SINGAPORE TOURISM BOARD PERSONAL DATA PROTECTION POLICY
The Singapore Tourism Board, 1 Orchard Spring Lane, Singapore 247729, as controller, (“STB”, “we”, “us”, or “our”) is committed to protecting information under our control that identifies you (“personal data”), including your name and identifying contact details. This document serves to inform you of your rights for your personal data, why we collect your personal data, how we use and share your personal data, and for how long we store your personal data.
General information on our processing of personal data
We collect personal data in furtherance of the statutory functions of STB under the STB Act (a) to develop and promote Singapore as a travel and tourist destination; (b) to advise the Government on matters relating to travel and tourism; (c) to enhance the travel and tourism sector’s contribution to the Singapore economy; and (d) to exercise licensing and regulatory functions in respect of such tourism enterprises as STB may determine, and the statutory purposes of the following i) Travel Agents Act, ii) Singapore Tourism (Cess Collection) Act, iii) Casino Control (Evaluation Panel) Regulations 2014, and iv) Consumer Protection (Fair Trading) Act, and including for the provision of services in any of our websites, applications, data analytics platforms, interactive kiosks or other STB platforms, or the conduct of surveys or elicitation of feedback, the organisation and running of events and programs, and the administration of grants.
We will process all personal data lawfully, fairly and in a transparent manner. We will collect personal data that is adequate, relevant and limited to what is necessary for the purposes for which they are processed. We will take reasonable steps to ensure that personal data is accurate and updated where necessary, and to erase or rectify inaccurate personal data without delay.
We will not store personal data longer than is necessary for the purpose for which the data is processed, and we will inform you of the period for which we will store your personal data and, if this is impossible, inform you of the criteria used to determine that period.
We will ensure appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures. We will not subject you to a decision based solely on automated processing (including profiling) where it produces prejudicially legal or similarly significant effects on you.
Personal data we will not collect
For EU residents, we will not collect personal data that reveals any of the following about you: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or sex life, or sexual orientation.
No requirement to provide personal data
The provision of your personal data will generally be voluntarily where there is no statutory obligation to provide your personal data. We generally do not contractually require provision of your personal data; but note that in any event non-provision of personal data might exclude you from using some of our services or parts thereof or disqualify you from receiving particular benefits.
Sharing of personal data
Unless expressly stated otherwise in this policy, we will only share personal data with others where you have consented to our doing so or where it is lawful for other reasons to do so. For example, we may share personal data with another Singapore public sector body pursuant to a data sharing direction under the Singapore Public Sector (Governance) Act 2018. Where we share personal data with your consent to other persons or entities, we will emplace contractual arrangement and security mechanisms to meet the standards under this policy.
Your rights and how to exercise them
You have rights over your personal data and we are committed to fulfilling these rights. You may be entitled to exercise some or all of the following rights:
require (a) information regarding whether your personal data is retained and (b) access to a copy of your personal data which we retain, including information on the purposes of the processing, the categories of personal data concerned, and the data recipients as well as potential retention periods;
request rectification, removal or restriction of your personal data, e.g. because (a) it is incomplete or inaccurate, (b) it is no longer needed for the purposes for which it was collected, or (c) the consent on which the processing was based has been withdrawn;
refuse to provide and, without impact to data processing activities that have taken place before such withdrawal, withdraw your consent to processing of your personal data at any time;
object, on grounds relating to your particular situation, that your personal data shall be subject to a processing. In this case, please provide us with information about your particular situation. After the assessment of the facts presented by you we will either stop processing your personal data or present you with our compelling legitimate grounds for ongoing processing;
take legal action in relation to any potential breach of your rights regarding the processing of your personal data, as well as to lodge complaints before the competent data protection authority; and/or
require that we (a) send to you personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and (b) transmit such data to another controller without hindrance; where technically feasible you shall have the right to require such data to be transmitted directly from us to another controller.
To exercise these rights or to raise any complaint of non-compliance with this policy, please contact our Data Protection Officer at [email protected]. Should you wish to exercise some or all of the rights above, please be prepared to authenticate your identity.
General information on consent
Where we are required under any applicable law to obtain your consent for the processing* of any personal data concerning you, we will do so. Where we seek your consent, we will inform you of the specific, explicit and legitimate purposes for which your consent is being obtained and thereafter process the personal data under the specific, explicit and legitimate purposes for which your consent has been obtained. Where consent is required from a child under the age of 16 years, we will obtain such consent from the parent or guardian. We will obtain such consent from you in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language. As mentioned above, you further have the right to withdraw your consent.
If you are browsing our websites:
When you visit our websites for informational reasons, i.e. without registering for any of our provided services and without providing us with personal data in any other form, we automatically collect your IP address in order to provide you with our websites and to ensure system stability and efficiency and to implement proper safeguards as to the security of our websites and services. The personal data automatically collected is necessary to provide the websites, as far as this is necessary to operate our websites or our legitimate interest with regards to our use of technical information to enhance our systems, make your usage of the websites more convenient or ensure the security of our websites. This is based on our legitimate interest as the data used for these purposes are stored for a limited period only and we are generally not able to personally identify the user without larger efforts.
