Personal Data Protection Act (PDPA) Policy
St Andrew’s Mission School recognises the significance of the personal data you entrust to us. We are dedicated to managing, protecting, and processing your data responsibly.
This Data Protection Policy outlines how we collect, use, disclose, safeguard, and handle your personal data in compliance with the Personal Data Protection Act 2012 (PDPA).
- Introduction to the Personal Data Protection Act 2012
1.1 Definition of Personal Data: “Personal Data” refers to any information, whether accurate or not, that can identify an individual on its own or in conjunction with other information to which the organization has or is likely to have access.
1.2 Examples of Personal Data:
1.2.1 Personal identification information, including name, gender, date of birth, NRIC number, photographs, video recordings, closed circuit television (CCTV) footage, and voice recordings;
1.2.2 Contact information, including postal address, email address, telephone numbers and mobile phone numbers;
1.2.3 Personal records and demographic information, including academic history, academic qualifications, medical history, health and sickness reports, employment history and records.
1.3 Collection and Consent: Generally, before collecting any personal data from you, we will inform you of the purposes for which your data may be collected, used, and/or disclosed, and will obtain your consent for these intended purposes.
2. Purposes for Personal Data
2.1 Depending on your relationship with us (e.g., student, parent, alumnus, staff, applicant, intern, volunteer, vendor, service provider), we may collect, use, and/or disclose your Personal Data for the following purposes:
2.1.1 Assessing suitability for admission or employment, enrolling or employing individuals, providing educational courses and training, including sending course materials, information on timetables and examinations via mail, email, SMS or voice calls;
2.1.2 Managing relationships with St Andrew’s Mission School, including responding to inquiries and sending correspondence, statements, or notices, which may involve disclosing certain Personal Data for delivery purposes;
2.1.3 Conducting due diligence or background checks as required by legal or regulatory obligations or risk management procedures that may be required by law or put in place by St Andrew’s Mission School, including obtaining references from prior educational institutions;
2.1.4 Processing applications for scholarships, financial assistance, and research support, as well as managing related programs, including using Personal Data for development and fundraising activities, and disclosing information to donors, grantors, evaluators, and external organizations for reports, events, surveys, and publicity of St Andrew’s Mission School’s related programmes;
2.1.5 Investigating potential fraud, misconduct, or unlawful actions, or omission, and using electronic and video systems to maintain school campus security, control access, and investigate suspicious or inappropriate activities;
2.1.6 Responding to requests for information from government ministries, public agencies, statutory boards, authorised non-governmental entities performing government-related functions, as well as external or internal auditors in connection with audit requirements imposed by the Group’s headquarters or regulatory authorities;
2.1.7 Conducting market research and analysis for St Andrew’s Mission School’s operational strategy and policy planning, including providing data to external parties for program evaluation and sharing information with former academic institutions and partner institutions for joint administered programmes;
2.1.8 Engaging with the community to garner support and resources for St Andrew’s Mission School, its community and affiliated institutions;
2.1.9 Supporting St Andrew’s Mission School’s functions, but not restricted to, the teaching and personal and professional development of students, research, and administration of St Andrew’s Mission School;
2.1.10 Processing and administering applications for overseas exchange programs and related activities, including disclosing information to overseas institutions and training organisations;
2.1.11 Processing and conferring awards, medals, scholarships, honors, and other distinctions, and publishing or releasing related information;
2.1.12 Engaging alumni including but not limited to notification on St Andrew’s Mission School and alumni-related initiatives and activities, invitation to St Andrew’s Mission School and alumni-related events through notifications, event invitations, updates, surveys, and communications related to alumni initiatives;
2.1.13 Handling applications and enrolment for health, life, travel insurance, service provision, and concession cards, and managing related services;
2.1.14 Processing applications for and administering local and overseas career-related activities, including events, programmes, internships, employment opportunities, and career coaching, and sharing information with companies (whether local or overseas) for recruitment, internship, industrial attachment, job placement and research support;
2.1.15 Facilitating participation in student life and alumni development activities, including social, cultural, athletic, educational events, volunteering and training programmes, student membership and leadership roles in clubs, societies, and orientation/reception activities;
2.1.16 Taking photographs and videos (whether by St Andrew’s Mission School staff or third-party photographers and/or videographers) during school programmes, events, or seminars organised by St Andrew’s Mission School or its affiliates for publicity purposes;
2.1.17 Maintaining records, including and not limited to school premises video surveillance, and visitor registration;
2.1.18 Providing updates on St Andrew’s Mission School events;
2.1.19 With your consent, sending marketing, advertising, and promotional information via mail, email, SMS, MMS, fax, or voice calls;
2.1.20 Any other purposes that St Andrew’s Mission School may inform you of in writing from time to time, for which St Andrew’s Mission School will seek your separate consent.
