Home About Us
Our Purposes, Mission & Values Our Heritage Governance
Our Board Governance Evaluation Checklist
How We Serve
Education
Journey With Us Contact Us Donate

PRIVACY AND DATA PROTECTION NOTICE

Canossa Mission Singapore (“CMS”) is committed to protecting personal data entrusted to us by individuals. This Privacy and Data Protection Notice (“Notice”) sets out CMS’s privacy policy and the basis upon which CMS collects, uses and discloses your personal data under the Singapore Personal Data Protection Act 2012 (“PDPA”). This Notice also explains how you can update us on changes in your personal data or request that we delete your personal data from our records.

Personal Data

1. As used in this Notice:
“Personal data” means any data, whether true or not, about you from which you can be identified, either: (a) from that data; or (b) from that data and other information to which we have or are likely to have access; and “PDPC” means the Singapore Personal Data Protection Commission.

2. We may collect, use and disclose your personal data for the purposes of providing our services, processing donations, responding to enquiries, and keeping you updated about our work. We will only collect, use and disclose your personal data where you have given consent or where permitted by law.

Collection, Use and Disclosure of Personal Data
Collection

3. We may collect your personal data in various ways, including but not limited to forms that you fill out and submit to us (whether physically, electronically or otherwise); your interactions with our staff, interns, volunteers, board or committee members via meetings, email or text messages, telephone conversations or other communications; your participation in our events and activities when photos and/or video recordings may be taken; or your visit to our premises which may be under CCTV surveillance.

4. Your personal data may also be disclosed to CMS by third parties with your consent, or where otherwise permitted by law.

5. We may also collect your personal data where required or permitted by laws or regulations binding on CMS.

Purposes

6. We may collect, use and/or disclose your personal data for any or all of the following purposes as well as any other purposes that you may have specifically consented to, or which are permitted by the PDPA or other applicable laws:

  • to provide our services to you;
  • in carrying out our operations;
  • for job application and staff and volunteer recruitment purposes, including but not limited to conducting background or reference checks and evaluations of suitability;
  • for billing and reporting, such as for invoicing and account management purposes and tax-deductible donation submissions to the Inland Revenue Authority of Singapore;
  • to manage and administer events or programmes that you have signed up for, including processing registration, payments (where applicable), attendance tracking, and post-event communication;
  • to process and acknowledge donations, including issuing receipts and providing updates related to your donation and our fundraising efforts;
  • to provide marketing services, such as newsletters, event invitations, and updates about our events, programmes and campaigns, where you have provided consent to receive such communications;
  • for follow-up action regarding any complaints, feedback, queries or requests received via our website or any other communication channels or to monitor, evaluate or audit the services we have provided or activities we have organised; and
  • to comply with all applicable laws and regulations, including but not limited to assisting in law enforcement and investigations conducted by any governmental and/or regulatory authority.

The purposes listed above may continue to apply even where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a legally required, permitted or reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under any contract with you).

7. We may collect, use and/or disclose your personal data on behalf of government agencies, in which case, we will do so in accordance with the government’s prevailing data management policies.

8. We may collect, use and/or disclose your personal data pursuant to an exception under the PDPA or other written law such as during the following situations:

  • to respond to an emergency that threatens your life, health and safety or that of another individual; and
  • where necessary in the national interest, or for any investigation or proceedings.

We may disclose your personal data to third parties for any of the purposes mentioned above. Such third parties include but are not limited to:

  • our service providers (for instance, we may disclose your data to contractors who assist us with the services we provide or the operations or activities we conduct, including, merely by way of example, our service providers who assist with or provide our information and data management systems, administrative and finance systems, website infrastructure and our communications and marketing platforms);
  • our volunteers and interns (for example, we may disclose your data to volunteers /interns in connection with the services, operations or activities that may relate to you);
  • our professional advisers such as lawyers and auditors;
  • government agencies and regulatory bodies;
  • law enforcement officials; and
  • any other party that you may have specifically consented to.

Consent and Notification Obligation

10. We will seek your consent before collecting your personal data, except where collection, use or disclosure of your personal data without consent is required or permitted by law.

11. You have the right of choice regarding the collection, usage and/or disclosure of your personal data. However, we may not be able to provide certain services to you or enter into a relationship with you if you are not willing to provide your consent to our collection, use or disclosure of your personal data.

12. Where you have provided your personal data for an obvious purpose, we will assume that you have consented to our collection, use and disclosure of your personal data for that purpose (e.g., when you provide your personal data to register for an event, we will assume that you have consented to our collection, use and disclosure of your personal data for the purpose of your participation in that event).

13. Either before or when we collect your personal data, we will inform you of the purpose for which your personal data is collected, except when such personal data is provided by you for obvious purposes or in other situations when the PDPA or other applicable laws allow for such collection without notification of the purpose.

14. In general, providing your personal data is voluntary. However, in certain situations (e.g. compliance with legal requirements or to process a service request), it may be obligatory for you to provide specific types of personal data. Where the provision of data is obligatory, we will inform you of this and explain the consequences of not providing such data (e.g., we may be unable to provide the requested service or proceed with your application).

