[{"id":"459d6d4c-2d2f-41b5-8e66-ac719ebfb9d7","order":1,"text":"DATA PROTECTION POLICY","fontSize":"20","textAlign":"center","bold":true,"underline":false,"marginBottom":"5","cflou":false,"active":true,"displayConditions":[]},{"id":"68cfae64-a976-4071-8282-05f446058c4d","order":2,"text":"[Name of the organisation]","fontSize":"16","textAlign":"center","bold":false,"underline":false,"marginBottom":"25","cflou":false,"active":true,"displayConditions":[]},{"id":"cddcf558-e00a-4a2d-a491-80be03278fa5","order":3,"text":"This Data Protection Policy (the "Policy") is adopted by [Name of the organisation] (the "organisation"), which is a registered charity, in the course of its activities of [Main activities]. It sets out how the organisation complies with the Personal Data Protection Act 2012 (the "PDPA") when it collects, uses, discloses and protects personal data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[]},{"id":"1e81e29e-274f-4016-894e-f7e8056b5d0c","order":4,"text":"The organisation is registered with the Commissioner of Charities under charity registration number [Charity registration number].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[{"field":"b58a1276-c574-4449-86c6-ba89a4afc994","value":"a registered charity","type":"add","operator":"="}]},{"id":"24e8144c-eb88-4dea-82bb-04fb8659c7ce","order":5,"text":"The organisation holds Institution of a Public Character status under charity registration number [Charity registration number] and issues tax-deductible receipts for qualifying donations, which requires the collection of donors' identification numbers.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[{"field":"b58a1276-c574-4449-86c6-ba89a4afc994","value":"an Institution of a Public Character (IPC)","type":"add","operator":"="}]},{"id":"1a97d7c3-3eb6-4f80-8127-7686827d6851","order":6,"text":"The organisation is a non-profit body and processes personal data solely in the course of its non-commercial activities.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[{"field":"b58a1276-c574-4449-86c6-ba89a4afc994","value":"a society or other non-profit organisation","type":"add","operator":"="}]},{"id":"e5ce9fab-7737-465e-a5d8-cc80b4a12df1","order":7,"text":"1. Purpose and Scope","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S01"},{"id":"785e7999-d950-4263-8ee4-5f76a29c9b84","order":8,"text":"This Policy binds the members of the governing board, the staff and the volunteers of the organisation, and applies to the personal data of donors, volunteers, beneficiaries, members, employees and any other individuals whose personal data the organisation handles. It serves both as the internal rulebook of the organisation and as the statement of practices made available to the public under the PDPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"e0c6c575-9eb5-4e86-b886-f760a5448053","order":9,"text":"2. Personal Data We Collect","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S02"},{"id":"11251a01-3f71-40fe-989f-7bbf524cb191","order":10,"text":"The organisation collects personal data that is reasonable and necessary for its purposes, including, in particular: [Main categories of personal data]. Identification numbers are collected only where required, such as for the issue of tax-deductible donation receipts or where the law demands it. Particular care is applied to the personal data of beneficiaries, which may reveal sensitive personal or financial circumstances, and access to it is restricted to those who need it for their role.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"dbabadc4-b7c6-43ef-a8d2-36e68534a4f3","order":11,"text":"3. Purposes of Collection, Use and Disclosure","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S03"},{"id":"680f1855-5857-4111-af87-b6b591849121","order":12,"text":"Personal data is collected, used and disclosed for the following purposes: delivering the organisation's programmes and services to beneficiaries; processing donations and issuing receipts; managing and coordinating volunteers; administering membership; communicating with supporters about the organisation's work; meeting legal and regulatory obligations, including, where applicable, reporting to its regulators, such as the Commissioner of Charities, and to the tax authority; and organising events, including the taking of photographs and videos. Personal data is not sold, and it is not shared with third parties for their own marketing.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"dff9433d-ee53-44c8-ae0b-5520cbf03d15","order":13,"text":"4. Consent","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S04"},{"id":"c3043b69-8581-4a0c-a5ea-3ac4ae69ff20","order":14,"text":"The organisation collects personal data only with the consent of the individual, on or before collection, or where the PDPA otherwise permits it, such as where an individual voluntarily provides personal data for an obvious purpose. Fresh consent is sought before personal data is used for a purpose that was not notified at the time of collection. Where the individual is a minor or a beneficiary who cannot validly consent, consent is sought from a parent, guardian or authorised representative.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"92cadd85-9857-41d4-9414-bfa13b13029e","order":15,"text":"The following consent wording is used on donation, volunteering and registration forms: "I consent to [Name of the organisation] collecting, using and disclosing my personal data for the purposes set out in its Data Protection Policy, and I understand that I may withdraw my consent at any time."","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"d1266134-5a2a-4366-9df5-7c90e9508cf5","order":16,"text":"Where photographs or videos taken at events may identify individuals, the organisation seeks specific consent before publication and removes published content at the request of the individual concerned.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"260bbd35-4db6-49e6-a780-1c3fc7b6e0a4","order":17,"text":"5. Withdrawal of Consent, Access and Correction","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S05"},{"id":"d736f5f3-7705-44a5-8cb9-e470abe92fc3","order":18,"text":"An individual may withdraw consent at any time by writing to the Data Protection Officer at [DPO email]. The organisation gives effect to the withdrawal within a reasonable time, explains the likely consequences, and does not prohibit the withdrawal. Any individual may also request access to their personal data, or its correction; requests are answered as soon as reasonably possible, and where a response cannot be given within thirty (30) days, the organisation informs the requester in writing of the time by which it will respond. A reasonable fee may be charged for access requests and is notified in advance.