Personal Data Protection Policy

1. Introduction

This Personal Data Protection Policy provides information about how The Straits Times School Pocket Money Fund (“SPMF”) collects, uses and discloses personal data in accordance with the Personal Data Protection Act 2012 (the “PDPA”).

2. Personal Data

In this policy, “Personal Data” refers to any data, whether true or not, about an individual who can be identified (a) from that data; or (b) from that data and other information to which SPMF has or is likely to have access, including data in SPMF’s records as may be updated from time to time, including:

• Full name
• NRIC, FIN, or passport number
• Photograph or video image of an individual
• Mobile number
• Personal email address
• Thumbprint
• Residential address
• Residential phone number
• Nationality
• Residential housing type
• Income
• Date of birth

3. Collection of Personal Data

SPMF will only collect, use or disclose personal data if an individual gives, or is deemed to have given, consent under the PDPA, or if required or authorised under the PDPA or any other written law.

4. Use of Personal Data Collected

SPMF shall use and / or disclose Personal Data in accordance with and subject to the PDPA only in accordance with the purpose(s) that the individual had provided consent for, including the following:

• Providing our services
• Administrative purposes
• Addressing questions and feedback
• Regulatory filings
• Invitations for future events
• Due diligence (where applicable)
• Eligibility assessments and funding disbursements
• Confirming donor details
• Volunteer screening/database
• Tax deduction documentation
• Donor appreciation
• Annual report disclosures
• Media coverage

5. Disclosure of Personal Data

We may disclose your personal data in accordance with and subject to the PDPA, to third party service providers, agents, government agencies or other data intermediaries we have engaged in connection with any of the permitted purposes, where such disclosure is required for performing obligations in the course of or in connection with the permitted purposes.

6. Withdrawal of Consent

If you do not wish for us to use or disclose your personal data for any purpose, you may withdraw your consent at any time by contacting our Data Protection Officer (as set out in paragraph 12).

Upon withdrawal of your consent, SPMF will cease to collect, use or disclose your personal data unless such collection, use or disclosure without your consent is required or authorised under the PDPA or other written laws.

7. Access and Correction of Personal Data

You may request for information relating to your personal data in the possession or under the control of SPMF, and the ways in which such personal data may have been used or disclosed within a year before the date of the request by contacting our Data Protection Officer (as set out in paragraph 12).

You may also request for your personal data in the possession or under the control of SPMF to be updated or corrected in respect of any error or omission in the personal data by contacting our Data Protection Officer.

8. Protection of Personal Data

To safeguard your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, and to prevent the loss of any storage medium or device on which your personal data has been stored, we have introduced appropriate administrative, physical and technical measures on our devices such as antivirus protection and encryption.

However, even with the existing protection measures in place to protect your personal data, no method of transmission over the Internet or method of electronic storage is completely secure. While security cannot be guaranteed, we strive to protect the security of your information and are constantly reviewing and enhancing our information security measures.

9. Retention of Personal Data

We may retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws.

We will cease to retain your personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for legal or business purposes.

10. Transfer of Personal Data outside of Singapore

We generally do not transfer your personal data to a country or territory outside of Singapore. However, if we do so, we will obtain your consent for the transfer to be made and we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPA, including entering into an agreement with the receiving party to accord similar levels of data protection as those in Singapore.

11. Data Breach Notification

In the event of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, your personal data, we shall promptly assess the impact and if appropriate, report this breach within 3 calendar days to the Personal Data Protection Commission (“PDPC”). We will notify you when the data breach is likely to result in significant harm to you after our notification to the PDPC. We may also notify other relevant regulatory agencies, where required.

12. Data Protection Officer

Please direct any queries, feedback or complaints you have about the way in which we collect, use or disclose personal data to our Data Protection Officer as follows:

Last updated: 4 April 2025