Data Protection Notice

Effective date: 24 April 2026
Last updated: 24 April 2026

1. About this Notice

This Data Protection Notice (“Notice“) sets out how the People Profilers group of companies (“People Profilers“, “we“, “us“, or “our“) collects, uses, discloses, retains, and protects personal data across our operations in Singapore, Malaysia, Thailand, Vietnam, and Indonesia.

This Notice applies to personal data in our possession or under our control, including personal data held by third-party organisations we have engaged to collect, use, disclose, or process personal data on our behalf.

By providing personal data to us, or by continuing to use our services, you acknowledge that you have read and understood this Notice.

2. The People Profilers Group & Your Data Controller

Depending on which of our websites, offices, or services you interact with, the specific legal entity that acts as the data controller of your personal data will be one or more of the following group companies:

In general, the country site or office through which you engage our services determines the primary data controller. Where our group companies share personal data among themselves to deliver services, we act as joint controllers.

3. Applicable Data Protection Laws

This Notice is designed to comply with, and should be read alongside, the following laws and any implementing regulations:

• Singapore: Personal Data Protection Act 2012 (“SG PDPA”)
• Malaysia: Personal Data Protection Act 2010 (“MY PDPA”)
• Thailand: Personal Data Protection Act B.E. 2562 (2019) (“TH PDPA”)
• Vietnam: Decree No. 13/2023/ND-CP on Personal Data Protection (“VN PDPD”) and subsequent legislation
• Indonesia: Law No. 27 of 2022 on Personal Data Protection (“UU PDP”)

Where any provision of this Notice is inconsistent with the mandatory requirements of applicable local law, the local law shall prevail for the relevant jurisdiction.

4. Personal Data We Collect

Depending on the nature of your interaction with us, we may collect the following categories of personal data:

• Identification data: full name, photograph, date of birth, gender, nationality, marital status, and government-issued identification numbers (e.g. Singapore NRIC/FIN, Malaysian MyKad, Thai National ID, Vietnamese CCCD/CMND, Indonesian KTP/NIK, or passport number).
• Contact data: residential address, email address, mobile and landline telephone numbers.
• Employment and professional data: CV/resume, employment history, educational qualifications, professional certifications, salary history, references, work authorisation and visa status.
• Financial data: bank account information, tax identification numbers, and payroll data.
• Technical and usage data: IP address, device and browser information, cookies, and interaction data collected automatically when you visit our websites.
• Sensitive personal data: where required for specific services and permitted by law, we may collect data relating to health, disability, or criminal records (for background screening with your explicit consent).

We collect personal data directly from you, from authorised third parties, and automatically through our digital services.

5. Purposes for Which We Use Personal Data

We may collect, use, and disclose your personal data for any or all of the following purposes:

• Recruitment, executive search, contract staffing, and placement services (in-house and on behalf of client employers)
• Employer of Record (EOR), payroll, and HR outsourcing services, including salary disbursement, tax filings, and statutory contributions
• HR advisory, outplacement, and global mobility services including work pass / visa applications
• Verifying your identity and eligibility to work
• Conducting background and reference checks (where permitted by law and with your consent where required)
• Performing contractual obligations to you or to our clients
• Responding to your queries, requests, applications, complaints, and feedback
• Managing our relationship with you as a candidate, client, vendor, or visitor
• Processing payments and credit transactions
• Sending you marketing communications about our services, events, and job opportunities (with your consent where required)
• Complying with applicable laws, regulations, codes of practice, and lawful requests from regulatory, tax, and law-enforcement authorities
• Sharing personal data among People Profilers group entities to coordinate regional recruitment and HR services for multinational clients
• Other purposes reasonably incidental to, or related to, the above

6. Legal Bases for Processing

We rely on the following legal bases, as applicable under the relevant jurisdiction:

• Consent — where you have provided voluntary, specific, and informed consent.
• Contract performance — where processing is necessary to perform a contract with you.
• Legal obligation — where we are required by law to collect, retain, or disclose certain data.
• Legitimate interests — where processing is necessary for our legitimate business interests (where recognised).
• Vital interests — in emergencies involving life, health, or safety.
• Public interest / legal proceedings — where required for investigations, court proceedings, or national interest.

7. Disclosure of Personal Data

We may disclose your personal data to: our group companies, our clients (with your knowledge and consent where required), third-party service providers and agents engaged to support our operations, government and regulatory authorities where required by law, professional advisers and auditors, and acquirers or successors in the event of a merger, acquisition, or sale of all or part of our business.

8. Cross-Border Data Transfers

Because we operate across five Southeast Asian countries, your personal data may be transferred to and processed in jurisdictions other than the one in which you are located. Such transfers are subject to the cross-border transfer requirements of the applicable law, which may include ensuring the recipient jurisdiction provides a comparable standard of protection, entering into binding contractual arrangements (e.g. data transfer agreements, standard contractual clauses), or obtaining your explicit consent where required (e.g. under VN PDPD and UU PDP).

9. Data Retention

We retain personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by applicable laws. When personal data is no longer required, we will securely delete, destroy, or anonymise it.

10. Your Rights

Subject to the applicable law in your jurisdiction, you have rights including: access to your personal data, correction of inaccurate data, withdrawal of consent, objection to or restriction of processing, data portability, erasure, and the right to lodge a complaint with the data protection authority in your country.

To exercise any of these rights, please contact our Data Protection Officer using the details below. We will respond within the timeframes required by the applicable law (generally 30 days).

11. Withdrawing Your Consent

You may withdraw your consent at any time by submitting a written request to our Data Protection Officer. We shall generally process withdrawal requests within ten (10) business days of receipt. Please note that withdrawing consent may prevent us from continuing to provide our services to you.

12. Data Protection Officer & Contact

Our Group Data Protection Officer is the primary point of contact for all data protection matters across our five markets:

• Email: dpo@peopleprofilers.com
• Mailing address: Data Protection Officer, People Profilers Pte. Ltd., 20 Cecil Street #08-09 Plus, Singapore 049705

If your enquiry relates to services provided by a specific country entity, please indicate this in your correspondence.

13. Regulatory Authorities

If you believe we have not handled your personal data in accordance with applicable law, you may lodge a complaint with the data protection authority in your country:

• Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg
• Malaysia: Department of Personal Data Protection (JPDP) — pdp.gov.my
• Thailand: Office of the Personal Data Protection Committee (PDPC) — pdpc.or.th
• Vietnam: Ministry of Public Security (Department of Cyber Security and Hi-Tech Crime Prevention)
• Indonesia: Personal Data Protection Supervisory Agency (currently administered by the Ministry of Communication and Informatics)

14. Security of Personal Data

We take reasonable administrative, technical, and physical measures to protect personal data from unauthorised access, including access controls, encryption in transit, confidentiality obligations on employees, staff training, incident response procedures, and regular security reviews. No method of electronic storage or transmission is 100% secure.

15. Children’s Personal Data

Our services are directed at adults (generally age 18 and above, or the age of majority in the applicable jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will delete it promptly.

16. Changes to this Notice

We may update this Notice from time to time to reflect changes in our practices, services, or applicable laws. The updated Notice will be posted on our websites with a revised “Last updated” date.

17. Governing Law

This Notice shall be interpreted in accordance with the applicable data protection law of the country in which the relevant group entity is established.

For questions about which specific entity is the data controller of your personal data, please contact our Data Protection Officer at dpo@peopleprofilers.com.