Privacy Notice | Singapore Addendum

The following Singapore-specific provisions apply to our processing of your personal data in addition to or in lieu of, as applicable, the relevant sections of the Global Privacy Policy:

In compliance with the provisions of the Personal Data Protection Act 2012, ManpowerGroup shall

• collect, use or disclose personal data only with your knowledge and consent
• collect, use or disclose personal data in accordance with the purposes consented to
• notify you what personal data we collect, use and disclose and why, on or before such collection, use or disclosure of personal data
• at your request and where appropriate, provide access to personal data of you and correct any error or omission in your personal data
• use reasonable efforts to keep personal data collected accurate and up-to-date
• limit access to and disclosure of personal data
• make reasonable security arrangements to protect personal data
• retain personal data as required by law and according to our retention schedules
• not transfer personal data to another country unless the standard of protection provided to the personal data so transferred will be comparable to the protection under the Personal Data Protection Act 2012

Timeframe to cease the collection, use and/or disclosure of personal data upon receipt written request

If you wish to withdraw consent, we shall process and effect your request within 10 business days of receiving it. This includes informing all third parties, which we had disclosed the personal data to, to cease collecting, using and/or disclosing the personal data unless otherwise permitted by PDPA or any other written law and obtaining their confirmation in writing within 5 working days. If we are unable to process and effect the request within 10 business days, we will inform you as soon as possible (and in any event within 30 business days of the request) the amount of time we require to process and effect the request.

Unsolicited personal data received via email or other communication channels

For digital data, the email/message/attached will be deleted from the primary inbox, and the item from the “Deleted Items” or “Trash” folder will be emptied to permanently purge it. Local archives or temporary server caches should be cleared. Employees are not to download unsolicited attachments onto local desktop hard drives or temporary folders. If downloaded, those files shall be permanently wiped.

For physical data, documents will be shredded immediately and sent for disposal.

Resolution timeline for responding to request for access to and, correction of and/or withdrawal of consent

For access or correction, the Data Protection Officer (DPO) will be notified immediately. The DPO will verify the identity of the requestor and request for information on the personal data before handling such a request.

Unless exempted by any law or regulation, within 30 days of receiving the request, the DPO will:

1. provide the requestor with the requested personal data currently under our possession or control and/or information about the ways in which the personal data has been or may have been used or disclosed by us within a year before the date of the request; or
2. verify that the updated information provided is accurate (e.g., by checking against supporting documents or obtaining a declaration from the requestor), update the personal data with the latest information provided by the requestor, send the corrected personal data to other organisations to which the personal data was disclosed or transferred within a year before the correction request was made and update the requestor that the correction was carried out. If we are unable to provide the personal data or make the correction requested within 30 days after receiving the request, the DPO is to inform the requestor in writing, within 30 days of the time by which we will respond to the request.

We will provide the requestor with the requested personal data by email and in the language in which the requestor submitted unless otherwise requested. If other formats of data are requested, the DPO will assess the most appropriate manner to provide the requested personal data to the requestor.

If we are unable to provide the personal data or make the correction requested within 30 days after receiving the request, the DPO is to inform the requestor in writing, within 30 days of the time by which we will respond to the request.

If we are unable to disclose or update the personal data, the DPO shall (i) provide a response to the requestor even if we are not providing access to the personal data (ii) inform the requestor of the reason(s) within 30 days of the request, except where we are not required to do so under any law or regulation, and (iii) refer the requestor to our management for any challenge of the decision. We shall also preserve a complete and accurate copy of the personal data for a prescribed period (i.e., 30 days) after rejection of the request. The email will be deleted after the rejection of the request.

If the request relates to personal data which we are processing on behalf of another organisation, we will (i) forward the request to the relevant organisation, and (ii) inform the requestor that the request has been forwarded to the relevant organisation, within 7 days of receiving the request.

We might provide the requestor with a reasonable fee estimate (typically around S$10 to S$200 per document per request) for providing a copy of the personal data requested in documentary form. The actual amount of fee will take into consideration, the time involved in handling the request and any disbursements incurred. Where we have provided the requestor with a written estimate of the fee, we do not have to respond to an access request unless the requestor agrees to pay the fee. We will inform the requestor if there is any change to the fee for providing the personal data.

For withdrawal of consent, upon receipt of your written request to withdraw consent, we will first notify you of the consequences of the withdrawal request, including any legal consequences which may affect your rights and liabilities. If you wish to proceed with the withdrawal, we shall process and effect your request within 10 business days of receiving it. This includes informing all third parties, which we had disclosed the personal data to, to cease collecting, using and/or disclosing the personal data unless otherwise permitted by PDPA or any other written law and obtaining their written confirmation within 5 working days. If we are unable to process and effect the request within 10 business days, we will inform you soon as possible (and in any event within 30 business days of the request) the amount of time we require to process and effect the request.

Accuracy of Personal Data Collected

By checking the box in the data collection form, job applicants, candidates and/or employees attest that the personal data provided are accurate and complete. Where possible, we shall verify that the information provided is accurate (e.g., by checking against supporting documents).

Our obligation to cease the retention of personal data that is no longer required

Depending on the type of data, personal data shall be retained for a maximum of the following periods:

When the retention period has lapsed, we shall return, dispose or anonymise all information that contains personal data in accordance with our Information Security Policy. Softcopy documents containing personal data shall be destructed via permanent deletion while hardcopy documents shall be destroyed via shredding.

Archival of personal data is deemed to be continued retention and does not constitute disposal of personal data.

If an outsourced data destruction services provider is used, a data destruction certificate should be obtained as verification of the destruction.

For paper disposal (if any), all documents must be shredded using our shredder in the office.

All digital storage devices with sensitive/confidential data such as (i) Personal Data stored previously needs to be sanitized and erased before disposal; (ii) Files with Personal Data must be destructed in accordance with Information Security Policy (iii) Any unwanted old computing devices must be properly disposed with approval/supervision of the Director, and ; (iv) Check and clear internal storage device before any Laptop/Printer/Copier/Fax(“MFP”) machine scheduled for destruction, sale or return (if it is under rental).

Notification to individuals, Personal Data Protection Commission and other relevant regulatory agencies (where required) in the event of a data breach.

When there is a suspected breach, we will contain the breach, access the breach, report the breach and evaluate the response and recovery to prevent future breaches in accordance with our Personal Data Protection Policy.