Personal Data Protection Policy
Introduction
We at GRC Group of Companies ("GRC Group”) respect the privacy and confidentiality of personal data in our possession or under our control; the personal data of our clients, partners, consultants, contractors, service providers, outsourced third-parties and others who have business dealings with us.
We have implemented policies and practices to safeguard the collection, use, disclosure, storage and other processing of personal data provided to us.
This policy applies to GRC Limited and its wholly owned Singapore subsidiary Companies ("GRC Group”) in the businesses of building construction, civil infrastructure, prefabrication technology, environmental & sustainability, procurement and property investment.
How We Collect Your Personal Data
We collect your personal data in the following ways:
- When you respond to our events and/or campaign invitations
- When you send feedback to us on our quality of service or your user experience
- When you register your attendance at our shareholders’ meetings that we are required by law to hold
- When you provide your personal information relating to the sale and purchase of properties or leasing of properties
- When you visit our websites and leave behind your contact information
- When you communicate with us via emails or written correspondences
- When you submit your CV and job application form to us in response to our recruitment advertisements in newspapers and websites, or at roadshows or job fairs
- When you submit your CV to recruitment firms or job portals, which are in turn forwarded to or retrieved by us
Types of Personal Data We Collect About You
The types of personal data we collect about you may include:
- Your personal contact information (name, address, phone numbers, email address)
- Your personal particulars (NRIC/FIN/Work Permit, Birth Certificate, Passport) only when required under the law or necessary to accurately establish or verify your identity to a high degree of fidelity
- Job applicant’s personal details (name, nationality, marital status, languages spoken or written)
- Job applicant’s professional and work experience (job title, occupation, employment history, work experience, curriculum vitae)
- Job applicant’s educational and professional qualifications (highest education level, qualifications, schools attended, academic transcripts, membership of professional bodies)
Should you require more details on types of personal data we collect about you, you may visit our website at www.grc.com.sg or contact our Group DPO at dpo@grc.com.sg
How We Use Your Personal Data
We use the personal data we have collected about you for one or more of the following purposes:
- Customer care and account management
- Communicate with enquirers
- Notify you about our services, special events and programs
- Notify shareholders on shareholders’ meeting
- Respond to enquiries, update requests and feedback on user experience
- Monitor the movement of visitors to our physical premises for safety and/or security purposes
- Assess the competency and fitness of workers in compliance with work safety regulations
- Process property related transactions and provide services for property and facilities management
- Process job applications, recruitment and selection
- Perform our obligations arising from any contracts entered into between you and GRC Group
- Comply with legal obligations and regulatory requirements
Who We Disclose Your Personal Data To
We disclose some of the personal data we have collected about you to the following parties or organizations outside GRC Group:
- Statutory boards e.g. SLA, BCA, HDB, SGX etc.
- External advisors e.g. auditors, lawyers, consultants etc.
- Insurance companies and agents
- IT/Technical support, IT service providers
- Webhosting companies, cloud service providers
- Banks, payment card processing companies
- Recruitment agencies / Headhunters
- Commercial service and training providers
- Government ministries and agencies (e.g. MOM, MOH)
How We Manage the Collection, Use and Disclosure of Your Personal Data
- Obtaining Consent
To the fullest extent required by the PDPA, before we collect, use or disclose your personal data, we will notify you of the purpose why we are doing so. We next obtain written confirmation from you on your expressed consent. As far as possible, we will not collect more personal data than necessary for the stated purpose. Under certain circumstances, we may assume deemed consent from you when you voluntarily provide your personal data for the stated purpose, e.g. when you enter into a Sales & Purchase Agreement in purchasing a property from us. - Third-Party Consent
If you perform a transaction with us on behalf of another individual, you must first obtain consent from that individual in order for us to collect, use or disclose his/her personal data.
How You Can Limit Processing of Personal Data
- Withdrawal of Consent
If you wish to withdraw consent, you should give us reasonable advance notice. You have to be aware, though, of the likely consequences of your withdrawal of consent, e.g. without your personal contact information we may not be able to inform you of future services offered by GRC Group. Your request for withdrawal of consent can take the form of an email or letter to us, or through the "UNSUB” feature in an online service.
