This Data Protection Policy outlines how the Personal Data collected will be managed by Whitewood Consultancy Pte Ltd in accordance with the Personal Data Protection Act 2012 (“PDPA”) including the purposes for which such Personal Data may be collected, used or disclosed by us (WWC) (Whitewood Consultancy Pte Ltd).
This Data Protection Policy will form a part of the terms and conditions governing the relationship of WWC's clients (“Clients”) with WWC and should be read in conjunction with such terms and conditions in all other agreements between the Clients and WWC (“Terms and Conditions”). In the event of any conflict or inconsistency between the provisions of this Data Protection Policy and the Terms and Conditions, the provisions of the Terms and Conditions shall prevail to the fullest extent permissible by law.
This Data Protection Policy supplements but does not supersede nor replace any other consents which may have been previously provided to WWC or any other rights of collection, use or disclosure under the Terms and Conditions nor does it affect any rights that WWC may have at law in connection with the collection, use and/or disclosure of the Personal Data. Nothing herein is to be construed as limiting any of these other rights.
WWC may amend and vary this Data Protection Policy from time to time and that upon notification of such amendment, the contents thereof shall take effect from the date specified in such notice.
1. Personal Data
In accordance with our privacy framework, Personal Data refers to any information regarding an identifiable person, whether verified or not, that Whitewood Consultancy has the capacity to access or may acquire through various legitimate data channels.
2. Collection of Personal Data
2.1 From time to time, WWC may collect from (a) the Clients, (b) any person authorised by Clients, (c) third parties including Relevant Individuals (defined below) and/or (d) publicly available sources, the following data and information:
a. Personal Data about the Client’s beneficial owners, partners, directors, officers or authorized signatories, representatives, employees, customers, guarantors, other security providers and other natural persons related to the Client or connected to sourcing of facilities (collectively all of the foregoing who are natural persons, “Relevant Individuals”). Such Personal Data may include names, identification particulars, date of birth, contact details, transaction patterns, background (which may possibly include financial, career, education and family background);
b. information and data generated in the ordinary course of the business relationship with WWC;
c. information from cookies, or other technologies deployed for analysis of visits to websites or the use of any information technology application or platform of WWC.
2.2 Personal Data of a Relevant Individual may be processed, kept, transferred or disclosed in and to any country as WWC considers appropriate, in accordance with the PDPA.
2.3 Where the Personal Data of the Relevant Individual is submitted by the Client (or any person on the Client’s behalf), the Client must obtain the consent of such Relevant Individual to WWC collecting, using and disclosing his or her Personal Data for the Purposes set out below. By providing the Personal Data to WWC, the Client undertakes, represents and warrants that:
a. it has notified and obtained the consent of the Relevant Individual for WWC to collect, use, disclose and process the Personal Data for the Purposes set out below and it has retained the proof of such notification and consent which will be provided to WWC upon WWC’s request;
b. it has validly acted for and on behalf of such Relevant Individual in disclosing such Personal Data to WWC and for WWC to collect, use, disclose and process the Personal Data for the Purposes set out below; and
c. it will inform such Related Individual who wish to access, correct, or withdraw consent in relation to his/her Personal Data provided to WWC of this Personal Data Protection Policy.
3. Purposes for the Collection and Use of Personal Data
WWC may collect, use and/or process the Personal Data for, one or more of the following purposes:
a. to source and negotiate for Facilities on behalf of the Client;
b. to consider and make decisions whether to service or continue to source Facilities for the Client;
c. to prepare the relevant documentation in relation to the Client’s Facilities;
d. to carry out or respond to any enquiries or instructions from the Client or the Relevant Individuals;
e. to conduct credit checks or credit assessment on the Clients and/or the Relevant Individuals;
f. to review and assess ongoing credit worthiness and standing of the Clients and/or the Relevant Individuals;
g. for internal operational requirements (including credit and risk management, system or product development and planning, insurance, audit and administrative purposes) and to comply or meet WWC internal policies and procedures;
h. to carry out due diligence or other screening activities and background checks (including but not limited to those designed to combat financial crime, “know-your customer”, anti-money laundering, counter-terrorist financing or anti-bribery) in accordance with legal or regulatory obligations or as required by WWC;
i. to prevent, detect and investigate fraud, misconduct, any unlawful action or omission and analyzing and managing other commercial risks;
j. to manage WWC’s relationship with the Client and/or the Relevant Individuals;
k. archival of documents and records for record keeping purposes;
l. to comply with any applicable domestic and foreign laws, regulations, rules, directives, orders, instructions and requirements from any local or foreign authorities including regulatory, governmental, tax and law enforcement authorities or other authorities;
m. to enforce or defend the rights of WWC, contractual or otherwise;
n. any other purposes reasonably related to any of the above.
