker has been employed by the Employer. However, if the OSP provides consent, the Employer shall provide a written undertaking to the OSP that the OSP Personal Data transferred outside Singapore will be protected at a standard that is comparable to that under the PDPA. If the Employer transfers OSP Personal Data to any third party overseas, the Employer shall procure the same written undertaking from such third party.

2.5	Security Measures.

2.5.1	The Employer shall protect OSP Personal Data in the Employer's control or possession by making reasonable security arrangements (including, where appropriate, physical, administrative, procedural and information & communications technology measures) to prevent unauthorised or accidental access, collection, use, disclosure, copying, modification, disposal or destruction of OSP Personal Data, or other similar risks. 

2.6	Accuracy and Correction of Personal Data.
OSP provides Personal Data of Job Seekers to the Employer through OSP's online application platform, the OSP shall make reasonable effort to ensure that the Personal Data is accurate and complete before providing the same to the Employer. The Employer shall put in place adequate measures to ensure that the Personal Data in its possession or control remain or is otherwise accurate and complete. 

2.7	Retention of Personal Data.

2.7.1	The Employer shall not retain OSP's Personal Data (physical or electronic form) for any period of time longer than is necessary to serve the purposes of this Agreement unless the Job Seeker has already been employed by the Employer.

2.7.2	The Employer shall not retain OSP's Personal Data (physical or electronic form) once the employer have end the relationship or contract agreement with OSP unless the Job Seeker has already been employed by the Employer at the time of which the relationship has ended.

2.7.3	The Employer shall, upon the request of the OSP:
a)	return to the physical copy of OSP's Personal Data; and/or
b)	delete the electronic copy of OSP's Personal Data in its possession,
and, after returning or deleting all OSP Personal Data, provide the OSP with written confirmation that it no longer possesses any OSP Personal Data. Where applicable, the Employer shall also instruct all third parties to whom it has disclosed OSP Personal Data for the purposes of this Agreement to return to the Employer or delete, such OSP Personal Data.

2.8	Notification of Breach. 

2.8.1	The Employer shall immediately, within 1 hour, notify the OSP when the Employer becomes aware of a breach of any of its obligations in Clauses [2.2 to 2.7].

2.8.2	The Employer report to OSP's Data Protection Officer by the below channel:
		Contact Person:  Data Protection Officer
		Contact Number: +65 6747 6186
		Email: bruno.ang@osp.sg

2.9	Indemnity
The Employer shall indemnify the OSP and its officers, employees and agents, against all actions, claims, demands, losses, damages, statutory penalties, expenses and cost (including legal costs on an indemnity basis), in respect of:
(a)	the Employer's breach of Clauses [2 to 3]; or
(b)	any act, omission or negligence of the Employer or its subcontractor that causes or results in the OSP being in breach of the Singapore Personal Data Protection Act.

DATA PROTECTION POLICY FOR GENERAL PUBLICUpdated on 18/08/2021

DATA PROTECTION NOTICE
The privacy of your Personal Data is important to us and we are committed to accord the information the due level of care in compliance with the Personal Data Protection Act of Singapore (the "Act"). 

PERSONAL DATA
Personal Data refers to the personal data, as defined under the Act, obtained by us in the course of and as a result of the provision of any products and services by us to you. Such Personal Data collected, used and disclosed to us may include, but not limited to, your name, mailing address, telephone number(s), personal email address, your images taken by us and any other information which you may have provided in any form to us.

COLLECTION OF PERSONAL DATA
We generally collect personal data that you knowingly and voluntarily provide (unless otherwise stated) in the course of or in connection with your relationship with us after (i) you have been notified of the purposes for which the data is collected, and (ii) you have provided consent to the collection and usage of your personal data for those purposes.
We shall seek your consent before collecting any additional personal data and before using or disclosing your personal data for a purpose which has not been notified to you (except where permitted or authorised by law)".
Personal Data may be collected from you in a number of ways, such as, but not limited to:
        when you visit us in any of our premises or events hosted by us; or
        when you ask us to provide a product or service over the telephone, social media, official webpage or internet.
Where you have given your Personal Data through the aforementioned mediums or any other mode, you agree to be bound by this Data Protection Notice.
Our websites may also offer interactive facilities where personal data may also be collected, such as:
        customer enquiry;
        feedback forms;
        Our Online Application Platform;
        Events (Gift & Take); or
        job application enquiry. 
Where you have accessed and used our websites and any services we offer via the websites, you agree to be bound by this Data Protection Notice in respect of the Personal Data collected about you via our websites.
We assure you that regardless of the medium you provide your Personal Data to us, it will be handled by us with care and diligence not only in accordance with this Data Protection Notice, in compliance with the PDPA, but also in line with our commitment to you as our customers and/or service users.