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"f98e4a63-f02f-4005-b749-7cbd309265f1","order":19,"text":"6. Accuracy","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S06"},{"id":"d92c414c-124b-4ac6-aff3-c1292826ca28","order":20,"text":"The organisation makes a reasonable effort to ensure that personal data it collects is accurate and complete, in particular before it is used to make a decision affecting the individual or disclosed to another organisation.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"f4255e36-a34a-440b-8988-073227894aa4","order":21,"text":"7. Protection and Security","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S07"},{"id":"5d5cefa1-3298-4b19-99bc-a957d6e03a14","order":22,"text":"The organisation makes reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks. Access is limited to board members, staff and volunteers who need the data for their role; all of them are bound to confidentiality. Electronic records are protected by passwords and, where appropriate, encryption; paper records are kept under lock; devices and accounts used for the organisation's work are secured.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"0d079e87-7f61-4233-9427-62c5d2c1426b","order":23,"text":"8. Retention","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S08"},{"id":"9abcded4-5cdc-4733-ac50-b1f6cbce08a3","order":24,"text":"Personal data is retained only for as long as it is needed for the purposes for which it was collected or as required by law; donation and accounting records are kept for the periods required by tax and charities legislation. Retained data is reviewed at least once every year, and personal data that is no longer needed is securely destroyed or anonymised.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"aa2128e6-a7c5-4f09-b72a-9eff995af8f7","order":25,"text":"9. Transfers Outside Singapore","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S09"},{"id":"3e39b778-ef70-46fa-95a1-231d37ac0745","order":26,"text":"The organisation transfers personal data outside Singapore only where the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that of the PDPA, including through contractual clauses with providers of cloud, communication or payment services.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"81446dcc-d6b4-4505-9625-ac0a1e433634","order":27,"text":"10. Data Breach Management","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S10"},{"id":"c370c111-b21d-419b-90e7-662307d56110","order":28,"text":"Any suspected data breach is reported at once to the Data Protection Officer, who assesses and contains it without delay. Where the breach is notifiable, being a breach that results in, or is likely to result in, significant harm to the individuals concerned or that is of a significant scale, the organisation notifies the Personal Data Protection Commission within three (3) calendar days of determining that it is notifiable, and notifies the affected individuals where required. A register of all data breaches, whether notifiable or not, is maintained, together with the remedial action taken.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"1fc18e2b-7084-4f9c-b75d-64272818cefe","order":29,"text":"11. Fundraising and Marketing Communications","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"63106bc0-81f8-4a97-bfc4-8f46c0511f36","value":"yes","type":"add","operator":"="}],"marginTop":"20","sectionNum":"S11"},{"id":"4f64e4ff-86b5-438c-b56e-a44ecfde015c","order":30,"text":"Before making calls or sending text messages of a marketing or fundraising nature to Singapore telephone numbers, the organisation checks the Do Not Call Registry, unless the recipient has given clear and unambiguous consent in writing. Every such message identifies the organisation, and a working unsubscribe channel is provided; opt-out requests are honoured promptly and recorded.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[{"field":"63106bc0-81f8-4a97-bfc4-8f46c0511f36","value":"yes","type":"add","operator":"="}]},{"id":"8216e4bb-edba-4ef7-98de-59102f2d5354","order":31,"text":"Transactional messages, such as donation receipts, tax receipts and volunteer scheduling, are not marketing messages; the organisation keeps the two categories separate and applies this section only to the latter.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[{"field":"63106bc0-81f8-4a97-bfc4-8f46c0511f36","value":"yes","type":"add","operator":"="}]},{"id":"c495d6c9-a348-440d-ba7e-809a53e4a536","order":32,"text":"12. The Data Protection Officer","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S12"},{"id":"6da42a5c-dd1c-495e-99d5-02e1c595cbff","order":33,"text":"The organisation has designated [Name or designation of the DPO] as its Data Protection Officer, reachable at [DPO email] or [DPO telephone]. The Data Protection Officer ensures the organisation's compliance with the PDPA and with this Policy, handles requests, complaints, withdrawals of consent and breach reports, maintains the records required by this Policy, and arranges data protection training for staff and volunteers. These contact details are made available to the public.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"33c626f3-fe92-42cd-a39d-6a372feac088","order":34,"text":"13. Governance and Review","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S13"},{"id":"a628a4d9-726f-4907-afef-7d7f1c418f3d","order":35,"text":"The governing board oversees the implementation of this Policy. Staff and volunteers are briefed on it when they join and receive refresher training. The Policy is reviewed at least once a year, and whenever the law or the organisation's activities change materially. A breach of this Policy by a member of staff or a volunteer is treated as a serious matter and may lead to disciplinary or other appropriate action.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"15","cflou":false,"active":true,"displayConditions":[]},{"id":"73b32427-0aec-4719-9c76-1146643ef93e","order":36,"text":"14. Adoption","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[],"marginTop":"20","sectionNum":"S14"},{"id":"02e2841d-1e0d-41c7-bb02-fe4aeae82d8e","order":37,"text":"This Policy was adopted by the governing board of the organisation on [Date of adoption] and takes effect from that date. It replaces any earlier data protection policy of the organisation.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"25","cflou":false,"active":true,"displayConditions":[]},{"id":"f518bfba-5774-4b39-bc78-804d17227c9c","order":38,"text":"_______________________
[Name of the signatory]
[Role of the signatory], for and on behalf of [Name of the organisation]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"0","cflou":false,"active":true,"displayConditions":[]}]