1. About CSRWorks and this Policy
CSRWorks International Pte Ltd (“CSRWorks”, “we”, “us” or “our”) is incorporated in Singapore. We are responsible for personal data covered by this Policy.

Where we process personal data solely on behalf of a client and under its instructions, the client determines the purposes for which the personal data is collected, used or disclosed. Requests concerning such personal data may need to be directed to the client, although we will provide reasonable assistance where required.

For the purposes of the PDPA, “personal data” means data, whether true or not, about an individual who can be identified from that data alone or together with other information to which an organisation has or is likely to have access.

Our business contact details are set out in Section 12.

2. Personal data we collect
The personal data we collect depends on the nature of our relationship and may include:

• identity and contact details, such as name, email address, telephone number, postal address and signature;
• professional and organisational details, such as employer, job title, department, qualifications, experience and professional interests;
• client, supplier and transaction information, including enquiries, proposals, contracts, purchase orders, invoices, payment records, correspondence and project records;
• training and event information, including registration details, attendance and participation records, assessment results, certificate information, grant or subsidy information, accessibility or dietary requirements, and photographs, audio or video recordings;
• website and technical information, such as internet protocol address, browser and device information, website activity, security logs and cookie information;
• marketing and communication preferences; and
• recruitment information, including curriculum vitae, employment history, qualifications, references, interview and assessment information, and right-to-work information.

We collect only personal data that is reasonably necessary for the relevant purpose. Where information may be more sensitive, such as health or accessibility information, we limit its collection and access to what is reasonably required.

3. How we collect personal data
We may collect personal data:

• directly from you through forms, registrations, contracts, emails, telephone calls, meetings, surveys, assessments, websites and online platforms;
• from your employer, course sponsor, client, colleague, authorised representative, recruitment agency or reference provider;
• from certification or accreditation bodies, funding authorities, event partners and service providers;
• from publicly available professional and company sources;
• automatically through website, platform and system logs, cookies and similar technologies; and
• through photographs, screenshots, audio or video recordings where appropriate notice has been provided.

If you provide personal data about another individual, you should ensure that you are authorised to do so and, where required, have informed that individual of the relevant purposes.

4. Purposes for collection, use and disclosure
We may collect, use or disclose personal data for the purposes set out below.

4.1 Services and business administration

• responding to enquiries and preparing proposals, quotations, contracts and service documentation;
• delivering and managing consulting, advisory, assurance, verification, training and other professional services;
• communicating with clients, participants, suppliers, partners and other stakeholders;
• managing projects, meetings, deliverables, access permissions, payments, invoices, refunds and financial records;
• conducting due diligence, audits, risk management, compliance and internal administration; and
• establishing, exercising or defending legal rights and complying with applicable laws and lawful requests.

4.2 Training, assessment, certification and funding

• processing registrations and determining prerequisites or eligibility;
• providing course materials, platform access, joining instructions and participant support;
• verifying identity, attendance, participation and completion of minimum training hours;
• administering assessments, assignments, results and academic integrity;
• issuing, amending or verifying certificates;
• meeting accreditation, audit and quality-assurance requirements;
• supporting grant, subsidy, reimbursement or sponsorship applications and claims; and
• providing relevant records to an employer, sponsor, client, accreditation body, funding authority or auditor where reasonably required.

4.3 Events, communications and recruitment

• administering webinars, conferences, awards, roundtables and other events;
• managing speakers, panellists, judges, sponsors, partners and attendees;
• sending requested information, publications, newsletters, event invitations and service or programme updates;/li>
• managing communication preferences and unsubscribe requests;
• operating, securing, maintaining and improving our websites, platforms and systems; and
• evaluating job applications, conducting interviews and reference checks, and administering recruitment decisions and offers.

5. Consent and new purposes
We collect, use and disclose personal data with consent, where consent is deemed under the PDPA, or where collection, use or disclosure without consent is permitted or required under the PDPA or another applicable law.

We will notify you of the purposes for collecting, using or disclosing personal data on or before the relevant collection, use or disclosure. If we intend to use or disclose personal data for a materially different purpose, we will provide additional notice and obtain consent where required.

You should provide complete and accurate information where it is reasonably required to deliver a service, verify attendance, issue a certificate, meet accreditation requirements or process a funding claim. If necessary information is not provided, we may be unable to provide the relevant service or benefit.

6. Training, events, photography and recordings
6.1 Attendance verification
Participants may be required to complete attendance checks or keep their cameras switched on during all or specified parts of a virtual or hybrid training programme. This may be necessary to verify identity, attendance and participation, confirm minimum training hours, determine certificate eligibility, meet accreditation or audit requirements, or support a grant, subsidy or reimbursement claim.

