1. Introduction
CaringSG Limited (“CaringSG”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data in accordance with Singapore’s Personal Data Protection Act 2012 (“PDPA”).
This Privacy and Personal Data Protection Policy explains how CaringSG may collect, use, disclose, store, protect and otherwise process personal data in our possession or under our control.
This Policy applies to individuals who interact with CaringSG, including:
prospective and existing service users;
caregivers, family members and dependants;
authorised representatives;
members;
programme, training and event participants;
volunteers;
donors and supporters;
partners and service providers;
job applicants and staff, where applicable; and
visitors to our websites, digital platforms and premises.
It also applies to personal data processed on CaringSG’s behalf by authorised service providers and data intermediaries.
Where CaringSG processes personal data on behalf of a public agency, the processing may also be governed by applicable public-sector requirements, contractual obligations and other relevant laws.
2. What is personal data?
“Personal data” refers to data, whether true or not, about an individual who can be identified:
from that data alone; or
from that data together with other information to which CaringSG has or is likely to have access.
Depending on your interaction with CaringSG, the personal data we collect may include:
Identity and contact information
name;
residential or mailing address;
telephone number;
email address;
date of birth;
nationality;
gender;
photograph;
NRIC, FIN, passport or other identification details, where necessary; and
emergency contact information.
Caregiver, family and service information
caregiver and family circumstances;
information about dependants and family members;
disability, medical, health and support-related information;
service needs and preferences;
assessment, intake, referral and case-management information;
case notes and service outcomes; and
information relating to financial assistance, subsidies or eligibility.
Programme and membership information
membership details;
programme and event registrations;
attendance records;
training records;
feedback, surveys and evaluation responses; and
communications with CaringSG.
Volunteer, employment and partner information
qualifications, experience and skills;
volunteer availability and deployment information;
employment and recruitment information;
background screening information, where required; and
business and partner contact details.
Financial and transaction information
payment and donation information;
billing and receipt records;
donation and tax-deduction details; and
other transaction records.
CaringSG will only collect identification numbers and other sensitive information where there is a clear and reasonable need to do so.
3. How we collect personal data
CaringSG may collect personal data:
directly from you through forms, interviews, consultations, registrations, applications, surveys or correspondence;
from your parent, guardian, caregiver, authorised representative or family member;
from referral partners, healthcare providers, social service agencies, schools, government agencies or other organisations;
through your participation in programmes, services, training or events;
through photographs, video recordings, audio recordings or CCTV, where applicable;
through our websites, email systems, telephone services and digital platforms;
from publicly available sources; or
where collection without consent is permitted or required by law.
Where you provide personal data about another person, you confirm that:
you are authorised to provide the information;
the information is accurate to the best of your knowledge; and
you have informed the person of the purposes for which the information may be collected, used or disclosed.
CaringSG may contact the individual directly to verify the information or obtain consent where appropriate.
Where consent is required for a minor or an individual who may not be able to provide valid consent independently, CaringSG may seek consent from a parent, guardian or legally authorised representative, as appropriate.
4. Purposes for collecting, using and disclosing personal data
CaringSG may collect, use and disclose personal data for purposes including:
Service and programme administration
assessing applications and determining eligibility;
registering individuals for programmes, services, training and events;
providing caregiver support, social work assistance, peer support, keyworker services, training and other services;
maintaining attendance, service and case records;
coordinating appointments, activities and follow-up;
communicating operational information and service updates;
providing emergency assistance and protecting participant safety; and
managing complimentary or paid membership arrangements.
Referrals and coordinated support
facilitating referrals requested or authorised by individuals;
coordinating support with relevant healthcare, social service, education or community partners;
sharing relevant information with professionals or organisations involved in delivering support; and
assessing and responding to service needs.
Only information reasonably required for the referral or support arrangement will be disclosed.
Volunteer and workforce administration
assessing volunteer or job applications;
matching volunteers to suitable roles;
managing deployment, supervision and training;
maintaining volunteer and employment records; and
ensuring the safety and suitability of staff and volunteers.
Events, training and engagement
organising programmes, events and activities;
managing venues, attendance and logistics;
issuing certificates or confirmations;
collecting feedback and evaluating effectiveness; and
communicating with participants.
Donations, payments and financial administration
processing donations, payments, refunds and subsidies;
issuing receipts and tax-deduction documentation;
managing financial assistance;
maintaining financial and audit records; and
fulfilling funder, charity governance and regulatory requirements.
Quality assurance, evaluation and reporting
monitoring and improving programmes and services;
evaluating outcomes and service effectiveness;
conducting audits and quality reviews;
preparing reports for management, the Board, funders or regulatory bodies; and
conducting statistical analysis.
CaringSG will use anonymised or aggregated information where reasonably possible.
Communications and enquiries
responding to questions, feedback, complaints and requests;
verifying identity;
maintaining records of correspondence; and
communicating information requested by you.
