Privacy Policy
We Are Caring Pte Ltd — Employers' Orientation Programme (EOP) Platform
1. About this Policy
We Are Caring Pte Ltd ("We Are Caring", "we", "us" or "our") is committed to protecting your personal data in accordance with the Singapore Personal Data Protection Act 2012 (the "PDPA"). This Privacy Policy explains what personal data we collect through the Employers' Orientation Programme platform at app.eop.sg (the "Platform"), why we collect it, who we share it with, how we protect it, how long we keep it, and the choices and rights available to you.
This Platform delivers the Employers' Orientation Programme, a training course for employers of Migrant Domestic Workers. The programme is conducted under the requirements of the Ministry of Manpower ("MOM").
By registering for and using the Platform, you acknowledge that you have read and understood this Policy.
We Are Caring Pte Ltd (UEN 201507515R) is registered at 61 Killiney Road, Level 2, Singapore 239522.
2. Our Data Protection Officer
We have appointed a Data Protection Officer ("DPO") who is responsible for overseeing our compliance with the PDPA and handling your queries and requests relating to personal data.
- Data Protection Officer: Ling Yan Lee
- Email: dpo@wearecaring.com
You may contact our DPO using the details above for any question about this Policy, to make an access or correction request, or to withdraw a consent you have previously given.
3. The personal data we collect
We collect the following categories of personal data when you register for and complete the course:
| Data we collect | How we obtain it | Why we collect it |
|---|---|---|
| NRIC or FIN | From Singpass / Myinfo, or entered by you | To verify your identity, prevent duplicate registrations, and produce the training records MOM requires |
| Passport number (foreign, non-PR participants) | From Singpass / Myinfo, or entered by you | Required for MOM training records where you hold a FIN |
| Full name | From Singpass / Myinfo, or entered by you | To identify you and to print your certificate of completion |
| Email address | From Singpass / Myinfo, or entered by you | To send you your certificate and service communications, and so our payment provider can send you your payment receipt |
| Mobile number | From Singpass / Myinfo, or entered by you | To contact you regarding your registration where needed |
| Nationality | From Singpass / Myinfo, or entered by you | To classify your participant category for MOM reporting |
| Course progress, quiz and survey responses | Generated as you use the Platform | To track completion and issue your certificate |
| Payment status | Generated when you pay the course fee | To confirm your enrolment |
| Technical/security records (e.g. session and audit logs) | Generated automatically | To keep the Platform secure and to investigate security incidents. These logs are designed to exclude your identifying personal data. |
We do not collect or store your payment card details. Card payments are processed entirely by our payment provider (see Section 5); your card number never reaches our systems.
4. Why we collect, use and disclose your data (purpose and consent)
We collect, use and disclose your personal data only for purposes that a reasonable person would consider appropriate in the circumstances, and for which you have given (or are deemed to have given) consent. Those purposes are:
- To register you for and deliver the Employers' Orientation Programme;
- To verify your identity via Singpass;
- To process your course-fee payment;
- To track your course progress and issue your certificate of completion;
- To provide the training records and reports that MOM requires of us as the course provider;
- To respond to your enquiries and provide technical support;
- To keep the Platform secure and to comply with our legal and regulatory obligations.
When you register, you are asked to give explicit consent to our collection, use and disclosure of your personal data for these purposes. We will not use your personal data for any purpose unrelated to the above without obtaining your consent, unless permitted or required by law.
5. Who we share your data with
We share your personal data only as necessary for the purposes above, and only with the following parties:
- Ministry of Manpower (MOM): As the course provider, we are required to provide MOM with training records (including attendance data and participant particulars) and periodic reports. This disclosure is a regulatory requirement of the programme.
- GovTech / Singpass (Government Technology Agency of Singapore): Used to verify your identity and, with your consent, to retrieve your particulars during registration.
- Stripe: Our payment processor, which handles your course-fee payment. Card payments are processed by Stripe. Stripe is a payment provider whose card-processing infrastructure is operated by an entity incorporated in the United States; your card details are handled by Stripe and not by us. We share your email address with Stripe so it can send your payment receipt.
