PDP Policy

Data Protection Notice

Yoshimura Food Holdings Asia group of companies in Singapore (Yoshimura Food Holdings Asia, Sin Hin Frozen Food, Sharikat National Food and JSTT) · For customers, suppliers, business contacts, visitors, website and messaging users, job applicants and employees · Effective 7 October 2026 · Last updated 7 October 2026 · English version, followed by Simplified Chinese (中文版本见后)

How this Notice works: Part A applies to everyone. Part B adds the details for customers, suppliers, business contacts, visitors and website users. Part C covers job applicants and Part D covers employees. Part E covers CCTV and cameras. Read Part A together with the Part that applies to you.

PART A – GENERAL (applies to everyone)

1. About this Notice

1.1 Your privacy is important to us. This Data Protection Notice (“Notice“) explains how the companies listed in Schedule 1 (each a “Group Company“, and together the “Group“, “we“, “us” or “our“) collect, use, disclose, transfer, retain and otherwise process personal data under the Personal Data Protection Act 2012 of Singapore (“PDPA“).

1.2 This Notice applies to every individual whose personal data we process (“you“), including but not limited to:

customers and prospective customers, and the owners, partners, directors, employees, agents and representatives of our corporate customers;
suppliers, manufacturers, brand owners, service providers, contractors, sub-contractors and their staff;
delivery recipients, guarantors, trade referees and other individuals connected with our business dealings;
visitors to our premises, warehouses, factories and vehicles;
users of our websites, online stores, social media pages and messaging channels, and anyone who contacts us by any means;
job applicants, interns and trainees; and
current and former employees, temporary and part-time staff, agency and seconded staff, and their family members, dependants, emergency contacts and referees.

1.3 Each Group Company is responsible for the personal data in its possession or under its control. Where a Group Company processes personal data on behalf of and for the purposes of another Group Company, it acts as that company’s data intermediary; where it uses personal data for its own purposes (for example group reporting or shared services), it is responsible for that use. The Group Company you deal with, or that employs you, is primarily responsible for your personal data.

1.4 When this Notice applies. This Notice applies to you from the time it is published or otherwise made available to you, including on our websites, by email, on notice boards or through links on our forms, documents and messages, whether or not you sign, return or reply to any acknowledgement form. Where we ask you to sign the Acknowledgement form at the end of this Notice, your signature records that you have received this Notice and any optional consents you choose to give.

1.5 This Notice supplements, and does not supersede or replace, any other notice, consent, contract, terms of business or employment terms that apply to you, or any consent you have previously given to us. It does not affect any right we have under applicable law to collect, use or disclose personal data. Any consent you give under this Notice is cumulative and in addition to those rights.

1.6 This Notice is not contractual and does not form part of any contract with you, unless a contract expressly says otherwise.

2. Key terms

2.1 “Personal data” means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.

2.2 The PDPA’s main obligations do not apply to business contact information: an individual’s name, position or title, business telephone number, business address, business email address, business fax number and similar information, where it was not provided solely for personal purposes. Much of the information we hold about the staff of our customers and suppliers is business contact information. We nevertheless handle it with care.

3. How and from where we collect personal data

3.1 We collect personal data through any channel, including but not limited to:

in person, at our premises, at deliveries, at trade shows, events and meetings, and through business cards;
post, courier, fax and email;
telephone calls, voicemail, SMS and MMS;
WhatsApp, WeChat, Telegram, LINE, Signal, Viber, Facebook Messenger, Instagram, LinkedIn and other messaging, chat and social media applications, including voice notes, images, videos, documents and location pins sent through them;
video and online meetings (including Microsoft Teams, Zoom, Google Meet, WhatsApp and WeChat calls);
our websites, online forms, online stores and ordering channels, retailers’ ordering portals, marketplaces, electronic data interchange (EDI) and electronic invoicing networks (including InvoiceNow/Peppol);
application forms, contracts, account-opening and credit forms, delivery orders and other documents;
CCTV and other cameras (including facial recognition), access control and attendance systems, visitor registration, vehicle telematics and GPS; and
our IT systems, ERP and HR systems, cookies and similar technologies.

3.2 We collect personal data from you directly, and from sources including but not limited to: your employer, company or business; persons you have authorised to act for you; other Group Companies; credit bureaus, credit insurers, banks and trade referees; recruitment agencies, job portals, referees, former employers, educational institutions and background-check providers; logistics and delivery partners; retailers, marketplaces and portal operators; our service providers; government agencies; and publicly available sources (including ACRA and other public registers, court records, websites, social media and directories).