Attendance evidence may include sign-in and sign-out records, platform reports, login and logout times, screenshots, camera-based visual verification, polls, chat or microphone participation, assessment records, photographs and relevant recordings. Such evidence may be disclosed to an employer, sponsor, client, accreditation body, funding authority or auditor where reasonably required for these purposes.

6.2 Operational recordings
With consent, where consent is deemed under the PDPA, or where otherwise permitted under the PDPA, we may record all or part of a programme or event for course access, administration, attendance verification, assessment, quality assurance, trainer development, complaint handling, security, accreditation or other purposes directly related to the administration or delivery of the relevant programme. We will provide reasonable notice before or when recording begins.

6.3 Marketing and promotional use
CSRWorks may take photographs or selected video clips for use on our website, social media channels, brochures, proposals, presentations and other communications. We will provide notice and obtain consent where required under the PDPA.

A participant who does not wish to be identifiable in marketing or promotional material should notify CSRWorks during registration or before photography or recording begins. We will make reasonable arrangements to respect the preference. Separate consent will be obtained before using an identifiable individual in a planned interview, testimonial, case study, close-up or featured promotional recording.

A preference not to appear in marketing material does not remove an attendance-verification requirement that is reasonably necessary for certification, accreditation, audit or funding purposes.

7. Disclosure of personal data
We may disclose personal data where reasonably necessary for the purposes described in this Policy, or where permitted or required by law, to:

• CSRWorks directors, employees, consultants, trainers, assessors and authorised personnel;
• clients, employers, course sponsors and authorised representatives;
• certification, accreditation, professional and funding bodies;
• banks, payment processors, insurers, auditors, legal advisers, accountants and other professional advisers;
• website, hosting, cloud, email, videoconferencing, learning-platform, security and other service providers;
• venues, event organisers and other suppliers supporting service delivery;
• government agencies, regulators, courts and law-enforcement bodies; and
• other parties authorised by you or permitted under the PDPA or another applicable law.

Where service providers process personal data on our behalf, we take reasonable steps to ensure that they protect it and use it only for the agreed purposes.

8. Marketing communications and cookies
We may send information about our services, training programmes, events and publications where you have requested or consented to receive it, or where the communication is otherwise permitted under the PDPA. You may unsubscribe from marketing emails through the unsubscribe link or by contacting us.

Where the Do Not Call provisions of the PDPA apply to marketing messages sent to Singapore telephone numbers, we will comply with the applicable requirements.

Our websites may use cookies, logs and similar technologies to operate and secure the websites, remember preferences, understand website use and improve content. Where these technologies collect personal data, we will notify users of the relevant purposes and obtain consent where required under the PDPA. You may control cookies through your browser settings, although this may affect website functionality.

9. Accuracy, protection and retention
We take reasonable steps to ensure that personal data is accurate and complete where it is likely to be used to make a decision affecting an individual or disclosed to another organisation.

We maintain reasonable administrative, physical and technical safeguards to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, loss, disposal or similar risks.

We retain personal data only for as long as it is reasonably necessary for the relevant business or legal purpose. When retention is no longer necessary, we will cease retaining the personal data or remove the means by which it can be associated with an individual, unless continued retention is required or permitted by law.

10. Transfers outside Singapore
CSRWorks operates internationally and may use service providers, platforms, trainers or advisers located outside Singapore. Where personal data is transferred outside Singapore, we will take appropriate steps to ensure that it receives a standard of protection comparable to that required under the PDPA.

11. Access, correction and withdrawal of consent
Subject to the PDPA and its applicable exceptions, you may:

• request access to personal data about you that is in our possession or under our control, and information about how it has been used or disclosed during the one-year period before the date of your request;
• request correction of inaccurate or incomplete personal data; and
• withdraw consent previously provided for the collection, use or disclosure of personal data by giving reasonable notice.

We may need to verify your identity and clarify the scope of a request. A reasonable fee may be charged for an access request, and we will provide an estimate before processing the request. We will respond as soon as reasonably possible. If we are unable to complete the request within 30 days after receiving it, we will inform you in writing of the time by which we expect to respond.

Withdrawal of consent does not affect collection, use or disclosure that occurred before the withdrawal or that remains permitted or required under the PDPA or another applicable law. We will explain any likely consequences of withdrawal. For example, withdrawal relating to information needed for attendance verification, certification, accreditation or funding may affect our ability to provide the relevant service, certificate or claim support.

12. Contacting our Data Protection Officer
Questions, requests, complaints or concerns about this Policy or our handling of personal data may be directed to our Data Protection Officer:

We will review and respond to your enquiry or complaint in accordance with the PDPA. You may also contact the Personal Data Protection Commission of Singapore if you are not satisfied with our response.

CSRWorks International Pte Ltd | www.csrworks.com