2.1.21 To facilitate our smooth operations, we may disclose your Personal Data to third-party service providers, agents, or affiliates, either within Singapore or abroad, who process the data on our behalf for the purposes listed above.
3. Specific Issues for the Disclosure of Personal Data to Third Parties
3.1 We are committed to protecting the confidentiality of the Personal Data you provide to us.
3.2 We will not disclose your Personal Data to third parties without first obtaining your express consent permitting us to do so. However, there are certain situations where disclosure may occur without prior consent, including but not limited to the following:
3.2.1 When disclosure is required by applicable laws and regulations;
3.2.2 When disclosure is clearly in your best interests and timely consent cannot be obtained;
3.2.3 When disclosure is necessary to respond to an emergency threatening your life, health, or safety, or that of another individual;
3.2.4 When there are reasonable grounds to believe that the health or safety of yourself or another individual is at serious risk, and timely consent cannot be obtained. We will notify you of such disclosure and its purpose as soon as practicable;
3.2.5 When disclosure is necessary for legal investigations or proceedings;
3.2.6 When Personal Data is disclosed to an officer of a prescribed law enforcement agency, upon presentation of written authorization signed by the head or director of that law enforcement agency or person of a similar rank, certifying that the Personal Data is necessary for the purposes of their functions or duties of the officer; and/or
3.2.7 When disclosure is to a public agency and is necessary for the public interest.
3.3 When Personal Data is disclosed to third parties with your consent, we will ensure that adequate protection measures are in place and will make every effort to ensure these third parties comply with the PDPA and our data protection policies.
4. Request for Access, Correction and/or Withdrawal of Personal Data
4.1 You may request to access or correct the Personal Data we hold, or withdraw your consent for the collection, use, and/or disclosure of your Personal Data at any time by submitting a written request to our PDPA Contact Person (see below).
4.2 We will respond to your requests within the following timeframes:
- Requests to withdraw consent for the collection, use or disclosure of personal data will be processed within ten (10) working days of receipt of the request, subject to any legal, regulatory or operational requirements.
- Requests for access to or correction of personal data will be responded to within thirty (30) days of receipt of the request.
4.3 If you request to correct your Personal Data, we will update the information and notify any organizations to which we disclosed your data within the past year, unless they no longer require the corrected data for legal or business purposes.
4.4 When you withdraw consent, we will process your request within a reasonable time from such a request for withdrawal of consent being made, and will cease to collect, use, or disclose your Personal Data as specified in your request.
4.5 Please note that withdrawing consent may have legal consequences. Depending on the extent of your withdrawal, it could impact our ability to maintain your existing relationship with us.
4.6 Where we are unable to respond within the stipulated timeline, we will inform you in writing within that period of the estimated date by which we will be able to provide a response. If we are unable to provide access or make a correction, we will generally inform you of the reasons for our decision, except where we are not required to do so under the PDPA.
4.7 There are some circumstances where we are not required to provide you with information, and others where we are not allowed by the PDPA to do so. In those circumstances we may be able to provide you with limited information. You may obtain more information about these circumstances from our Data Protection Officer.
5. Administration and Security Management of Personal Data
5.1 We will make reasonable efforts to ensure that your Personal Data is accurate, complete, and up to date, taking into account the purposes for which the personal data is used and the interests of the individual. Personal data provided to us may be verified against supporting documents and through generally accepted practices and guidelines, including requests to sight original documentation where necessary.
