How we protect candidate and client data under Singapore's PDPA
45%
5/11 controls passing
Continuously monitored · last automated check 13 hours ago
Privately verified
Identity data is kept separate and never shown publicly.
Publicly pseudonymous
Candidates are presented by CandidateID, not by name.
Access logged
Every CV view is recorded and reviewed.
Consent obligation
Data protection consent checkbox on candidate forms; Direct Apply consent audit records.
Purpose limitation & notification
Privacy policy link on forms and emails; Original CV purpose note in CV Studio.
Access & correction
Candidate Portal profile editing and CV Studio.
Protection obligation
Row-level security on candidate records, private CV storage, bot guard and rate limiting.
Retention limitation
Archived job orders, auto-clean of old logs and applications, account deletion.
Transfer limitation
Confidential CVs with redacted PII sent to companies; partner API keys.
Data breach notification
Security scan results and incident response policy.
Accountability & DPO
Approved policies in the Compliance Hub.
Access logging
CV access log and user activity log.
Do Not Call & marketing consent
Suppression list and unsubscribe links on marketing emails.
Business continuity & minimum-data backup
Weekly role-based Continuity Packs (Compliance Hub > Continuity): minimum fields only, private storage, admin-only access, 5-minute download links, every generation and download logged as evidence, packs expire after 30 days (max 4 kept per type). Full database exports are not part of the continuity process.
Policies are being finalised.
Chris Ho · chris@jjobb.com
Contact our DPO for access, correction or withdrawal-of-consent requests, or audit enquiries.
Retention: candidate personal data is anonymised after 2 years of inactivity.