Personal Data Protection And Privacy Policy

Version Date: 21 September 2023 (v1.4)

The privacy of your Personal Data is important to us and we are committed to accord the information the due level of care in compliance with the Personal Data Protection Act of Singapore (the “Act”).

By interacting with us, submitting information to us, using, purchasing or signing up for any promotions or goods or services offered by us including any new digital applications to access our services or communication tools, you agree and consent to ComfortDelGro Corporation Limited, its related corporations and affiliates, (collectively referred to herein as “CDG Group”, “us”, “we” or “our”), as well as our respective representatives collecting, using, disclosing and sharing amongst themselves your Personal Data, and disclosing such Personal Data to CDG’s authorised service providers and relevant third parties in the manner set forth in this Personal Data Protection and Privacy Policy (“Policy”). This Policy applies to our customers, passengers, agents, vendors, suppliers, partners, contractors and service providers (collectively “you”, “your” or “yours”). In addition, this Policy will also provide you with more information on the basis upon which we may lawfully collect, use, and/or disclose your Personal Data without your consent, where permitted by applicable law.

This Policy attempts to supplement but does not supersede nor replace any other consents you may have previously provided to us in respect of your Personal Data, and any consents you may have provided in connection with this Policy are cumulative and additional to any rights which we may have under applicable law to collect, use or disclose your Personal Data.

Personal Data

Personal Data refers to the personal data, as defined under the Act, obtained by us in the course of and as a result of the provision of any products and services by us to you. Such Personal Data collected, used and disclosed to us may include, but not limited to, your name, mailing address, telephone number(s), personal email address, NRIC number, payment-related information, location data (such as your geographical location) your images taken by us and any other information which you may have provided to us in any forms.

Collection of Personal Data

Personal Data may be collected from you in a number of ways, such as, but not limited to:

(a) when you use our products and/or services;
(b) when you visit us in our service centres, any of our transportation platforms, premises, roadshows or events hosted by us;
(c) when you ask us to provide a product or service over the telephone, social media or internet;
(d) provide information to assess your eligibility to provide services as our driver partner (such as your driver’s license information, vehicle information and background check results (as legally permissible));
(e) when you use, access and/or interact with us via any of our websites, mobile applications and/or other channels (the “Platforms”);
(f) when you submit any form, including but not limited to application, declaration or feedback forms;
(g) when your images are captured by us via CCTV cameras while you are within our premises;
(h) when you request that we contact you, be included in an email or other mailing list; or when you respond to our request for additional Personal Data;
(i) when you submit an employment application or when you provide documents or information in connection with the recruitment; and/or
(j) when you submit your Personal Data to us for any other reasons.

Where you disclose your Personal Data to us, you agree to be bound by this Personal Data Protection and Privacy Policy in respect of the Personal Data collected about you.

If you provide us with any Personal Data relating to a third party (e.g. information on your customers, spouse, children, parents, and/or employees), by submitting such information to us, you represent to us that you have obtained the consent of such third party to you providing us with their Personal Data for the respective purposes.

Purpose for Collection

We collect Personal Data for the purposes stated in this Policy. These purposes include, but are not limited to:

(a) providing you with our products and services, including to fulfil your requests for those products and services;
(b) engaging you to provide products and services;
(c) handling, responding to your request or enquiries and resolving complaints;
(d) receiving feedback and dealing with complaints and disputes;
(e) processing orders, payments, and administering accounts;
(f) providing customer support, such as service maintenance reminders;
(g) obtaining and sending quotations from different insurance companies;
(h) communicating with you and/ or any third parties (whose information is provided by you) in relation to any products and/ or services we provide which are relevant to your existing relationship with us in connection with any of the purposes stated in this Policy;
(i) offering you updated marketing and promotional packages you can benefit from, including products and services offered by our partners;
(j) product updates and upgrades;
(k) training and development, research and surveys, statistical analysis, and business strategy development;
(l) facilitate and carrying out due diligence checks (such as age, identity, credit and background checks);
(m) detecting or preventing fraud, unlawful or improper activities;
(n) meeting or otherwise complying with all applicable laws, including without limitation compliance, audit, regulatory and legal obligations and enforcing our corporate policies and legal rights; and/or
(o) any other purpose that may be made known by you or reasonably expected to be carried by us in order to provide you a service or engage with you.