5.2 To help us maintain accurate records, you should ensure that the personal data you provide to us is complete, accurate and current. If there are any changes to your personal data, please inform us as soon as possible by contacting our Data Protection Officer
5.3 We will also take reasonable efforts and measures to ensure that the Personal Data in our possession or under our control is destroyed and/or anonymized as soon as it is reasonable to assume that (i) the purpose for which that Personal Data was collected is no longer being served by the retention of such Personal Data; (ii) retention is no longer necessary for any other legal or business purposes.
6. Updates on Data Protection Policy
6.1 To ensure the effective management, protection, and processing of your Personal Data, we will periodically review and update our policies, procedures, and processes.
6.2 We reserve the right to amend the terms of this Data Protection Policy at our absolute discretion.
6.3 We encourage you to periodically check our website, www.sams.org.sg, for the most current version of our Data Protection Policy to stay informed about our latest practices regarding Personal Data Protection.
7. Complaint Process and Feedback
7.1 If you have any complaint, grievance, or feedback regarding our handling of your Personal Data or about our compliance with the PDPA, please feel free to reach out to us. Generally, we are unable to deal with anonymous complaints because we are unable to investigate them. If you raise a complaint anonymously, we will nevertheless note the matter raised and, if possible, investigate and resolve it appropriately.
7.2 Whenever you make a complaint, our Data Protection Officer will seek sufficient information from you to enable us to investigate it. Please be prepared to provide, for example:
- the type of action, or lack of action, by us that has given rise to your concern;
- whether it was an isolated incident or is ongoing and, in the case of an isolated incident, when it occurred;
- a copy of any relevant correspondence or evidence you hold; and
- details about what you consider should have happened or should not have happened.
Upon receiving a complaint, our Data Protection Officer will investigate it and within thirty (30) days advise you of the outcome and the reasons for that outcome; or advise you that more time is needed and when it is expected to be resolved. If you are not satisfied with the outcome, you may take your complaint to the Personal Data Protection Commission.
7.3 You can contact us through the following methods to submit your complaint, grievance, or feedback:
Singapore Telephone Number: 6334 1539
Email: dpo@sams.org.sg. Attention it to the ‘Data Protection Officer’
School Address: 11 Bukit Batok Street 25, Singapore 658712
7.4 We are committed to deal with any complaint, grievance or feedback that you may have efficiently and fairly.
Personal Data Protection Act (PDPA) Policy
St Andrew’s Mission School recognises the significance of the personal data you entrust to us. We are dedicated to managing, protecting, and processing your data responsibly.
This Data Protection Policy outlines how we collect, use, disclose, safeguard, and handle your personal data in compliance with the Personal Data Protection Act 2012 (PDPA).
- Introduction to the Personal Data Protection Act 2012
1.1 Definition of Personal Data: “Personal Data” refers to any information, whether accurate or not, that can identify an individual on its own or in conjunction with other information to which the organization has or is likely to have access.
1.2 Examples of Personal Data:
1.2.1 Personal identification information, including name, gender, date of birth, NRIC number, photographs, video recordings, closed circuit television (CCTV) footage, and voice recordings;
1.2.2 Contact information, including postal address, email address, telephone numbers and mobile phone numbers;
1.2.3 Personal records and demographic information, including academic history, academic qualifications, medical history, health and sickness reports, employment history and records.
1.3 Collection and Consent: Generally, before collecting any personal data from you, we will inform you of the purposes for which your data may be collected, used, and/or disclosed, and will obtain your consent for these intended purposes.