You have choices regarding our collection, use or disclosure or your personal data. If you choose not to provide us with the personal data described in the notices, we may not be able to perform our obligations with you or facilitate the purposes listed in Purpose for Collection. You have the right to object to the processing of your personal data and withdraw your consent in the manner described under the header "Withdrawing Consent". We may collect, disclose or use your personal data pursuant to an exception under the Personal Data Protection Act or other written law such as during the following situations; (a) to respond to an emergency that threatens your life, health and safety or of another individual and (b) necessary in the national interest for any investigation or proceedings.

PURPOSE FOR COLLECTION
Generally, we collect Personal Data for our customers, prospective customers, suppliers etc. for purposes relating to the products and services we offer or require. These purposes include, but are not limited to:
        responding to your request or enquiries regarding to an issue or question, and any other services we offer;
        receiving feedback and dealing with complaints;
        communicating with you in relation to products and services we provide which are relevant to your existing relationship with us;
        offering you updated marketing and promotional packages you can benefit from, including products and services offered by our selected partners;
        product updates and upgrades;
        meeting regulatory and legal obligations;
We may for these purposes, contact you via mail (including electronic mail), telephone, SMS or other communication (text or image) applications for mobile devices, and facsimile.
You may exercise choice in the collection, use or disclosure of your personal data. However, if your choice should affect the purpose for which your personal data was collected for, you will be made known of the consequences e.g. terminating the our existing customer relationship, limited functions to use on our online application, etc. 

 
DISCLOSURE
In providing you with a product or service, we may sometimes need to disclose your Personal Data to others. It is generally not our policy to disclose your Personal Data to external organisations unless we have your consent and/or are required to disclose your Personal Data as required in the normal course and scope of our business in the provision of our services to you, and/or for contractual, legal and regulatory requirements. Some examples of the types of external organisations we may need to disclose information to in the course of providing a product or service are:
        appointed third party service partners;
        other companies or individuals, including legal counsel and information technology service providers, who assist us in providing services or who perform functions on our behalf (e.g., mailing houses of letters or printers for our marketing materials) who are contract bound to comply with our Data Protection and Privacy Notice and that of the PDPA.
Those external organisations are not authorised by us to use your Personal Data for anything other than the purpose(s) for which we supplied that information to them. 
Unless otherwise required or permitted by law, we will only disclose your Personal Data with your consent (implied or expressed), and we will also take reasonable steps to ensure the external organisation to whom we have disclosed your information are also legally bound to protect the privacy of your Personal Data.

WITHDRAWAL OF CONSENT
Should you wish to withdraw your consent for us collect use, and disclose on:
        CCTV or Photo Footage taken in any of our premises or events hosted by us; 
        Sales and marketing information sent to you via a specific mode or all modes of communications (e.g., mail, email, telephone calls, SMS-Text);
        Provision of any products and services by us to you;
        Provision customer enquiry & feedbacks;
        Provision in our Online Application Platform;
        Participation our Events (Gift & Take); or
        Job application enquiry. 
Please notify us in writing to our Data Protection Officer ("DPO").  However, your withdrawal of consent could result in certain legal consequences arising from such withdrawal, including us being unable to provide the product and service provision requested by you on our website(s), website/online application(s) or events hosted by us. Do note that your withdrawal of consent will not affect our ability to collect, use or disclose your personal data for a specific purpose without your consent, if the PDPA or a provision in applicable law permits us to. We may require up to 10 days, upon receipt of your request.

ACCESS TO AND CORRECTION OF PERSONAL DATA
If you wish to make (a) an access request for access to a copy of the personal data which we hold about you or information about the ways in which we use or disclose your personal data, or (b) a correction request to correct or update any of your personal data which we hold about you, you may submit your request in writing or via email to our Data Protection Officer.
Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.
We will respond to your access request as soon as reasonably possible. Should we not be able to respond to your access request within 30 days after receiving your request, we will inform you in writing via email within 30 days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the PDPA).

We will respond to your correction request as soon as reasonably possible. Should we not be able to correct the correction request within 30 days after receiving your request, we will inform you in writing on the time by which we will be able to correct your correction request. If we are unable to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the PDPA).