How You Can Access and Make Correction to Your Personal Data
You may write in to us, based on reasonable grounds, to find out how we have been using or disclosing your personal data. We are obligated under the PDPA to allow you access to your personal data of the past one year, and to make any correction if there is any error or omission. Before we accede to your request, we may need to verify your identity by checking your NRIC or other legal identification document.
We will endeavour to fulfil your request within 30 days, with an estimate of the fee for processing the request, if applicable. If we are not able to do so within 30 days, we will notify you of the additional time required.
How We Ensure the Accuracy of Your Personal Data
We will take reasonable precautions and verification checks to ensure that the personal data we have collected from you is reasonably accurate, complete and up-to-date. From time to time, we may do a verification exercise with you to update us on any changes to your personal data.
How We Protect Your Personal Data
We will take the necessary security arrangements to protect your personal data that is in our possession to prevent unauthorised access, use, disclosure, or similar risks. We will take reasonable and appropriate measures to maintain the confidentiality and integrity of your personal data, and will only share your data with authorised persons on a 'need to know’ basis.
External data intermediaries who process and maintain your personal data on our behalf will be bound by contractual information security arrangements we have with them.
How We Retain Your Personal Data
We will not retain any of your personal data under our charge when it is no longer necessary for any business or legal purposes. Based on our Document Retention Policy, we will ensure that your personal data that are no longer needed by us will be destroyed or disposed of in a secure manner.
How We Transfer Your Personal Data
If there is a need for us to transfer your personal data to another country, we will ensure that the standard of data protection in the recipient country is comparable to that of Singapore’s PDPA. If this is not so, we will enter into a contractual agreement with the receiving party to accord similar levels of data protection as that in Singapore.
How We Handle Queries and Complaints
If you have any query or feedback regarding this Policy, or any complaint you have relating to how we manage your personal data, you may contact our Group Data Protection Officer at dpo@grc.com.sg
Any query or complaint should include, at least, the following details:
- Your full name and contact information
- Brief description of your query or complaint
We treat such queries and complaints seriously and will deal with them confidentially and within reasonable time.
How We Use Your Location Information
Note that if you give us the permission to do so via your mobile device, we may use and store information about your location. We use this information to provide features of our Service in order to improve and customize our Service. You can enable or disable location services when you use our Service at any time, through your mobile device settings.
Tracking of User Activity
Where we track user activity, we will document this in our Data Inventory, and disclose such activity in our Privacy Notice.
We use Tracking Tools such as Google Analytics
- Use of Cookies
We use "cookies” to collect information about your activity on our website. Cookies are files with a small amount of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your computer’s hard drive. You can instruct your browser to refuse all cookies or to indicate them when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our website.
- Behavioural Re-marketing
Where we use remarketing services to advertise on third party websites to you after you have visited our website, we, and our third party vendors, use cookies to inform, optimize and serve ads based on your past visits to our website.
The following is used for remarketing services for purposes of advertising:
- Remarketing and behavioural targeting – Google Analytics for display advertising
You can opt out of these re-marketing services by visiting the website of the relevant third party vendor(s).
Compliance with Laws
If required to do so by law, we will disclose personal data about you to the relevant authorities or to law enforcement agencies.
Links to Other Sites
Our website may contain links to other websites that are not operated by us. If you click on a third party link, you will be directed to that third party’s website. It is important that you review the Privacy Policy of every site you visit. We have no control over, and are unable to assume any responsibility for, the content, privacy policies or practices of any third party sites or services.
Changes to this Data Protection Policy
We may update our Data Protection Policy from time to time. We will notify you of any changes by posting the policy on this page. Please revisit this page periodically for any changes. Changes to this Policy are effective when they are posted on this page.
Contacting Us
If you have any questions, feedback or compliant regarding this Policy, you may contact our Group Data Protection Officer at dpo@grc.com.sg
Any query or complaint should include, at least, the following details:
- Your full name and contact information
- A brief description of your query or complaint
GRC Limited
12 Tai Seng Link #08-01
Singapore 534233