PDPA POLICY
CE Personal Data Protection Act (PDPA) Policy – Singapore (Revised since December 2017)
This data protection policy applies to Creative Eateries Pte Ltd (CE) and all its related companies in Singapore. This policy governs the collection, use and disclosure of personal data provided to Creative Eateries Pte Ltd (CE) and its related companies. It states the way of collection and utilization of personal data of individuals in compliance with the requirement(s) and regulation(s) of the Personal Data Protection Act 2012 of Singapore (PDPA). In this policy, the “Personal Data” used or mentioned shall have the meaning ascribed to it under the PDPA.
Collection of Personal Data
Personal Data will be collected from clients, customers, business partners, contacts, personnel, contractors, suppliers and other relevant individuals. Ways of collection may be through online or physical forms, verbal communication, email messages, phone calls, our webpages, publicly available sources, CCTV or provided by third parties with consent from the particular individual or from his/her authorized representatives. A record of personal data or contact may be kept in the contact history when you contact us through the aforementioned ways.
These personal data will be collected for business purposes or any purpose consented by the related individual during the point of collection.
Creative Eateries Pte Ltd (CE) and its related companies will only collect, hold, process, use, communicate and/or disclose such personal data, in accordance with this policy. If you are acting as an intermediary or otherwise on behalf of a third party or supply us with information regarding a third party (such as a friend, a colleague, an employee etc), you undertake that you are an authorised representative or agent of such third party and that you have obtained all necessary consents from such third party to the collection, processing, use and disclosure by us of their personal data. Because we are collecting the third party’s data from you, you undertake to make the third party aware of all matters listed in this policy preferably by distributing a copy of this policy to them or by referring them to our website.
Purpose and Notification of Purpose of Personal Data
Creative Eateries Pte Ltd (CE) and its related companies may collect, use and disclose your Personal Data for the following purposes:
responding to your queries and requests;
managing the administrative and business operations of CE and complying with internal policies and procedures;
facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales) involving any of the Companies;
matching any Personal Data held which relates to you for any of the purposes listed herein;
resolving complaints and handling requests and enquiries;
preventing, detecting and investigating crime and analysing and managing commercial risks;
providing media announcements and responses;
monitoring or recording phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation and identity verification purposes;
organising promotional events;
legal purposes (including but not limited to obtaining legal advice and dispute resolution);
conducting investigations relating to disputes, billing or fraud;
meeting or complying with any applicable rules, laws, regulations, codes of practice or guidelines issued by any legal or regulatory bodies which are binding on CE (including but not limited to responding to regulatory complaints, disclosing to regulatory bodies and conducting audit checks, due diligence and investigations); and
purposes which are reasonably related to the aforesaid.
Where permitted under the Personal Data Protection Act (the “Act”): –
CE may also collect, use and disclose your Personal Data for the following “Creative Eateries Additional Purposes”:
analytics and tracking;
conducting market research and surveys to enable us to understand and determine customer location, preferences and demographics to develop special offers and marketing programmes in relation to CE’s Products and Services, and to improve our service delivery and your customer experience at our touchpoints;
providing additional Products and Services and benefits to you, including promotions, loyalty and reward programmes from CE;
matching Personal Data with other data collected for other purposes and from other sources (including third parties) in connection with the provision, marketing or offering of Products and Services by CE;
leads generation and management for marketing CE’s Products and Services;
administering contests, competitions and marketing campaigns, and personalising your experience at CE’s touchpoints;
communicating to you advertisements involving details of our Products and Services, special offers and rewards, either to our customers generally, or of which we have identified may be of interest to you (including but not limited to upselling, cross selling and online marketing);
organising promotional events and corporate social responsibility projects; and
purposes which are reasonably related to the aforesaid.