Our products and services include ride-hailing or other transportation services (“Transportation Services”). When you access or use the Transportation Services, we may access and use your location to:

(a) facilitating and processing ride-hail bookings and requests for the Transportation Services (such as to determine your pick-up location); and/or
(b) detect and provide location-based discounts.

In addition, and without prejudice to the generality of the foregoing, and subject to applicable law, we may, with your consent (if required by law) collect, use, disclose and/or process your Personal Data for any of the following purposes:

(a) providing or marketing services, products and benefits to you, including promotions, loyalty reward, and/or similar programmes, including joint marketing and/or cross promotions with third parties;
(b) matching or combining Personal Data with other data collected for other purposes and from other sources (including third parties) in connection with the development, customisation, provision or offering of products, services, marketing or promotions, whether by the CDG Group, our service providers, and/or other third parties;
(c) administering contests and competitions, and personalising your experience at the CDG Group’s touchpoints;
(d) sending you details or products, services, special offers and rewards, either to our customers generally, or which we have identified may be of interest to you;
(e) conducting market research, or analysing and/or profiling your location, preferences, demographics, purchases, transactions, and/or behaviour so as enable us, our service providers, and/or third parties to design goods and/or services, understand customer behaviour, preferences and market trends, and to review, develop and improve the quality of goods and/or services, and/or to provide you with personalised goods and/or services (e.g. special offers and marketing programmes which may be relevant to your preferences and profile) and to enhance our goods and/or services for better customer experience;
(f) recommending, identifying and contacting you to inform you of products and services that are or may be relevant to you, including on behalf of third parties, or sharing your personal data with such third parties or their service providers for them to collect, use, disclose or process your personal data for such purposes; and
(g) collection, use, disclosure and/or processing of customer data by our business partners for data monetisation purposes.

In relation to particular products or services or in your interactions with us, we may also have specifically notified you of other purposes for which we collect, use, disclose and/or process your Personal Data. If so, subject to applicable law, we shall have the right to collect, use, disclose and/or process your Personal Data for such additional purposes as well unless we have specifically notified you otherwise.

We may for the purposes set out in this section, contact you via mail (including electronic mail), telephone, SMS or other communication (text or image) applications for mobile devices, and facsimile.

Platforms

If you access, download or use any of our Platforms, you agree we may collect, use, disclose and/or process your Personal Data for any of the following purposes:

(a) where the Platform includes subscription services, to process your application for these services;
(b) to maintain your account with us and to ensure your access of the Platform is within the scope of your subscription;
(c) to verify and process your personal particulars and payments in relation to provision of goods and services connected to the Platform;
(d) to provide you with the goods and services which you have signed up for and to push articles to you which may be relevant to you;
(e) communicating with you to inform you of changes and development to our policies, terms and conditions and other administrative information, including for the purposes of servicing you in relation to products and services offered to you;
(f) resolving complaints and handling requests and enquiries;
(g) conducting market research for statistical, profiling and statistical analysis for the improvement of services provided to you; and/or
(h) the processing of your Personal Data in relation to any of the purposes stated above.

Disclosure

Subject to applicable law, you hereby agree, acknowledge and consent that your Personal Data may be disclosed for any of the purposes listed above in this Policy (as applicable), to the following entities or parties, regardless whether they are located overseas or in Singapore:

(a) any of the CDG Group companies and affiliates;
(b) any agent, contractor or third-party service provider who provide services to the CDG Group, including Market Research Companies, insurers and reinsurers, as well as their respective employees, agents and/ or other third parties that any of the foregoing persons rely on to provide their respective services and products;
(c) any external business and charity partner in relation to corporate promotional events;
(d) any vendor or third-party business partner, including any vendor who offers goods and services or sponsor contests or other promotional programs on any Platform (whether in conjunction with us or not), advertisers and/or marketplace aggregators;
(e) any external business and charity partner in relation to corporate promotional events;
(f) the Credit Bureau Singapore, and/or in the event of default or disputes, any debt collection agencies or dispute resolution centres;
(g) any business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale);
(h) any person to whom we transfer or may transfer our rights and duties;
(i) banks, credit card companies and their respective service providers;
(j) our professional advisors such as our auditors and lawyers;
(k) relevant government regulators or authority or law enforcement agency to comply with any laws or rules and regulations imposed by any governmental authority;
(l) analytics, search engine providers or other third party service providers that assist us in delivering any of our products, services, and/or Platforms as well as improving and optimising the same; and/or
(m) any other party to whom we are authorised by you or by law to disclose your Personal Data.