4. The legal basis for our processing

4.1 Consent. We collect, use and disclose personal data with your consent, including consent given by your conduct when you voluntarily provide personal data for a purpose (for example, when you place an order or send us a message).

4.2 Deemed consent for contracts. Where disclosure is reasonably necessary to conclude or perform a contract or transaction with you or at your request, you are deemed to consent to that disclosure and to the onward collection, use and disclosure by the recipient for that purpose.

4.3 Exceptions. We may also collect, use and disclose personal data without consent where the PDPA or other written law permits or requires it. This includes but is not limited to: managing or terminating an employment relationship; evaluative purposes (such as assessing job applicants); investigations and proceedings; recovering debts; personal data that is publicly available; business asset transactions; business improvement; and legitimate interests.

4.4 Legitimate interests. We may collect, use or disclose personal data without consent where this is in the legitimate interests of the Group or another person and those interests outweigh any adverse effect on you. We do so as permitted by applicable law. Our legitimate interests are:

detecting, preventing and investigating fraud, theft, misconduct, loss, and other unlawful or harmful activity, including by CCTV and other cameras, and by facial recognition for the purposes in paragraph 33.7;
securing our premises, vehicles, stock, systems, networks and information, and preventing data loss;
assessing credit and recovering debts;
monitoring, managing and analysing our business email, messaging, telephone and IT systems, including by automated and artificial intelligence (AI) tools, for security, compliance, quality, efficiency and record-keeping;
analysing operations, production, warehouse and delivery workflows to improve safety, efficiency and quality;
measuring and reporting the productivity, accuracy and service levels of teams and individuals using data from our systems;
food safety, hygiene, traceability and product recall;
registering and managing visitors to our premises;
managing the work, attendance, supervision and safety of agency, seconded and contract staff working for us;
internal controls, audits and group reporting required of our listed parent company (including J-SOX);
managing group-wide shared services, systems and functions; and
establishing, exercising and defending legal rights and claims.

You may contact our Data Protection Officer for more information about our reliance on legitimate interests.

4.5 Business improvement. Where permitted by applicable law, we may use personal data without consent, and share it between Group Companies that are related corporations, where applicable law permits, for the following business improvement purposes: improving or developing goods, services, processes and methods of operation (including automated and AI tools); learning about and understanding customer behaviour and preferences; and identifying or personalising goods and services that may be suitable for our customers.

4.6 Deemed consent by notification. Where permitted by applicable law, we may collect, use or disclose personal data for a new purpose on the basis of deemed consent by notification, in the manner required by applicable law.

4.7 Withdrawing consent does not affect any collection, use or disclosure that is permitted or required without consent under applicable law.

5. Who we disclose personal data to

5.1 For the purposes described in this Notice, we may disclose personal data to recipients in Singapore or elsewhere, including but not limited to:

other Group Companies, and our parent company Yoshimura Food Holdings K.K. (Japan) and its other subsidiaries and affiliates in Japan, Malaysia and elsewhere;
service providers, agents and contractors, including providers of: logistics, delivery, warehousing and cold-chain services; IT, cloud hosting, data storage and back-up; ERP (including Odoo); email, collaboration and productivity tools (including Microsoft); software development and hosting (including GitHub); messaging, telephony and social media (including Meta (WhatsApp, Facebook, Instagram), Tencent (WeChat), Telegram, LINE and SMS gateways and their solution providers); artificial intelligence and data analytics (including Anthropic); electronic invoicing and data exchange (including InvoiceNow/Peppol access points and EDI providers); HR, payroll, time-attendance and benefits systems (including Whyze); payment processing; printing, mailing and document destruction; security, CCTV and access control; recruitment, background checks and medical services; training and travel; and insurance;
banks, financial institutions, payment and remittance providers, card issuers and trade finance providers;
credit bureaus, credit insurers, trade referees, debt collection agencies and guarantors;
professional advisers, including lawyers, auditors (including the auditors of our parent company), tax advisers, company secretaries and consultants;
insurers, insurance brokers and loss adjusters;
your employer, company, business partners, authorised representatives and, in an emergency, your emergency contacts;
customers, suppliers, retailers, marketplaces, portal operators, distributors, manufacturers and brand owners, where needed for orders, deliveries, site access, promotions, claims, traceability or recalls;
prospective employers or verifiers who request a reference or employment verification;
courts, tribunals, regulators, government and statutory bodies and law enforcement agencies in Singapore or elsewhere (including the Ministry of Manpower, CPF Board, IRAS, ACRA, ICA, Singapore Customs, the Singapore Food Agency, the Police and the Personal Data Protection Commission), and self-help groups for fund contributions;
prospective and actual acquirers, purchasers, successors, investors, financiers, assignees and their advisers in connection with any merger, acquisition, sale, transfer, financing, listing or restructuring of all or part of our business or assets; and
any other person to whom you have consented, or to whom disclosure is permitted or required by law.