We will not provide information under the access requirement for:- 
(a)	opinion data kept solely for an evaluative purpose; 
(b)	the personal data of the beneficiaries of a private trust kept solely for the purpose of administering the trust;
(c)	personal data kept by an arbitral institution or a mediation centre solely for the purposes of arbitration or mediation proceedings administered by the arbitral institution or mediation centre;
(d)	documents related to a prosecution if all proceedings related to the prosecution have not been completed; 
(e)	personal data subject to legal privilege; 
(f)	personal data which, if disclosed, would reveal confidential commercial information that could, in the opinion of a reasonable person, harm the competitive position of the organisation; 
(g)	personal data collected, used or disclosed without consent pursuant to the exemptions in the PDPA, for the purposes of an investigation if the investigation and associated proceedings and appeals have not been completed;
(h)	the personal data was collected or created by a mediator or arbitrator in the conduct of a mediation or arbitration for which he was appointed to act — 
        under a collective agreement under the Industrial Relations Act (Cap. 136) or by agreement between the parties to the mediation or arbitration; 
        under any written law; or 
        by a court, arbitral institution or mediation centre.
(i)	any request:- 
        That would unreasonably interfere with the operations of the organisation because of the repetitious or systematic nature of the requests;
        If the burden or expense of providing access would be unreasonable to the organisation or disproportionate to the individual’s interests; 
        For information that does not exist or cannot be found; 
        For information that is trivial; and 
        That is otherwise frivolous or vexatious. 
(j)	personal data or other information shall not be provided to an individual if the provision of that Personal Data or information could reasonably be expected to: 
        Threaten the safety or physical or mental health of an individual other than the individual who made the request; 
        Cause immediate or grave harm to the safety or to the physical or mental health of the individual who made the request; 
        Reveal Personal Data about another individual; 
        Reveal the identity of an individual who has provided Personal Data about another individual and the individual providing the Personal Data does not consent to the disclosure of his/her identity; or be contrary to national interest. 
(k)	If Personal Data has been disclosed to a prescribed law enforcement agency without the consent of the individual or pursuant to the exemptions in the PDPA, we shall not be required to inform the individual of such disclosure.

Correction request will not be approve in respect of:
(a)	opinion data kept solely for an evaluative purpose;
(b)	the personal data of the beneficiaries of a private trust kept solely for the purpose of administering the trust;
(c)	personal data kept by an arbitral institution or a mediation centre solely for the purposes of arbitration or mediation proceedings administered by the arbitral institution or mediation centre; or
(d)	a document related to a prosecution if all proceedings related to the prosecution have not been completed.

ENSURING PERSONAL DATA IS UP-TO-DATE
We rely on the Personal Data we hold in conducting our business. Therefore, it is very important that the Personal Data we hold is accurate, complete and up-to-date.
We will do our best to ensure that the Personal Data we hold is accurate, complete and up-to-date whenever we collect or use it. This means that from time to time, we may ask you to update us if there is any change to your Personal Data. If you find that the Personal Data we hold about you is incorrect, please contact us immediately in writing to our DPO and we will update it.

SECURITY OF PERSONAL DATA
Security of Personal Data is very important to us and we take all reasonable precautions and care to protect your Personal Data from misuse, loss, unauthorised access, modification or disclosure.
Some of the ways we protect Personal Data include:
        external and internal premises security;
        restricting access to Personal Data only to staff who need it to perform their day to day functions;
        maintaining technology products to prevent unauthorised computer access or damage to electronically stored information, such as requiring identifiers and passwords, firewalls and anti-virus software;
        conducting annual penetration test on our Online Application Platform; and
        maintaining physical security over paper records.

RETENTION
We will retain your Personal Data for a reasonable period for the purposes as cited herein or as required by law.

TRANSFERS OF PERSONAL DATA OUTSIDE OF SINGAPORE
We generally do not transfer your personal data to countries outside of Singapore. However, if we do so, we will obtain your consent for the transfer to be made and we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPA.

RESOLVING CONCERNS
If you believe that the privacy of your Personal Data has been compromised, please contact us immediately and we will take the relevant steps to address your concerns.

RIGHT TO AMEND OUR ONLINE DATA PROTECTION NOTICE
We reserve the right to amend this Data Protection Notice from time to time at our sole discretion. If we make any changes to this Data Protection Notice and the way in which we use your Personal Data, we will update these changes on our websites. 

CONTACTING OUR DATA PROTECTION OFFICER
For any questions relating to your Personal Data or about our Privacy Notice, you may contact our DPO, Mr Bruno Ang, at this email bruno.ang@osp.sg.