In addition, where permitted under the Act and subject to the provisions of any applicable law, your Personal Data may be disclosed, for Creative Eateries’ Additional Purposes, to the vendors or other third-party service providers in connection with promotions, Products and Services offered by CE
CE may also collect, use and disclose your Personal Data for the following Additional Purposes:
conducting market research and surveys to enable us to understand and determine customer location, preferences and demographics to develop special offers and marketing programmes with our preferred partners;
matching Personal Data with other data collected for other purposes and from other sources (including third parties) in connection with the provision, marketing or offering of products and services (including promotions, loyalty and reward programmes) by our preferred partners;
leads generation and management for marketing the products and services offered by our preferred partners;
administering contests, competitions and marketing campaigns in connection with the products and services offered by our preferred partners;
communicating to you advertisements involving details of the products, services, special offers and rewards offered by our preferred partners, either to our customers generally, (including but not limited to upselling, cross selling and online marketing); and
purposes which are reasonably related to the aforesaid.
In addition, where permitted under the Act and subject to the provisions of any applicable law, your Personal Data may be disclosed, Additional Purposes, to the vendors or other third-party service providers in connection with promotions and services offered by CE’s preferred partners.
If you have provided your Singapore telephone numbers, CE may contact you using such Singapore telephone numbers (including via voice calls, SMSes, fax or other means) with information about our Products and Services or those products and services offered by our preferred partners (including discounts, flash sales and special offers).
In relation to particular Products and Services or in your interactions with us, we may also have specifically notified you of other purposes for which we collect, use or disclose your Personal Data. If so, we will collect, use and disclose your Personal Data for these additional purposes as well, unless we have specifically notified you otherwise.
Withdrawal of Consent
You may choose to unsubscribe from mailing lists, registrations, or elect not to receive further marketing information from us by contacting our Data Protection Officer, or if we have contacted you by email, you may use the unsubscribe function in that email to notify us. Please allow 30 days for your request to be processed.
If you withdraw your consent to any or all use of your Personal Data, depending on the nature of your request, we may not be in a position to continue to provide its Products and Services to you, administer any contractual relationship in place, which in turn may also result in the termination of any agreements with CE, and any breach of your contractual obligations or undertakings. CE’s legal rights and remedies in such events are expressly reserved.
Disclosure of Personal Data to Third Party
We do not disclose personal data to third parties except when required by law, when we have your consent or deemed consent or in cases where we have engaged the third party such as data intermediaries or subcontractors specifically to assist with our firm’s activities. Any such third parties whom we engage will be bound contractually (e.g. Non-Disclosure Agreement) to keep all information confidential, but we cannot and do not assume any responsibility for any actions or omissions of third parties.
We may disclose personal data to other related companies of Creative Eateries Pte Ltd (CE), where it is necessary (i) to meet the purpose for which you have submitted the information; or (ii) to enable you to be provided with information at a later date which may be of relevance and interest to you based on the nature and purpose of your voluntary requests.
We may also transfer all data in our possession to a successor-in-interest to our business or assets.
Subject to the provisions of any applicable law, your Personal Data may be disclosed, for the purposes listed above (where applicable), to the following:
CE’s related corporations and employees who provide content, Products and Services to you, address your questions and requests in relation to your customer accounts, subscription and billing or order arrangements with us as well as our Products and Services, to activate, deactivate, install, maintain and operate our systems and/or services;
companies who provide insurance and consultancy services to CE;
agents, contractors or third-party service providers who provide operational services to CE, such as courier services, telecommunications, information technology, payment, printing, billing, payroll, processing, technical services, training, market research, call centre, security (CCTV) or other services to CE;
vendors or third-party service providers who provide marketing promotions and services offered by CE or its preferred partners;
commercial shops and retailers who provide rewards and benefits in partnership with CE;
any business partner, investor, assignee or transferee (actual or prospective) who facilitates business asset transactions (which may extend to any merger, acquisition or asset sale) involving any of the companies under the CE which we are part of;
our professional advisers such as auditors and lawyers;
relevant government regulators, statutory boards or authorities or law enforcement agencies to comply with any laws, rules, guidelines and regulations or schemes imposed by any governmental authority; and
any other party to whom you authorise us to disclose your Personal Data to.
Access to and Correction of Personal Data
Upon request, we will provide the individual with access to their personal data or other appropriate information with regards to their personal data in accordance with the requirements of the PDPA.
Upon request, we will correct an error or omission in the individual’s personal data that is in our possession or control in accordance with the requirements of the PDPA.
We may induce a reasonable charge for a request for access or correction of personal data in accordance with the requirements of the PDPA.