Governance, security and legal requirements
preventing and investigating fraud, misuse and security incidents;
maintaining the security of CaringSG’s systems and premises;
complying with applicable laws, regulations and codes of practice;
responding to lawful requests from public agencies or enforcement authorities;
establishing, exercising or defending legal rights; and
meeting audit, insurance, governance and risk-management requirements.
Research
CaringSG may invite individuals to participate in research relating to caregivers, social services or our programmes.
Where required, CaringSG will provide information about the specific research project and obtain separate consent before using identifiable personal data for that research, unless collection, use or disclosure without consent is permitted by law.
5. Consent
CaringSG will notify individuals of the relevant purposes and obtain consent where required before collecting, using or disclosing personal data.
Consent may be provided:
in writing;
electronically;
verbally, where properly recorded;
through an authorised representative;
through deemed consent where the requirements under the PDPA are satisfied; or
through another valid method.
CaringSG may also collect, use or disclose personal data without consent where permitted or required under the PDPA or another applicable law.
Consent for optional purposes, such as promotional communications, identifiable publicity photographs or testimonials, will generally be handled separately from consent required to administer a programme or service.
Declining an optional use will not ordinarily affect access to the underlying programme or service.
6. Withdrawal of consent
You may withdraw consent for CaringSG’s continued collection, use or disclosure of personal data by contacting our Data Protection Officer.
After receiving your request, CaringSG will:
verify your identity and authority, where necessary;
explain the likely consequences of the withdrawal;
process the request within a reasonable period; and
cease the relevant collection, use or disclosure unless continued processing is permitted or required by law.
Withdrawal of consent may affect CaringSG’s ability to continue providing a programme or service where the relevant personal data is necessary to deliver it.
Withdrawal does not affect personal data that CaringSG is required or permitted to retain or process for legal, regulatory, audit, safeguarding or other legitimate purposes.
Withdrawal also does not affect processing that occurred before the withdrawal took effect.
7. Photographs, videos, testimonials and personal stories
CaringSG may take photographs, video recordings or audio recordings during programmes, training and events for:
programme documentation;
internal records;
reporting to funders or stakeholders;
organisational communications; and
publicity and promotional purposes.
Where general event photography is taking place, CaringSG may provide notice through registration materials, event briefings or signs at the venue.
General photographs may include participants in group or background settings. Individuals who do not wish to be photographed or recorded should inform CaringSG staff at registration or during the event. CaringSG will take reasonable steps to accommodate the request.
CaringSG will seek separate consent where appropriate before using:
identifiable close-up photographs;
interviews;
testimonials;
case studies;
personal caregiver stories; or
information revealing sensitive personal or family circumstances
for external publicity or promotional purposes.
Where consent is provided by a parent, guardian or representative, the person must be authorised to provide that consent.
Individuals may withdraw consent for future publicity use. CaringSG will stop future use where reasonably practicable, although it may not always be possible to recall materials that have already been printed, distributed or lawfully published.
PDPC guidance recognises different consent considerations for general event photography and identifiable publicity content, particularly in a social-service setting.
8. Membership
Where registration for a programme or service includes complimentary CaringSG membership, this will be clearly stated during registration.
Membership information may be used to:
administer membership;
provide access to member services and benefits;
maintain membership records;
communicate membership-related information; and
understand member needs and participation.
Membership does not automatically mean that an individual has consented to receive promotional calls, SMSes or emails. Consent for promotional communications will be managed separately where required.
Where membership is optional, individuals will be given a separate choice to join.
9. Operational and promotional communications
CaringSG may send operational communications relating to:
registrations;
appointments;
programmes or services;
event reminders;
schedule changes;
membership administration;
safety information; and
requests initiated by the individual.
Operational communications are necessary to administer the relevant programme, service or relationship.
CaringSG may also send news, fundraising appeals, programme announcements or promotional information through email, SMS, telephone or other communication channels where:
the individual has provided valid consent;
the message is otherwise permitted by law; or
the applicable Do Not Call requirements have been satisfied.
CaringSG will not treat silence or failure to opt out as clear consent where affirmative consent is required.
Individuals may unsubscribe or withdraw marketing consent at any time by:
using the unsubscribe facility in an email;
replying through the method stated in the message; or
contacting CaringSG’s Data Protection Officer.
CaringSG will process marketing withdrawal requests within the applicable timeframe.
10. Disclosure of personal data
CaringSG may disclose relevant personal data to authorised parties including:
CaringSG staff and authorised volunteers;
affiliated programmes and authorised service teams;
healthcare, education, social service and community partners;
referral partners and professionals involved in providing support;
government ministries, statutory boards and public agencies;
funders, auditors and governance bodies;
insurers, legal advisers and professional consultants;
venue operators and event providers;
payment, donation and financial-service providers;
technology, cloud-hosting, communications and data-management providers;
mailing, printing and logistics providers; and
law-enforcement or regulatory authorities where required.
CaringSG will disclose only the personal data reasonably necessary for the relevant purpose.
Where service providers process personal data on CaringSG’s behalf, CaringSG will take reasonable steps to ensure that appropriate confidentiality, security, breach-reporting, retention and deletion requirements are in place.
