SUMMARY
The Personal Data Protection Act of Singapore (the “PDPA”) establishes data protection laws that govern the collection, use and disclosure of Personal Data and came into effect on July 2, 2014. Zendesk is a recognized Infocomm Development Authority of Singapore (IDA) Data Intermediary as a Software-as-a-Service (SaaS) Service Provider (IDA Cloud Booklet 2015). As a Data Intermediary Zendesk complies with the Protection and Retention Limitation Obligations of the Act. Details are set out below.
BACKGROUND OF THE PDPA AND HOW IT APPLIES TO US
The following is a brief summary of how we comply with and/or relate to the specific laws and privacy protection principles established by the government of Singapore. The PDPA establishes data protection laws which govern the collection, use and disclosure of Personal Data (the “Data Protection Provisions”). Defined terms not defined herein shall have the meaning set for in our Privacy Policy.
Whether and to what extent the obligations imposed by the Data Protection Provisions apply depends on (i) whether we are operating in the capacity of a data principal or a data intermediary when Processing Personal Data in the provision of the Zendesk Service and/or Zopim Service (as applicable). “Processing” in relation to Personal Data under the PDPA means the carrying out of any operation or set of operations in relation to Personal Data, and includes recording, holding, organisation, adaptation or alteration, retrieval, combination, transmission, erasure or destruction.
| Activity | Applicability of Data Protection Provisions |
| Processes Personal Data when a Subscriber registers for an account for the Service or registers Agents to use the Service. | We are a data principal Processing Personal Data for these purposes. As the information collected constitutes “business contact information,” the obligations of the PDPA do not apply. |
Processes Personal Data through Subscriber’s use of the Service. We are a data intermediary for these purposes; and, we are only subject to the two obligations imposed by the Data Protection Provisions relating to the protection and retention of Personal Data.
OBLIGATIONS IMPOSED BY THE DATA PROTECTION PROVISIONS
The Data Protection Provisions generally require an organization (which term includes any individual, company, association or body of persons, corporate or unincorporated) to be responsible for Personal Data of individuals in its possession or under its control, and to develop and implement policies that are necessary to meet the following obligations:
The obligation to obtain, on or before the collection, the individual’s consent to the collection, use and disclosure of the individual’s Personal Data (the “Consent Obligation”).
The obligation to ensure that Personal Data is collected, used and disclosed only for purposes which consent was given or which a reasonable person would consider appropriate in the circumstances (the “Purpose Limitation Obligation”).
The obligation to notify the individual, on or before collection, use or disclosure, the purposes for which it is collecting, using and/or disclosing the individual’s Personal Data (the “Notification Obligation”).
The obligation to provide, upon the request of the individual, information about the ways in which the individual’s Personal Data has been or may have been used or disclosed in the year before the request, and allow the individual to correct his/her Personal Data (the “Access and Correction Obligation”).
The obligation to use reasonable effort to ensure that the Personal Data collected by or on its behalf is accurate and complete (the “Accuracy Obligation”).
The obligation to make reasonable security arrangements to protect the Personal Data and prevent unauthorised access, collection, use disclosure or similar risks (the “Protection Obligation”).
The obligation to cease retaining Personal Data or remove the means by which the Personal Data can be associated with an individual when the personal data is no longer necessary for business or legal purpose (“Retention Limitation Obligation”).
The obligation not to transfer Personal Data to a country or territory outside of Singapore except in accordance with the requirements under PDPA (“Transfer Limitation Obligation”).
The obligation to make information about its data protection policies, practices and complaints process available on request, and designating one or more individuals as its data protection officer to ensure that the organisation complies with the PDPA (“Openness Obligation”).
The PDPA applies only to Personal Data of individuals given in a personal capacity, for personal purposes and does not apply to “business contact information” which is defined in the PDPA as “an individual’s name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his personal purposes”. An organization is not required to obtain consent or otherwise comply with the PDPA in collecting, using or disclosing any business contact information disclosed in the course of a commercial transaction.
PERSONAL DATA PROVIDED BY SUBSCRIBERS TO US
Personal Data is collected when an Account is created by a Subscriber or when Agents are registered to use the Service. This information consitutes business contact information for purposes of the PDPA. In this regard, we are not required to obtain consent or comply with the Data Protection Provisions in relation to such Personal Data. We do, however as a matter of good business practices describe how we collect, use, disclose and Process this Personal Data in our Privacy Policy.
HOW WE COMPLY WITH THE PDPA AS A DATA INTERMEDIARY WITH REGARD TO PERSONAL DATA IN THE SERVICE
We act as a data intermediary in connection with the use of the Service by our Subscribers and their Agents. Data intermediaries who process Personal Data on behalf of other organisations are only required to comply with two obligations under the PDPA when Processing this Personal Data:
the Protection Obligation; and
the Retention Limitation Obligation
The Protection Obligation requires us to put in place appropriate administrative, physical and technical measures to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks to the Personal Data in our possession or under our control, regardless whether the Personal Data is stored in a central server, or on local storage media, or at facilities operated by a third party vendor. We utilize robust precautions to protect the confidentiality and security of the Personal Data within the Service, by employing technological, physical and administrative security safeguards, such as firewalls and carefully developed security procedures. These technologies, procedures and other measures are used in an effort to ensure that Personal Data is safe, secure, and only available to Subscribers and to those authorized to access such Personal Data. However, no internet, e-mail or other electronic transmission is ever fully secure or error free, so Subscribers should take care in deciding what information is transmitted, stored or hosted through the Service.
The Retention Limitation Obligation requires us to cease to retain Personal Data which is Processed or remove the means by which the Personal Data can be associated with particular individuals, as soon as it is reasonable to assume that the purpose for which the Personal Data was collected is no longer being served by retention of the Personal Data; and, the retention of the Personal Data is no longer necessary for legal or business purposes.
If you wish to make a complaint about the way we have handled your Personal Data (including if you think we have breached any applicable privacy laws), you may do so to our Privacy Officer in writing, by mail or email to the address or email address set out in the ‘Contact Us’ section of our Privacy Policy. Please include your full name, contact details and a detailed description of your complaint. Our Privacy Officer will acknowledge your complaint and respond to you regarding your complaint within a reasonable period of time. If you consider that we have failed to resolve the complaint satisfactorily, we will provide you with information about the further steps you can take.