Accuracy of Personal Data
We will make a reasonable effort to ensure that personal data collected by us or on our behalf is accurate and complete.
Security and Protection of Personal Data
We have implemented generally accepted standards of technology and operational security to protect the personal data in our possession or under our control and to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks.
Retention of Personal Data
We will cease to retain personal data, as soon as it is reasonable to assume that the purpose for collection of such personal data is no longer being served by such retention, and such retention is no longer necessary for legal or business purposes.
A schedule, which defines the respective retention limitations for data held and controlled by CE’s various departments is put in place as follows:
Marketing related Personal Data: Up to 10 years
Human Resource related Personal Data: 3 – 7 years
Orders, Sales and Payment related Personal Data: Up to 10 years
CE reviews documents from each department on an annual basis to determine which Personal Data are to be retained or disposed.
Disposal of Personal Data
Disposal methods includes shredding of hard copies and permanent deletion of electronic data in our system. CE ensures that disposal of personal data is considered completed only when the document is fully destroyed and cannot be recovered by any means.
Transfer of Personal Data outside of Singapore
CE do not transfer Personal Data overseas. In circumstances that we do, we will ensure that any transfers of personal data to a territory outside of Singapore will be in accordance with the PDPA so as to ensure the standard of protection of personal data in the territory it is transferred to is comparable to that of the PDPA in Singapore.
Privacy on our Webpages (Cookies and log files)
This Policy also applies to any personal data we collect via our websites. Cookies may be used on some pages of our websites. “Cookies” are small text files placed on your hard drive that assist us in providing a more customised website experience. Cookies are now used as a standard by many websites to improve users’ navigational experience. If you are concerned about cookies, most browsers permit individuals to decline cookies. In most cases, a visitor may refuse a cookie and still fully navigate our websites, however other functionality in the site may be impaired. After termination of the visit to our site, you can always delete the cookie from your system if you wish.
We also ensure auto-fill function (esp. for sign in and sign up pages) has been disabled, and incognito function has been activated to ensure privacy of guests and visitors to the website.
Because we want your website experience to be as informative and resourceful as possible, we may provide a number of links to third party websites. We assume no responsibility for the information practices of these third-party websites that you are able to access through ours. When a visitor to our website links to these third-party websites, our privacy practices no longer apply. We encourage you to review each website’s privacy policy before disclosing any data.
Marketing Data Protection Policy
The privacy of information you provide in this form is important to us. The following privacy statement governs the collection and, use and disclosure of personal data submitted to Creative Eateries Pte Ltd (CE) and its related companies which are established in Singapore. The company’s information handling practices are in accordance with current privacy and data protection legislation in Singapore.
Ways of Collection of Personal Data
Submission of online or physical forms for registering as a customer on our website or any other platforms relating to any of our Products and Services
Interaction with our staff personnel, for example, via telephone calls, letters, face-to-face meetings and emails
Post-usage of some of our services, for example, websites and applications which include establishing any online accounts with us
Requests for us to contact you, be included in an email or other mailing list
Responses to our promotions, initiatives or to any request for additional Personal Data
Photos and videos taken at our premises for social media/publications (guests/customers will be notified on the purpose at the point of collection)
When you are contacted by, and respond to, our marketing representatives and customer service team;
References received from business partners and third parties, for example, where you have been referred by them; or
Submission of your Personal Data to us for any other reasons.
Reason for Collection of Personal Data
The personal data submitted in the above forms will be used by CE and its related companies for the purposes of any relevant promotional activities organised by the company such as, but not limited to, reservations, membership sign-ups, mailing lists, feedback, promotions, competition, social media posts and lucky draws.
Purpose of collection will be notified to customers at the point of collection.
By submitting the information through the above-mentioned forms, you acknowledge that you have consented to our processing data in accordance with the privacy statement for the purposes described.
Retention of Personal Data
Personal data that is kept by us will be destroyed after a reasonable period (up to 10 years) from the time when it becomes outdated or is no longer required for the purpose for which it was collected or when we receive your request to delete it.
Retained data may be used for purposes such as to conduct data insights, market research, customer base review, reservicing of returning members/customers and members and also to review restaurants’ performances.