Those external organisations are not authorised by us to use your Personal Data for anything other than the purpose(s) for which we supplied that information to them.

Direct Marketing / Marketing and Promotions

From time to time, we may contact you via mail, electronic-mail, telephone (call or SMS-Text) or facsimile, to inform about our products and services, or about special offers and promotions that we think may be of interest to you. You can let us know at any time if you no longer wish to receive marketing material (by unsubscribing from such marketing material or contacting the relevant Data Protection Officer indicated below) and we will remove your details from our direct marketing database.

We may also reach out to you through your Personal Data to market our partners’, sponsors’ and advertisers’ products, services, events or promotions by sending you newsletters, updates, mailers, promotional materials, special privileges, festive greetings; and invite and manage your participation in our events or activities.

We may communicate our publicity promotions by post, telephone call, short message service, online messaging service, push notification by hand and by email through the contact points you provided us. You may unsubscribe to the processing of your Personal Data for any of the marketing and promotions by clicking on the unsubscribe link in any email or message. Alternatively, you may also update your preferences via our apps.

We will not disclose your Personal Data to external organisations outside CDG and its related companies for the purposes of allowing them to directly market their products and services unless you have expressly indicated to us, otherwise. Unless permitted by law or overridden by other provisions, we will only disclose your Personal Data with your consent (implied or express), and we will also take reasonable steps to ensure the external organisation to whom we have disclosed your information are also legally bound to protect the privacy of your Personal Data.

Deemed Consent

In addition to the matters set forth above, subject to and in accordance with applicable law, you shall be deemed to have consented to us collecting, using, disclosing and sharing amongst ourselves your Personal Data, and disclosing such Personal Data to the Company’s authorized service providers and relevant third parties:

(a) where in response to a request for your Personal Data in connection with identified purposes, you voluntarily provide such Personal Data to us for such purpose(s) and it is reasonable that you would voluntarily provide such Personal Data; and
(b) where the collection, use or disclosure of your Personal Data is reasonably necessary for the conclusion and/or performance of a contract, between you and us or any other organisation entered into at your request, which may include recipients of your Personal Data not indicated in this Policy.

If any third party who has been duly authorised by you, provide or disclose your Personal Data to the Company voluntarily, you shall be deemed to have consented to the provision of your Personal Data by the third party and been notified of the purposes stated in this Policy for the collection, use and disclosure of your Personal Data.

The Company will not obtain express consent under the PDPA for collection, use or disclosure of your personal data under the following circumstances and exceptions:

(a) Personal data is publicly available.
(b) Personal data is disclosed by agency or disclosed to a public agency.
(c) Personal data is necessary for any investigation or proceedings.
(d) Personal data is necessary for legitimate interests.
(e) Personal data is necessary for business asset transaction.
(f) Personal data is necessary for the purpose that is clearly in the interest of individual or necessary to protect vital interest of individual.
(g) Personal data is necessary for business improvement, such as improving, enhancing, or developing new goods or services

Other Basis for Handling or Processing Your Personal Data

In addition to and without limiting the consents you have provided to our collection, use, and/or disclosure of your Personal Data for the purposes set out elsewhere in this Policy, where permitted by applicable law, we may also in accordance with the requirements thereof collect, use and/or disclose your Personal Data as further detailed below including without your consent, where we meet the requirements of applicable law:

(a) for our legitimate interests or the legitimate interests of another person, but not for sending you direct marketing messages unless you have otherwise provided your consent; and
(b) for CDG to collect your Personal Data from any of the CDG Group, for CDG to use your Personal Data, and for any of the CDG Group to disclose your Personal Data to CDG, for improving our products, services, processes or business, understanding customer preferences and personalised experiences and recommendations (whether you are an existing or prospective customer of any of the CDG Group).

Cookies Web Beacons and Other Technologies

Our Platform(s) may include technologies that automate the collection, use, disclosure, and/or processing of data (including your Personal Data). Such technologies may include cookies, web beacons and other web analytics. If you do not wish to have your data collected through such technologies you should disable the operation of these technologies on your devices (where possible), or refrain from using our Platform(s).