6. Transfers outside Singapore

6.1 We may transfer personal data to, and store or process it in, countries and territories outside Singapore, including but not limited to: Japan (our parent company and its group); Malaysia (our affiliates); the countries in which our service providers and their sub-processors operate, which may include the United States, the European Union, the United Kingdom, Australia, India, the People’s Republic of China (including for WeChat) and Hong Kong; and the countries of our overseas suppliers, manufacturers, brand owners, logistics providers and customers, to the extent relevant to our dealings with them.

6.2 Where we transfer personal data outside Singapore, we do so as required by applicable law.

7. Artificial intelligence and automated processing

7.1 We use automated tools and AI services, including those provided by third parties, for the following purposes: reading, classifying, routing and summarising emails, messages and documents (such as orders, purchase orders, invoices, delivery documents, receipts, claims and HR letters); extracting information; preparing draft quotations, replies, letters and reports; answering questions; analysing CCTV images (including by facial recognition, as described in paragraph 33.7) and operational data; and detecting errors, anomalies and fraud. These tools may process personal data contained in that material. Where these tools support decisions about credit, employment or discipline, a person is involved in making the decision.

8. Recordings and monitoring

8.1 Telephone calls, online meetings and video calls with us may be recorded or transcribed. Messages, chats, voice notes and attachments you send to us through any channel, including but not limited to email, SMS, WhatsApp and WeChat, may be kept as business records.

8.2 Our premises and vehicles are monitored by CCTV and other cameras as described in Part E. Employees should also read Part D, paragraph 29.

9. Protection

9.1 We protect personal data in our possession or under our control as required by applicable law.

9.2 No method of transmission over the Internet or of electronic storage is completely secure. We cannot guarantee absolute security. You are responsible for keeping any login details we give you safe, and for sending sensitive information to us only through secure channels.

10. Accuracy

10.1 We rely on the personal data you or your representatives provide. Please keep it accurate, complete and up to date and tell us of any changes. To the extent permitted by law, we are not responsible for loss arising from inaccurate or incomplete personal data provided to us, except to the extent the loss is caused by our breach of applicable law or our negligence.

11. Retention

11.1 We retain personal data for as long as it is needed for the purposes for which it was collected, or as required or permitted for legal, regulatory, accounting, tax, audit, insurance or business purposes, including any period during which a claim may be brought or defended, and otherwise as required or permitted by applicable law.

11.2 We may keep anonymised data without limit.

12. Your rights

Withdrawal of consent

12.1 You may withdraw your consent to our collection, use or disclosure of your personal data by giving reasonable notice to our Data Protection Officer (for example by email) or, if you are an employee or job applicant, to Human Resources. Withdrawal may mean, without limitation, that we can no longer supply goods or services, extend credit, consider your job application or continue our relationship with you, and that contractual terms on termination will apply. We will deal with your request as required by applicable law.

12.2 Withdrawal does not affect processing carried out before the withdrawal.

Access and correction

12.3 You may request access to, or correction of, your personal data as provided under applicable law.

12.4 We may charge a fee for access requests, as permitted by applicable law, and need not process a request until the fee is agreed.

12.5 We will respond to requests within the time required by applicable law. We may decline a request, or part of it, where permitted by applicable law.

12.6 We may verify your identity before acting on a request, and act on requests from third parties only if we are satisfied they are authorised to act for you.

13. Data Protection Officer and complaints

13.1 Questions, requests and complaints about this Notice or our handling of personal data should be sent to our Data Protection Officer:

Email	dpo@y-food-h-asia.com

13.2 We handle complaints as required by applicable law.

14. Limitation

14.1 To the maximum extent permitted by applicable law, the Group is not liable for any loss, damage, cost or expense arising from any unauthorised access to, or collection, use, disclosure, copying, modification, disposal or loss of, personal data, to the extent it is caused by:

any act or omission of a third party that is not acting as our data intermediary, including hackers and other wrongdoers, telecommunications and internet service providers, and messaging, social media and cloud platforms;
your own transmission of personal data to us, or your request that we send it to you, by email, messaging application, fax or any other means that is not fully secure;
your own devices, accounts, passwords, networks or systems, or your failure to keep any login details secure;
personal data that you have made public or shared with others; or
events beyond our reasonable control,

except to the extent the loss is caused by our breach of applicable law or our negligence.