- Xero: Our accounting software. Details of your course-fee payment (such as your name, email address, the amount and the date) are recorded in Xero for our accounting and tax records. Xero is operated by Xero Limited, a company incorporated in New Zealand, and these details may be stored and processed outside Singapore.
- Amazon Web Services (AWS) Simple Email Service: Used to send your certificate and service emails. This service is operated in the Singapore (ap-southeast-1) region.
- Google Cloud Platform: Hosts the Platform. All Platform data is stored and processed in Google Cloud's Singapore (asia-southeast1) region.
We do not sell your personal data, and we do not share it with advertisers or for marketing by third parties. We do not add you to our customer-relationship or marketing contact lists.
6. How we protect your data
We have put in place reasonable security arrangements to protect your personal data against unauthorised access, use, disclosure, modification or loss, including:
- Encryption at rest of sensitive identifiers (your NRIC, FIN and passport number) using customer-managed encryption keys;
- Encryption in transit using TLS for all data moving to and from the Platform;
- Strong identity assurance through Singpass (FAPI 2.0) with two-factor authentication;
- Least-privilege access controls within our systems, so that data is accessible only where strictly necessary;
- Security logging that is designed to exclude identifying personal data;
- Hosting entirely within Singapore.
While we take these measures, no method of transmission or storage is completely secure; we continue to review and improve our safeguards.
7. How long we keep your data, and how we dispose of it
We retain your personal data only for as long as it is needed for the purposes set out in this Policy, or as required to meet our obligations to MOM and under the law.
- Accounts that remain inactive are disabled after 90 days of inactivity.
- Disabled accounts are subsequently anonymised (your identifying data is irreversibly removed) 30 days after disablement.
- Backup copies are held in encrypted, access-controlled storage within Singapore and are deleted on a defined retention schedule (no longer than our overall corporate data-retention policy).
- Records of your course-fee payment kept in our accounting system are retained for as long as Singapore law requires us to keep accounting records, even after your Platform account has been anonymised.
When personal data is no longer required, we dispose of it securely.
8. Your rights: access, correction and withdrawal of consent
Under the PDPA, you have the right to:
- Access the personal data we hold about you, and information about how it has been used or disclosed;
- Correct any error or omission in your personal data;
- Withdraw your consent to our continued collection, use or disclosure of your personal data.
To exercise any of these rights, contact our DPO at dpo@wearecaring.com. We will respond to your request within a reasonable time, and in any event consistent with the timeframes set out under the PDPA. There may be a reasonable fee for an access request, which we will inform you of in advance.
Please note that if you withdraw your consent to the processing necessary to deliver the programme, we may be unable to complete your registration, deliver the course, or issue your certificate, and we may be unable to meet the MOM requirements that apply to your participation. We will inform you of the likely consequences before giving effect to a withdrawal.
9. Data breaches
We maintain procedures to detect, assess and respond to data breaches. In the event of a data breach involving your personal data, we will assess the breach and, where the breach is of a type that the PDPA requires to be notified, we will notify the Personal Data Protection Commission and affected individuals in accordance with the PDPA's data breach notification requirements.
10. Cookies
The Platform uses only cookies that are strictly necessary for it to function securely (for example, to keep you signed in during your session). We do not use advertising or behavioural-tracking cookies. For details, see our Cookies Notice.
11. Changes to this Policy
We may update this Policy from time to time. The version number and effective date at the top of this Policy indicate when it was last revised. Where changes are material, we will take reasonable steps to bring them to your attention. Your continued use of the Platform after an update constitutes acknowledgement of the revised Policy.
12. How to contact us
For any question or concern about this Policy or your personal data, contact:
Data Protection Officer
We Are Caring Pte Ltd
Email: dpo@wearecaring.com
If you are not satisfied with our response, you have the right to contact the Personal Data Protection Commission of Singapore.
This Policy is version v1.2, effective as of the date shown above.