2. Purposes for Personal Data
2.1 Depending on your relationship with us (e.g., student, parent, alumnus, staff, applicant, intern, volunteer, vendor, service provider), we may collect, use, and/or disclose your Personal Data for the following purposes:
2.1.1 Assessing suitability for admission or employment, enrolling or employing individuals, providing educational courses and training, including sending course materials, information on timetables and examinations via mail, email, SMS or voice calls;
2.1.2 Managing relationships with St Andrew’s Mission School, including responding to inquiries and sending correspondence, statements, or notices, which may involve disclosing certain Personal Data for delivery purposes;
2.1.3 Conducting due diligence or background checks as required by legal or regulatory obligations or risk management procedures that may be required by law or put in place by St Andrew’s Mission School, including obtaining references from prior educational institutions;
2.1.4 Processing applications for scholarships, financial assistance, and research support, as well as managing related programs, including using Personal Data for development and fundraising activities, and disclosing information to donors, grantors, evaluators, and external organizations for reports, events, surveys, and publicity of St Andrew’s Mission School’s related programmes;
2.1.5 Investigating potential fraud, misconduct, or unlawful actions, or omission, and using electronic and video systems to maintain school campus security, control access, and investigate suspicious or inappropriate activities;
2.1.6 Responding to requests for information from government ministries, public agencies, statutory boards, authorised non-governmental entities performing government-related functions, as well as external or internal auditors in connection with audit requirements imposed by the Group’s headquarters or regulatory authorities;
2.1.7 Conducting market research and analysis for St Andrew’s Mission School’s operational strategy and policy planning, including providing data to external parties for program evaluation and sharing information with former academic institutions and partner institutions for joint administered programmes;
2.1.8 Engaging with the community to garner support and resources for St Andrew’s Mission School, its community and affiliated institutions;
2.1.9 Supporting St Andrew’s Mission School’s functions, but not restricted to, the teaching and personal and professional development of students, research, and administration of St Andrew’s Mission School;
2.1.10 Processing and administering applications for overseas exchange programs and related activities, including disclosing information to overseas institutions and training organisations;
2.1.11 Processing and conferring awards, medals, scholarships, honors, and other distinctions, and publishing or releasing related information;
2.1.12 Engaging alumni including but not limited to notification on St Andrew’s Mission School and alumni-related initiatives and activities, invitation to St Andrew’s Mission School and alumni-related events through notifications, event invitations, updates, surveys, and communications related to alumni initiatives;
2.1.13 Handling applications and enrolment for health, life, travel insurance, service provision, and concession cards, and managing related services;
2.1.14 Processing applications for and administering local and overseas career-related activities, including events, programmes, internships, employment opportunities, and career coaching, and sharing information with companies (whether local or overseas) for recruitment, internship, industrial attachment, job placement and research support;
2.1.15 Facilitating participation in student life and alumni development activities, including social, cultural, athletic, educational events, volunteering and training programmes, student membership and leadership roles in clubs, societies, and orientation/reception activities;
2.1.16 Taking photographs and videos (whether by St Andrew’s Mission School staff or third-party photographers and/or videographers) during school programmes, events, or seminars organised by St Andrew’s Mission School or its affiliates for publicity purposes;
2.1.17 Maintaining records, including and not limited to school premises video surveillance, and visitor registration;
2.1.18 Providing updates on St Andrew’s Mission School events;
2.1.19 With your consent, sending marketing, advertising, and promotional information via mail, email, SMS, MMS, fax, or voice calls;
2.1.20 Any other purposes that St Andrew’s Mission School may inform you of in writing from time to time, for which St Andrew’s Mission School will seek your separate consent.
2.1.21 To facilitate our smooth operations, we may disclose your Personal Data to third-party service providers, agents, or affiliates, either within Singapore or abroad, who process the data on our behalf for the purposes listed above.
3. Specific Issues for the Disclosure of Personal Data to Third Parties
3.1 We are committed to protecting the confidentiality of the Personal Data you provide to us.
3.2 We will not disclose your Personal Data to third parties without first obtaining your express consent permitting us to do so. However, there are certain situations where disclosure may occur without prior consent, including but not limited to the following:
3.2.1 When disclosure is required by applicable laws and regulations;
3.2.2 When disclosure is clearly in your best interests and timely consent cannot be obtained;
3.2.3 When disclosure is necessary to respond to an emergency threatening your life, health, or safety, or that of another individual;
3.2.4 When there are reasonable grounds to believe that the health or safety of yourself or another individual is at serious risk, and timely consent cannot be obtained. We will notify you of such disclosure and its purpose as soon as practicable;
3.2.5 When disclosure is necessary for legal investigations or proceedings;
3.2.6 When Personal Data is disclosed to an officer of a prescribed law enforcement agency, upon presentation of written authorization signed by the head or director of that law enforcement agency or person of a similar rank, certifying that the Personal Data is necessary for the purposes of their functions or duties of the officer; and/or
3.2.7 When disclosure is to a public agency and is necessary for the public interest.
3.3 When Personal Data is disclosed to third parties with your consent, we will ensure that adequate protection measures are in place and will make every effort to ensure these third parties comply with the PDPA and our data protection policies.
