Privacy Notice

In this Notice and under the Personal Data Protection Act 2012 (No. 26 of 2012) (“PDPA”), “Personal Data” refers to any data or information (whether true or not) about you from which you can be identified, either (i) from that data; or (ii) from that data and other information to which we have or are likely to have access. It includes information such as an individual’s name, identification number, address, mobile phone number, email addresses, photos and video images of a person.

2.1. Purposes for Personal Data collection, use and disclosure
NVPC may collect, use and/or disclose your Personal Data for the purposes listed below as well as for other purposes you specifically consent to:

a) Marketing and advocacy purposes, including but not limited to the following:

• To inform you about the products, services, events and activities of NVPC and its related organisations, as well as that of the non-profit organisations registered with giving.sg, or other information which may be of interest to you

b) Administration and servicing purposes, including but not limited to the following:

• To create, administer and update your user account;
• To verify your identity;
• To communicate with you, carry out your instructions or respond to your queries/comments;
• To administer your third-party interactions through NVPC (e.g. when you donate to or volunteer with non-profit organisations registered with giving.sg);
• To process and administer payments, billings, accounts, benefits/entitlements, credit and reference checks, debt-recovery matters;
• To perform internal operations necessary to provide our services, including troubleshooting software bugs and operational problems, conducting data analysis, testing and research, monitoring and analysing usage and activity trends;
• For compliance monitoring and audit reviews;
• To investigate allegations or suspicions of fraud, misconduct, any unlawful action or omission;
• To archive, back-up or destroy Personal Data;
• To inform you of changes and updates to our services, products, policies, terms and conditions and other administrative information.

c) Analytics, research, business development and improvement purposes, including but not limited to the following:

• To understand and improve your user experience with our services, websites and mobile applications;
• To derive further attributes relating to you based on your Personal Data, in order to provide you with more targeted and/or relevant information;
• To improve the layout or content of the pages of our websites/mobile applications, and customise them for existing and prospective users;
• To conduct surveys, data analysis of usage and activity trends, testing and monitoring and other research e.g. research on demographics and behaviour;
• To improve, enhance and develop our current technology, operations, products and services;
• To improve, enhance or develop new services, websites or mobile applications and new methods or processes for business operations;
• To learn or understand behaviour and preferences of existing or prospective users and identify goods or services that may be suitable for them.

d) To comply with applicable rules, laws and regulations as well as the legal process or legal requirements of any government agency.

e) We may collect, use and disclose Personal Data on behalf of government agencies, in which case we shall do so in accordance with the government’s prevailing data management policies.

2.2. How we collect your Personal Data
NVPC may collect your Personal Data in various ways, including without limitation, when you:

a) visit our premises, which are monitored by CCTV surveillance;
b) visit our websites or use our mobile applications;
c) donate to NVPC or through our websites or mobile applications;
d) volunteer your time with NVPC or through our websites or mobile applications;
e) attend/participate in our events, as photos and/or video recordings may be taken;
f) register with us for our services or events/activities;
g) interact with any of our employees, interns, volunteers, board and committee members e.g. via meetings (physical and online), emails or telephone calls;
h) respond to our request for additional Personal Data;
i) request that we contact you, e.g. to be included in a mailing list;
j) respond to our initiatives or programmes;
k) participate in any research and/or survey conducted by us or our partners/vendors.

Your Personal Data may also be disclosed to NVPC by third parties with your consent, or where otherwise permitted by law.

We may also collect Personal Data where required or permitted by laws or regulations binding on NVPC for any purpose.

2.3. Who we may disclose your Personal Data to
We may provide your Personal Data to various third parties for the purposes mentioned above. Such third parties include without limitation:

• financial institutions, payment processors and facilitators;
• debt collectors;
• credit bureaus and other credit reporting agencies;
• background check and anti-money laundering service providers;
• cloud-based service providers;
• marketing partners and marketing platform providers;
• data analytics providers;
• research partners, including those performing surveys or research projects in partnership with NVPC or on NVPC’s behalf;
• Giving.sg API developers;
• NVPC volunteers and interns;
• NVPC-related organisations;
• Professional advisors such as lawyers and auditors;
• Any liquidator, receiver, official assignee/trustee, judicial manager or any other person appointed under or pursuant to any applicable law or court order in connection with the bankruptcy, liquidation, winding up, judicial management or any other analogous process in respect of any individual, company or business;
• Law enforcement officials;
• Government agencies and regulatory bodies;
• Other third-party service providers including those engaged by non-profit organisations registered with giving.sg;
• Any other party to whom you authorise us to disclose your Personal Data.

2.4. Consent
NVPC shall always seek your consent to collect, use or disclose your Personal Data, except in specific circumstances where collection, use or disclosure without consent is authorized or required by law.

NVPC may not be able to fulfill certain services if you are unwilling to provide consent to the collection, use or disclosure of certain Personal Data.

NVPC may assume that you have consented to the collection, use and disclosure of your Personal Data in situations where you provided Personal Data for obvious purposes.