2. Cookies and Web Analytics
Some of our websites use Adobe Analytics, a web analytics service provided by Adobe Systems Software Ireland Limited (“Adobe”).
On behalf of the website provider, Adobe will use this information for the evaluation of your use of the website, compiling reports on website activity for website operators, and in order to provide other services relating to website activity and use of the Internet to the website provider. Adobe will not associate your IP address with any other data held by Adobe.
If you subscribe to our newsletter:
Where you have granted consent, we use your name, e-mail address, country and other data you provide voluntarily to send you our newsletter on our services and products as well as general information on tourism in Singapore. Such newsletters might include advertisement for third-parties; however your personal data will not be transferred to such parties. You may revoke consent granted at any time. We will delete your personal data for marketing purposes immediately after you object to the processing of your data or withdrawing the consent.
If you contact us or use our feedback forms:
If you have any questions, you want to make an enquiry, give compliments or submit a complaint, we offer you the opportunity to contact us using the forms provided on our websites or to contact our contact centre. Your name, e-mail address and place of residence and in some cases further contact details are required in order to process your request and follow up as required. The personal data will be processed for the purpose of contacting us to fulfil our obligations under a contract; or based on our legitimate interest to enhance your travel experience and improve our services, as required to follow up on your request, which may include the transfer to third parties as far as this is necessary to follow up on your request (e.g. when it concerns the business of other entities or legal bodies).
If you register for our portal:
If you register for our API application:
If you register for our API application we will process your name, e-mail address and country of residence as well as further provided information. We will do so to provide you with our API token and related services. The processing is based on the fulfilment of the respective agreement on the use of the API application as well as on our legitimate interest to provide you with the API and to improve traffic to and the visibility of our services.
If you are using our interactive kiosk:
We provide you with itinerary planning services through our interactive kiosk, and for this we require your name and e-mail address. The personal data is solely used for the provision of the services and will be deleted after your customised itinerary has been sent. The personal data will be processed based on our legitimate interest in enhancing your travel experience and promote travel to or through Singapore.
If you are applying for a grant:
If you are applying for a grant we will collect your name, company name, designation and other relevant data requested in the specific grant application. We will use such personal data only for the assessment and audit against the requirements in order to receive such grant. Your personal data will be processed for the fulfilment of the respective agreement (terms of application). We will delete any personal data after the process is finally closed and respective statutory obligations related to the storing of the information have expired (up to 5 years from the final date of use for the purposes above).
If you are participating in an event or program organised by STB:
If you are participating in an event or program organized by STB, we will collect your name and business contact information as well as other related business information in order to process your specific request or application. Your personal data will solely be processed for the fulfilment of the respective contract related to the specific event or program you are applying to.
If, in the course of such events, you provide us with your business card, we will use such contact details for the purpose you provided the business card for. The information will be added to our systems and stored for the purpose the business card was provided for. The processing of your personal data is based on our legitimate interest in delivering our services to you.
If you are participating in our survey:
If you participate in our surveys, we or our vendors (on our behalf) collect your name, e-mail address and further contact details for the purpose of fieldwork validation and data quality checks. All personal data is provided on a completely voluntary basis. From surveys conducted by our vendors, we will only receive aggregated data. The personal data is processed on the basis of our legitimate interest in order to enhance and improve our services.
If you take part in our contests:
If you take part in one of our contests, we will use the personal data you provide in order to execute such contest and to provide you with your prize. The processing is necessary for the fulfilment of the participation terms or in case these do not exist, processing is based on our legitimate interest in offering the services and promoting our services and tourism in Singapore.
If you nominate an individual/enterprise for an award:
If you want to nominate an individual or enterprise for one of our awards, we will process you name and e-mail address as well as the name of the person or entity you nominated for the purpose of assessing your nomination and in order to follow up on your nomination. Your personal data will be processed in order to fulfil our obligations under the participation terms.
If you apply for an internship or job opening:
If you apply for an internship or job opening, we will process the personal data you provide (e.g. resume data) only as far as necessary for the processing of your application. The legal basis for such processing is in connection with respective national laws; or in absence of such, in connection with the initiation of contract.
Processing personal data for regulatory or legal defence purposes:
Notwithstanding anything within this policy, we reserve the right to freely process your personal data for regulatory purposes under the statutory functions of STB or to defend ourselves against any legal claim. Examples of regulatory purposes include travel agent licensing, tourist guide licensing, and collection of cess for tourism events. We do so, on the basis of our legitimate interest in fulfilling our public obligations and statutory functions.
Updates to this policy:
We reserve the right to update this policy for reasons including but not limited to complying with relevant Singapore legislation, Singapore Government guidelines, regulatory directions and other requirements of a similar nature. Examples of these include future amendments to the Singapore Personal Data Protection Act 2012 or amendments to the Singapore Government Instruction Manual.
* ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.