Security and Protection of Personal Data
The personal data submitted to us is stored in our contacts database or similar system and is available to only authorized partners and staff, and contractors and vendors. Access to Your Personal Data If you wish to access, delete or correct your personal data provided to us or if you have any concerns about how we handle information about you, please contact our Data Protection Officer, Bernadette Wong, at DPO@createries.com or at 6411 4990.
Withdrawal of Consent
Should you wish to withdraw your consent for us to send you sales, marketing or promotional information via a specific mode, please inform us in the following manner:
to withdraw consent from receiving SMS promotions: please unsubscribe by following the steps provided in the promotional SMS;
to withdraw consent from promotional emails: please click on the “Unsubscribe” link in the promotional emails
Please be aware that once we receive confirmation that you wish to withdraw your consent for marketing or promotional materials/communication, it may take up to thirty (30) days for your withdrawal to be reflected in our systems. Therefore, you may still receive marketing or promotional materials/communication during this period of time.
Please note that even if you withdraw your consent for the receipt of marketing or promotional materials through a specific mode, we may still contact you for other purposes in relation to the Products and Services that you have requested from or subscribed with CE.
Otherwise than stated above, if you wish to withdraw any consent given in respect of the collection, use or disclosure of your Personal Data, please contact our Data Protection Officer (“DPO”), Bernadette Wong, at DPO@createries.com or at 6411 4990. Please note that such withdrawal of consent may affect our ability to provide our Products and Services you have requested or may request in the future.
Disclosure of Data to Third Parties
The personal data submitted will not be disclosed to third parties except when required by law, when we have your explicit consent or in cases where the third party is a contractor or supplier whom we have engaged specifically to assist with the company’s activities. All such contractors will be bound contractually (e.g. Non-Disclosure Agreement) to keep all information confidential, but we cannot and do not assume any responsibility for any actions or omissions of third parties.
We do not transfer any personal data across borders to overseas territories.
Access and Correction of Personal Data
Access to your personal data can be done through the membership portal with members’ log in details. Corrections of Personal Data such as Name, Contact Number, Email Address, Mailing Address and etc., can be done with immediate effect through the personalized portal provided by CE’s third-party CRM vendor, who is bounded contractually to keep all personal data confidential. However, we cannot and do not assume any responsibility for any actions or omissions of third parties.
Recruitment Data Protection Policy
Creative Eateries Pte Ltd (CE) and its related companies which are established in Singapore believe that privacy is an important individual right and this policy provides information regarding our use and disclosure of personal data collected from individuals including via our websites for recruitment purposes. The company’s information handling practices are in accordance with current privacy and data protection legislation in Singapore.
Ways of Collection of Personal Data
Application Forms
Resume Collection via email and
Applicants (Part-timers) NRIC and bank details via email, physical meeting and other communication forms
Reasons for Collection of Personal Data
As part of our recruitment process, we collect necessary personal data about you to consider you for employment with our firm. During the course of the recruitment and selection process, we may request further information about you to assess your suitability for positions with our firm. In doing so, we only collect personal data that is necessary for recruitment decisions. The procedures used by the firm to gather further information about you might include:
selection interviews;
referee reports on request;
necessary pre-employment activities.
References from your current or former employer(s) or other sources will only be obtained with your verbal and written consent. In some cases, pre-employment checking may be necessary. Any checking is “tailor-made” and the extent and nature of information sought is no more than is justified by the particular position being filled. Failure to provide requested information may influence the processing and outcome of your application.
Ways of Utilization of Personal Data
We use the personal data for the primary purpose of considering your suitability for positions with us. Only that information which is relevant to the purpose of assessing your suitability is collected and use. We will not collect or use personal data in ways other than as described in this policy unless we have obtained your consent. In some cases, we may specifically request a consent form to be signed. In other cases, consent may be implied (for instance, you give us information after being fully advised of how it will be used).
After applicant is employed as one of CE’s staffs, personal data collected will then be used for all necessary employment-related activities.
Retention of Personal Data
Generally, we hold used recruitment information for specific vacancies for up to three months. To request us to delete your personal data submitted to CE whether through our websites or otherwise, please send your request to DPO@createries.com.