Access and Correction of Personal Data

15. We generally rely on personal data provided by you (or your authorised representative). In order to ensure that your personal data is current, complete, and accurate, please update us if there are changes to your personal data by informing our Data Protection Officer at the contact details provided in paragraph 30 below. If you provide to us any personal data of anyone else apart from yourself, by providing such personal data, you represent, warrant and undertake that you are lawfully and duly authorised to provide such personal data on behalf of the relevant person and that such personal data is current, complete and accurate.

Access to and Correction of Personal Data

16. If you wish to make (a) an access request for access to a copy of the personal data which we hold about you or information about the ways in which we use or disclose your personal data, or (b) a correction request to correct or update any of your personal data which we hold about you, you may submit your request in writing to our Data Protection Officer at the contact details provided in paragraph 30 below.

17. We will respond to your request as soon as reasonably possible. Before we accede to your access or correction request, we may need to verify your identity by checking your identification document, and the legitimacy of your request. If we are not able to respond to your request within thirty (30) calendar days after receiving your request, we will inform you in writing within thirty (30) calendar days of the time by which we will be able to respond to your request.

18. Please note that we may refuse your request under certain circumstances as set out in the PDPA. Further, depending on the circumstances, we may only need to provide you with access to your personal data contained in the documents requested, and not to the entire documents themselves. It may also be appropriate for us to simply provide you with confirmation of your personal data that we have on record if the record of your personal data forms a negligible part of the document.

19. Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.

Data Protection

20. You may withdraw your consent and request us to stop using and/or disclosing your personal data for any or all of the purposes listed in paragraph 6 above or any other purposes that you may have specifically consented to by submitting your request in writing to our Data Protection Officer at the contact details provided in paragraph 30 below.

21. We will try to process your request within ten (10) business days of receipt and will notify you if we require more time to give effect to your request.

22. Please note that depending on the nature and scope of your request, we may not be in a position to continue providing our services to you or to continue our relationship with you and we will, in such circumstances, notify you before completing the processing of your request. Should you decide to cancel your withdrawal of consent, please notify our Data Protection Officer at the contact details provided in paragraph 30 below.

23. Please note that withdrawing your consent does not affect our right to continue to collect, use and disclose your personal data where such collection, use and disclosure without consent is required or permitted under the PDPA or other applicable laws.

Protection of Personal Data

24. To safeguard your personal data from unauthorised or accidental access, collection, use, disclosure, copying, modification, loss, disposal or destruction or other similar risks, we have introduced appropriate administrative and physical measures such as up-to-date anti-virus protection and encryption to secure all storage and transmission of personal data by us, and will disclose personal data both internally and to authorised third parties and agents only on a need-to-know basis. We strive to protect the security of your personal data by regularly reviewing and enhancing our information security measures.

25. If there is a need to disclose your personal data to third parties under paragraph 9 above in line with the purposes mentioned in paragraph 6 above, we will either ensure that such third parties are legally required to implement, or we are sufficiently assured that they will and/or have implemented the necessary security measures to protect your personal data.

Retention of Personal Data

26. We will retain your personal data for as long as it is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable laws. We will cease to retain your personal data, or remove the means by which the data can be associated with you, after it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for legal or business purposes.

27. You may request that we delete your personal data by contacting our Data Protection Officer at the contact details provided in paragraph 30 below. However, we will not be able to comply with your request if we are required to retain your personal data for business or legal purposes. In such circumstances, you may withdraw your consent to our further use or disclosure of your personal data – please refer to paragraphs 20 to 23 above.

Cross-border Transfers of Personal Data

28. Generally, we will not transfer your personal data to other jurisdictions. However, if we do so, we will obtain your consent for the transfer to be made and we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPA, including entering into an agreement with the receiving party to accord similar levels of data protection as those in Singapore.

Data Breach Notification

29. As no method of transmission over the Internet or method of electronic storage is completely secure, there remains a possibility of data breach. In the event a breach of security leads to unauthorised or accidental access, collection, use, disclosure, copying, modification, loss, disposal or destruction of personal data, we will promptly assess the impact and if appropriate, notify the affected individuals at the same time or after reporting the breach to the PDPC and other relevant regulatory agencies (if any). Reporting to the PDPC (where required) will be made no later than three (3) calendar days after our assessment.

Data Protection Officer

30. You may contact our Data Protection Officer if you have any enquiry, feedback or complaint regarding our personal data protection policies and procedures, if you wish to make any request, or if you believe that information we hold about you is incorrect or out-dated.

31. You may contact our Data Protection Officer via email at jo.sim@cmsfdcc.org.sg

Modifications

32. We may revise this Notice from time to time to ensure that it is consistent with changes in legal or regulatory requirements and is in line with future developments and industry standards. You may determine if any such revision has taken place by referring to the date on which this Notice was last issued. Your continued use of our services or continuation of your relationship with us constitutes your acknowledgement and acceptance of such changes.