2.5. Notification Obligation
Either before or when we collect your Personal Data, NVPC shall inform you of the purpose for which the Personal Data is collected, except when such Personal Data is provided by you for an obvious purpose (E.g. when you provide Personal Data to register for an event, as such the purpose is for that event participation).

2.6. Accuracy Obligation
NVPC generally relies on the Personal Data provided by you (or your authorised representative). To ensure that your Personal Data is current, complete and accurate, please update us if there are changes to your Personal Data by informing our Data Protection Officer at the contact details provided below (refer to Section 9 (Contacting Us)).
NVPC will not be responsible for relying on inaccurate or incomplete Personal Data provided to us. Failure to provide complete and accurate information may result in our inability to provide you with services you have requested and/or other administrative delays.

2.7. Transfer and Disclosure of Personal Data in and outside Singapore
NVPC may disclose Personal Data to internal/external parties located overseas for necessary and appropriate purposes. Such transfer shall be done in a manner that is secure and in accordance with PDPA requirements.

3.1. Protection and Storage of your Personal Data
We will endeavour to protect your Personal Data in our possession and will guard against risks of unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction, through reasonable and appropriate security measures.

We strive to ensure that our systems are secure and that they meet the industry standards and have put in place appropriate physical, electronic and managerial procedures to safeguard and secure the Personal Data in our possession.

3.2. Retention of your Personal Data and Requests to Delete your Personal Data
We will only retain your Personal Data for as long as it is necessary for our business or legal purposes.

You may request that your Personal Data be deleted by contacting our Data Protection Officer (DPO) (refer to Section 9 (Contacting Us)). Do note that we will not be able to delete your Personal Data if we require it for business or legal purposes. In such circumstances, you may nevertheless withdraw your consent to the further use or disclosure of your Personal Data (refer to Section 4 (Withdrawal of Consent)).

4.1. If you wish to withdraw your consent to any collection, use or disclosure of your Personal Data as set out in this Notice, you may contact the DPO (refer to Section 9 (Contacting Us)).

4.2. Please note that if you withdraw your consent to the collection, use, and/or disclosure of your Personal Data, depending on the nature of your request, we may not be able to continue providing our services or perform our contractual obligations to you. Such withdrawal may also result in the termination of any agreements or arrangements you have with us. NVPC’s legal rights and remedies are expressly reserved under such circumstances.

4.3. NVPC will strive to effect your withdrawal of consent within 10 working days of your withdrawal and will notify you if more time is required. Please note that withdrawing consent does not affect our right to continue to collect, use and disclose personal data where such collection, use and disclose without consent is permitted or required under applicable laws.

5.1. If you wish to make (a) an access request for access to a copy of the Personal Data which we hold about you or information about the ways in which we use or disclose your Personal Data, or (b) a correction request to correct or update any of your Personal Data which we hold about you, please submit your request to NVPC’s DPO (refer to Section 9 (Contacting Us) identifying yourself and indicating the Personal Data that the request concerns.

5.2. NVPC will respond to your request as soon as reasonably possible. However, please note that we may refuse your request under certain circumstances as laid out under the PDPA. Please note that a reasonable fee may be charged for an access request. If so, NVPC will inform you of the fee before processing your request.

5.3. If we are unable to respond to your access or correction request within 30 days after receiving your request, we will inform you in writing within 30 days of the time by which we would be able to respond to your request.

6.1. We may collect or analyse anonymised information from which individuals cannot be identified (“Aggregate Information”), such as number of users and their frequency of use, the number of page views (or page impressions) that occur on our websites/applications and common entry and exit points into our websites/applications.

6.2. We use “cookies” where a small data file is sent to your browser to store and track Aggregate Information about you when you enter our website or use our mobile applications. The cookie is used to track information such as the number of users, their frequency of use, profiles of users, and their preferred sites.

6.3. The Aggregate Information collected is used to assist us in analysing the usage of our websites/applications and improving our websites, mobile applications and services.

6.4. Should you wish to disable the cookies associated with these technologies, you may do so by changing the setting on your browser. However, you may not be able to enter certain part(s) of our websites, mobile applications or services.

7.1. Our websites and mobile applications may contain links to other websites and applications operated by third parties for your convenience and information. You access these websites and applications at your own risk. To the fullest extent permitted under the law, we cannot be responsible for a third-party’s acts, omissions, data policies or their use of cookies nor the content or security of any third-party websites and applications, even if linked to our websites and applications. We recommend that you check the applicable data protection policy of the third party to determine how they will handle any information they collect from you. Any such liability is expressly disclaimed and excluded.

8.1. Even with reasonable protection measures in place, there may be a possibility of a data breach. In the event the data breach is assessed to be notifiable, NVPC will notify the affected individuals as soon as practicable, at the same time or after notifying the Personal Data Protection Commission. If the breach warrants notification to the Commission, NVPC will make notification as soon as practicable but no later than three (3) calendar days upon our assessment.

9.1. Should you have any questions or feedback relating to the collection, use or disclosure of your Personal Data, or if you wish to know more about our data protection policies and practices, please contact our DPO at [email protected].