(collectively, the “Purposes”)
4. Disclosure of Personal Data
In carrying out one or more of the above Purposes, the Personal Data may be disclosed to the following parties (whether located within or outside Singapore) for the above Purposes or for processing in accordance to the above Purposes on a need to know basis:
a. related corporations and affiliates of WWC.
b. any director, officer, staff and relevant personnel of WWC.
c. any process agent to receive, accept and acknowledge the service of process in any legal proceedings;
d. any agent, contractor or third-party service provider who provides operational services such as administrative, information technology, telecommunication or other services to WWC for its business operations;
e. any credit reference agency, credit information bureau, rating agency, business partner, insurer provider or insurance broker, bank or financial institution;
f. WWC’s auditors and professional advisors including its solicitors;
g. any person or entity to whom WWC is under an obligation or otherwise required to make disclosure pursuant to legal process or pursuant to any domestic or foreign legal and/or regulatory obligation;
h. regulators, law enforcement and government agencies;
i. any person in connection with any of the Purposes.
5. Withdrawal of Consent
The consent to use or disclose the Personal Data for any of the above Purposes can be withdrawn by the Relevant Individual at any time by reasonable notice in writing to WWC pursuant to PDPA. However, depending on the circumstances and the nature or extent of the withdrawal of consent, such withdrawal of consent may result in WWC’s inability to source or continue to source the Facilities for the Client.
6. Access and Correction of Personal Data
To the extent that the applicable law allows, the Relevant Individuals may request access to, and correction of, the Personal Data in relation to themselves. However, some Personal Data may be exempt from such access and correction rights in accordance with the PDPA. All requests for access to, and/or correction of, the Personal Data can be submitted to WWC’s Data Protection Officer via email address at info@whitewood.sg. Please note that WWC has the right to charge a reasonable fee for the handling and processing of such requests.
7. Retention of Personal Data
The Personal Data will be kept by WWC only for as long as it is needed for the purposes for which it was collected and as required for business or to comply with legal, regulatory and internal requirements.
8. Management of Personal Data
8.1 WWC will take reasonable efforts to ensure that the Personal Data is accurate and complete, if the Personal Data is likely to be used by WWC to make a decision that affects a Relevant Individual, or disclosed to another organisation. However, this means that WWC must be updated of any changes in the Personal Data that was initially provided to WWC. WWC will not be responsible for relying on inaccurate or incomplete personal data arising from WWC not being updated of any changes in the Personal Data that was initially provided to WWC.
8.2 WWC will also put in place reasonable security arrangements to ensure that the Personal Data is adequately protected and secured. Appropriate security arrangements will be taken to prevent any unauthorised access, collection, use, disclosure, copying, modification, leakage, loss, damage and/or alteration of the Personal Data. However, WWC cannot assume responsibility for any unauthorised use of the Personal Data by third parties which are wholly attributable to factors beyond WWC’s control.
8.3 Where the Personal Data is to be transferred out of Singapore, WWC will comply with the PDPA in doing so. In this regard, this includes WWC obtaining the relevant consent unless an exception under the PDPA or law applies, and taking appropriate steps to ascertain that the foreign recipient organisation of the personal data is bound by legally enforceable obligations to provide to the transferred personal data a standard of protection that is at least comparable to the protection under the PDPA. This may include WWC entering into an appropriate contract with the foreign recipient organisation dealing with the personal data transfer or permitting the personal data transfer without such a contract if the PDPA or law permits WWC to.