The CDG Group may also use independent companies and service providers (“Market Research Companies“), and our Platform(s) may be coded with software or other technologies to assist the Market Research Companies in measuring and analyzing the user behaviour across any of our Platforms, and to track visitors. For example, we may use the Market Research Companies’ services to collect the following information on the usage of our Platform(s), including without limitation: (a) the number of page views or page impressions that occur on our Platform(s); (b) the number of unique visitors to our Platform(s); (c) how long these unique visitors (on average) spend on our Platform(s) when they do visit; (d) common entry and exit points into our Platform(s); (e) user travel patterns; (f) location data (including geographical location); (g) time spent at a particular location, (h) quantity and value of transactions for purchases on our Platform(s); (i) user spending behavior; (j) user’s choice of goods and/or services purchased or used on our Platform(s); and (k) “dwell time” information. Such information is provided by the Market Research Companies to the CDG Group to assist the CDG Group in analysing the usage of our Platform(s).

You may change the settings on your device to block the use of cookies, web beacons and/or other web analytics. However, if you choose to block such technologies used in any of our Platforms, you accept that you may not be able to use certain features and functions available on our Platform(s).

Withdrawal of Consent

You may refuse to give or withdraw your consent for us to collect, use or disclose your Personal Data by giving us reasonable notice as long as there are no legal or contractual restrictions preventing you from doing so. Please note that if you withdraw your consent to any or all use of your Personal Data, depending on the nature of your request, we may not be in a position to continue to provide our products or services to you or administer any contractual relationship in place, and this may also result in the termination of any agreements with us and you being in breach of your contractual obligations or undertakings, and our legal rights and remedies in such event are expressly reserved. Withdrawing of such consent may also result in the termination of providing other services such as service reminders and keeping of records of our customer-management history.

Please note that if your Personal Data has been provided to us by a third party, you should contact such party directly to make any queries, feedback, and access and correction requests to CDG on your behalf.

Should you wish to withdraw your consent, please notify us by writing to our Data Protection Officer (“DPO”), the contact details are listed in the last paragraph of this policy. We may require up to 2 weeks, upon receipt of your request, for your request to take effect.

Access to and Correction of Personal Data

If you wish to make (a) a request for access to a copy of the personal data which we hold about you or information about the ways in which we use or disclose your personal data, or (b) a correction request to correct or update any of your personal data which we hold about you, you may submit your request in writing or via email to our Data Protection Officer.

Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request. We will respond to your access request as soon as reasonably possible. Should we not be able to respond to your access request within 30 days after receiving your request, we will inform you in writing via email within 30 days of the time by which we will be able to respond to your request.

If we are unable or not required to grant an access or correction request, we shall generally inform you of the reasons (except where we are not required to do so under the PDPA).

Ensuring Personal Data is Up-To-Date

We rely on the Personal Data we hold in conducting our business. Therefore, it is very important that the Personal Data we hold is accurate, complete and up-to-date. You shall ensure that all Personal Data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with products and services you have requested. Please
update us immediately if there is any change to the Personal Data you submitted to us.

Security of Personal Data

Security of Personal Data is very important to us and we take all reasonable precautions and care to protect your Personal Data from misuse, loss, unauthorised access, modification or disclosure.

Some of the ways we protect Personal Data include:

• external and internal premises security;
• restricting access to Personal Data only to staff who need it to perform their day to day functions;
• maintaining technology products to prevent unauthorised computer access or damage to electronically stored information, such as requiring identifiers and passwords, firewalls and anti-virus software; and
• maintaining physical security over paper records.

Retention

We will retain your Personal Data for a reasonable period for the purposes as cited herein or to the extent as may be required by law.

We will cease to retain your Personal Data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the Personal Data was collected, and retention is no longer necessary for legal or business purposes.

Transfers of Personal Data Outside of Singapore

We generally do not transfer Personal Data to countries outside of Singapore. However, if we do, we will do so according to the requirements under applicable law and we will take steps to ensure that your Personal Data continues to receive a standard of protection that is at least comparable to that provided under the PDPA.

Third-Party Sites

We are not responsible for the Personal Data policies (including Personal Data protection and cookies), content or security of any third party websites linked to any Platform.

Resolving Concerns

If you believe that the privacy of your Personal Data has been compromised, please contact us immediately and we will take the relevant steps to address your concerns.

Right to Amend the Policy

We reserve the right to amend this Policy from time to time at our sole discretion. If we make any changes to this Personal Data Protection and Policy and the way in which we use your Personal Data, we will update these changes on our websites. You agree that it is your responsibility to review the Policy regularly.

Contacting Our Data Protection Officer

For any questions relating to your Personal Data or about this Policy, you may contact any of our DPO at their respective email:

Governing Law

This Policy shall be governed in all respects by the laws of Singapore.