4. Request for Access, Correction and/or Withdrawal of Personal Data
4.1 You may request to access or correct the Personal Data we hold, or withdraw your consent for the collection, use, and/or disclosure of your Personal Data at any time by submitting a written request to our PDPA Contact Person (see below).
4.2 We will respond to your requests within the following timeframes:
- Requests to withdraw consent for the collection, use or disclosure of personal data will be processed within ten (10) working days of receipt of the request, subject to any legal, regulatory or operational requirements.
- Requests for access to or correction of personal data will be responded to within thirty (30) days of receipt of the request.
4.3 If you request to correct your Personal Data, we will update the information and notify any organizations to which we disclosed your data within the past year, unless they no longer require the corrected data for legal or business purposes.
4.4 When you withdraw consent, we will process your request within a reasonable time from such a request for withdrawal of consent being made, and will cease to collect, use, or disclose your Personal Data as specified in your request.
4.5 Please note that withdrawing consent may have legal consequences. Depending on the extent of your withdrawal, it could impact our ability to maintain your existing relationship with us.
4.6 Where we are unable to respond within the stipulated timeline, we will inform you in writing within that period of the estimated date by which we will be able to provide a response. If we are unable to provide access or make a correction, we will generally inform you of the reasons for our decision, except where we are not required to do so under the PDPA.
4.7 There are some circumstances where we are not required to provide you with information, and others where we are not allowed by the PDPA to do so. In those circumstances we may be able to provide you with limited information. You may obtain more information about these circumstances from our Data Protection Officer.
5. Administration and Security Management of Personal Data
5.1 We will make reasonable efforts to ensure that your Personal Data is accurate, complete, and up to date, taking into account the purposes for which the personal data is used and the interests of the individual. Personal data provided to us may be verified against supporting documents and through generally accepted practices and guidelines, including requests to sight original documentation where necessary.
5.2 To help us maintain accurate records, you should ensure that the personal data you provide to us is complete, accurate and current. If there are any changes to your personal data, please inform us as soon as possible by contacting our Data Protection Officer
5.3 We will also take reasonable efforts and measures to ensure that the Personal Data in our possession or under our control is destroyed and/or anonymized as soon as it is reasonable to assume that (i) the purpose for which that Personal Data was collected is no longer being served by the retention of such Personal Data; (ii) retention is no longer necessary for any other legal or business purposes.
6. Updates on Data Protection Policy
6.1 To ensure the effective management, protection, and processing of your Personal Data, we will periodically review and update our policies, procedures, and processes.
6.2 We reserve the right to amend the terms of this Data Protection Policy at our absolute discretion.
6.3 We encourage you to periodically check our website, www.sams.org.sg, for the most current version of our Data Protection Policy to stay informed about our latest practices regarding Personal Data Protection.
7. Complaint Process and Feedback
7.1 If you have any complaint, grievance, or feedback regarding our handling of your Personal Data or about our compliance with the PDPA, please feel free to reach out to us. Generally, we are unable to deal with anonymous complaints because we are unable to investigate them. If you raise a complaint anonymously, we will nevertheless note the matter raised and, if possible, investigate and resolve it appropriately.
7.2 Whenever you make a complaint, our Data Protection Officer will seek sufficient information from you to enable us to investigate it. Please be prepared to provide, for example:
- the type of action, or lack of action, by us that has given rise to your concern;
- whether it was an isolated incident or is ongoing and, in the case of an isolated incident, when it occurred;
- a copy of any relevant correspondence or evidence you hold; and
- details about what you consider should have happened or should not have happened.
Upon receiving a complaint, our Data Protection Officer will investigate it and within thirty (30) days advise you of the outcome and the reasons for that outcome; or advise you that more time is needed and when it is expected to be resolved. If you are not satisfied with the outcome, you may take your complaint to the Personal Data Protection Commission.
7.3 You can contact us through the following methods to submit your complaint, grievance, or feedback:
Singapore Telephone Number: 6334 1539
Email: dpo@sams.org.sg. Attention it to the ‘Data Protection Officer’
School Address: 11 Bukit Batok Street 25, Singapore 658712
7.4 We are committed to deal with any complaint, grievance or feedback that you may have efficiently and fairly.