Employees personal data are retained for three to seven years before disposal. Disposal methods includes shredding of hard copies and permanent deletion of data in our system.
Disclosure of Personal Data
Your personal data will be used only by partners and staff directly involved in the recruitment process. Information will not be disclosed to third parties except when required by law, when we have your explicit consent or in cases where the third party is a contractor or supplier whom we have engaged specifically to assist with our company’s activities. All such contractors will be bound contractually to keep all information confidential.
Transfer of Data to Overseas
CE do not transfer Personal Data overseas. In circumstances that we do, we will ensure that any transfers of personal data to a territory outside of Singapore will be in accordance with the PDPA so as to ensure the standard of protection of personal data in the territory it is transferred to is comparable to that of the PDPA in Singapore.
Security and Protection of Personal Data
We keep your personal data secure and make it accessible to partners and staff on a need to know basis. The information you provide in your online application is stored into our recruitment database. CE has implemented generally accepted standards of technology and operational security in order to protect personal data from loss, misuse, alteration or destruction. All CE staff follow a firm wide security policy which is stated in our employment letter. Only authorized CE personnel are provided access to personal data and these employees have agreed to ensure confidentiality of this information, but we cannot and do not assume any responsibility for any actions or omissions of third parties.
Access and Correction of Personal Data
Access to your personal data can be made by request to us unless granting access would infringe another person’s privacy. If you wish to gain access to your personal data, please send your request to DPO@createries.com.
If you believe that information we hold about you is incorrect, if you have concerns about how we are handling your personal data, or if you changed your mind about our usage of your data, please email us at DPO@createries.com and we will try to resolve those concerns. Please allow 30 days for your request to be processed.
Orders, Sales and Payment Data Protection Policy
Creative Eateries Pte Ltd and its related companies which are established in Singapore believe that privacy is an important individual right and this policy provides information regarding our use and disclosure of personal data collected from individuals including via our websites for recruitment purposes. The company’s information handling practices are in accordance with current privacy and data protection legislation in Singapore.
Ways of Collection and Types of Personal Data
Suppliers bank details via email
Customers’ credit card details via email
Employees bank details via email for claims, payroll and petty cash reimbursements
Backend database of sales order
Credit Term Forms
Reason for Collection of Personal Data
Tracking and recording of orders through our sales/ordering platform
Tracking of reservations through our reservation system
Payment and receiving purposes
Invoicing and billing purposes (to suppliers, from customers, etc.)
Any necessary accounting collation or auditing purposes
Retention of Personal Data
We will cease to retain personal data, as soon as it is reasonable to assume that the purpose for collection of such personal data is no longer being served by such retention, and such retention is no longer necessary for legal or business purposes. Retention period of personal data collected is up to five years.
Disposal of Personal Data
Disposal methods includes shredding, burning of hard copies and permanent deletion of data in our system.
Security and Protection of Personal Data
The personal data are only accessed by authorized personnel internally. We have implemented generally accepted standards of technology and operational security to protect the personal data in our possession or under our control and to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks.
Contacting us – Data Protection Officer
If you:
have any questions or feedback relating to your Personal Data or our Data Protection Policy;
would like to withdraw your consent to any use of your Personal Data as set out in this Data Protection Policy; or
would like to obtain access and make corrections to your Personal Data records, please contact us as follows:
Data Protection Officer: Bernadette Wong
Email: DPO@createries.com
Telephone Number: 6411 4990
Please note that if your Personal Data has been provided to us by a third party (e.g. a referrer, a vendor), you should contact that organisation or individual to make such queries, complaints, and access and correction requests to Creative Eateries Pte Ltd (CE) on your behalf.
Modifications of Personal Data Protection Policies
We reserve the right to modify or amend this Policy and its sub-parts at any time. The effective date will be displayed at the beginning of this Policy. To keep you informed, we will notify changes to this Policy by prominently identifying the alteration for a period of not less than two weeks on our related webpages.
Governing Law
This Personal Data Protection Policy and your use of this website shall be governed by and construed in all respects in accordance with the laws of the Republic of Singapore. You shall submit to the non-exclusive jurisdiction of the Singapore courts.