11. Website, forms and digital platforms
When you use CaringSG’s website, online forms or digital platforms, CaringSG may collect information such as:
IP address;
browser and device information;
pages visited;
date and time of access;
form submissions;
referral source; and
website usage and interaction information.
Our website may use cookies and similar technologies to:
enable essential website functions;
remember settings;
maintain security;
understand website usage; and
improve user experience.
You may control or disable cookies through your browser settings. Disabling certain cookies may affect some website functions.
CaringSG may use external platforms to provide forms, payments, donations, membership access, video conferencing or other online services. These providers may process personal data according to their own privacy policies and their contractual arrangements with CaringSG.
Our website may contain links to external websites. CaringSG is not responsible for the privacy practices or content of external websites that are not operated by us.
12. Accuracy of personal data
CaringSG will make reasonable efforts to ensure that personal data collected by or on behalf of CaringSG is accurate and complete where it is likely to be:
used to make a decision affecting the individual; or
disclosed to another organisation.
We generally rely on individuals and their authorised representatives to provide accurate and updated information.
Please inform CaringSG as soon as reasonably possible if your information changes or if you believe that information held by CaringSG is inaccurate or incomplete.
13. Protection of personal data
CaringSG uses reasonable administrative, physical and technical measures to protect personal data against unauthorised:
access;
collection;
use;
disclosure;
copying;
modification;
loss;
disposal; or
similar risks.
Measures may include:
access controls based on job responsibilities;
multifactor authentication;
password and account-management requirements;
device and endpoint protection;
encryption where appropriate;
secure cloud and data-management services;
system updates and security monitoring;
staff and volunteer training;
confidentiality requirements;
secure physical storage;
backup and recovery arrangements; and
secure disposal of records.
Access to personal data is restricted to individuals who reasonably require it for their work or authorised duties.
Although CaringSG takes reasonable precautions, no electronic transmission or storage method can be guaranteed to be completely secure.
If you believe personal data has been lost, misused or disclosed to an unauthorised person, please contact our Data Protection Officer promptly.
14. Retention of personal data
CaringSG retains personal data only for as long as reasonably required to:
fulfil the purpose for which it was collected;
continue providing services;
meet legal, regulatory, funding and contractual requirements;
maintain appropriate financial, audit and governance records;
protect the safety and interests of service users;
respond to complaints or disputes; or
establish, exercise or defend legal rights.
Retention periods may vary according to the nature and purpose of the information.
When personal data is no longer required for a legal or business purpose, CaringSG will take reasonable steps to:
securely delete or destroy it;
return it where appropriate; or
anonymise it so that it can no longer be associated with an identifiable individual.
15. Transfer of personal data outside Singapore
CaringSG may use cloud, technology, communications or service providers that process or store personal data outside Singapore.
Where personal data is transferred outside Singapore, CaringSG will take reasonable steps to ensure that the recipient is bound to provide a standard of protection that is at least comparable to the protection required under the PDPA.
These measures may include contractual protections, security assessments and the use of service providers with appropriate data-protection commitments.
16. Access to personal data
You may request:
access to personal data about you that is in CaringSG’s possession or under our control; and
information about how that personal data has been used or disclosed within the applicable period.
CaringSG may need to verify your identity before processing the request.
Where a request is submitted on behalf of another person, CaringSG may require evidence that the requester is legally authorised to act for that person.
A reasonable fee may be charged for an access request. CaringSG will inform you of the estimated fee before processing the request.
Access may be refused or limited where an exception or prohibition under the PDPA applies, including where providing access would reveal another person’s personal data or create an unreasonable or disproportionate burden.
17. Correction of personal data
You may request correction of inaccurate or incomplete personal data held by CaringSG.
Where there are no reasonable grounds to reject the request, CaringSG will:
correct the information as soon as reasonably practicable; and
where required, send the corrected information to organisations to which it was disclosed within the applicable period, unless they no longer require the information for legal or business purposes.
CaringSG will not charge a fee for making a correction.
CaringSG will generally respond to access and correction requests as soon as reasonably possible. If we are unable to respond within 30 calendar days, we will inform you in writing of the time by which we expect to respond.
18. Personal data breaches
CaringSG maintains procedures for assessing, containing and responding to personal data breaches.
Where a breach is assessed to be notifiable, CaringSG will notify the Personal Data Protection Commission and affected individuals as required under the PDPA.
Individuals, volunteers, staff and partners should report suspected loss, misuse, unauthorised disclosure or unauthorised access to personal data to CaringSG’s Data Protection Officer immediately.
Notifiable breaches must be reported to the PDPC as soon as practicable and no later than three calendar days after the organisation determines that the breach is notifiable.
19. Data Protection Officer
For questions, feedback, withdrawal of consent, access or correction requests, or concerns about CaringSG’s handling of personal data, please contact:
Data Protection Officer
CaringSG Limited
Email: chrislim@caring.sg
Address:
22 Lengkok Bahru
#03-06/07 Block Vista
Singapore 159053
Please include sufficient information for CaringSG to identify you, understand your request and locate the relevant records.