14.2 Nothing in this Notice excludes or limits any liability that cannot be excluded or limited under applicable law.

15. Governing law, language and severability

15.1 This Notice is governed by the laws of Singapore.

15.2 This Notice is issued in English and Simplified Chinese. If there is any inconsistency between the versions, the English version prevails. If you do not understand any part of this Notice, you may contact our Data Protection Officer or, for employees, Human Resources.

15.3 Severability. If any provision of this Notice, or any part of a provision, is held to be invalid, illegal or unenforceable, that provision or part is to be treated as deleted, and the rest of this Notice remains in force.

16. Changes to this Notice

16.1 We may update or modify this Notice at any time and may notify you of updates in any form we consider appropriate, including by publishing the updated Notice on our websites with the date of the update. Where required by applicable law, we will also post a notice or contact you, for example by email, SMS or messaging application, using the contact details in our records, or obtain your consent. Please check this Notice regularly.

PART B – CUSTOMERS, SUPPLIERS, BUSINESS CONTACTS, VISITORS AND WEBSITE USERS

17. Personal data we collect

17.1 Depending on how you deal with us, we collect personal data including but not limited to:

identity and contact data: name, alias, job title, company, business and personal telephone and mobile numbers, email addresses, postal, billing and delivery addresses, messaging and social media identifiers (such as WhatsApp numbers, WeChat IDs, Telegram and LINE handles, and profile names and pictures), and signatures (handwritten, electronic or digital);
identification data: NRIC, FIN, passport or other identification numbers (for example for guarantees, credit applications by sole proprietors, or legal proceedings);
transaction and account data: enquiries, quotations, orders, purchase orders, contracts, deliveries, delivery orders and proof of delivery (including photographs, stamps and signatures), returns, credit notes, claims, invoices, statements of account, payment history, prices, rebates and promotions;
financial and credit data: bank account and payment details, credit applications and limits, trade references, guarantees, ACRA and public register information, credit bureau and credit insurer reports, outstanding amounts, payment arrangements and debt recovery records;
communications: emails, letters, faxes, voicemail, SMS and messages through any messaging or social media application (including voice notes, images, videos and documents), call logs, and recordings and transcripts of calls and meetings;
images and recordings: CCTV and camera footage, photographs and video at our premises, deliveries, trade shows and events, and facial images and templates where facial recognition is used (Part E);
vehicle and delivery data: delivery routes and times, vehicle location (GPS) and telematics data, and dashboard camera footage;
visitor data: name, company, contact number, vehicle number, purpose of visit, times of entry and exit, and health and safety declarations;
online data: IP address, device identifiers, device and browser information, approximate location, cookies, pixels and similar technologies, pages visited, links clicked, email opens, and interactions with our websites, online stores, social media pages and messaging channels;
preferences and feedback: product preferences, survey responses, complaints and feedback; and
other data that you or your representatives provide, or that we obtain in the course of our dealings with you.

17.2 If you do not provide personal data that we need, we may be unable to open or maintain an account, extend credit, accept orders, make deliveries, make or receive payments or otherwise deal with you.

18. Purposes

18.1 We collect, use and disclose personal data of the individuals in this Part for the following purposes:

(a) Supplying goods and services and managing the relationship

processing enquiries, quotations, orders and purchase orders received through any channel, including retailers’ portals, EDI, electronic invoicing and messaging applications;
picking, packing, delivering, collecting and installing goods and equipment, providing maintenance and after-sales service, scheduling and tracking deliveries, and recording proof of delivery;
invoicing, issuing statements of account, collecting payments, and processing returns, credit notes, rebates, promotions, warranties and claims;
opening, administering, reviewing and closing customer and supplier accounts, and setting payment terms and credit limits;
purchasing goods and services, managing suppliers and contractors, and approving and making payments;
communicating with you about orders, deliveries, accounts, payments, product information, recalls, food safety, changes to our business and service matters by any means, including but not limited to post, email, telephone, fax, SMS, WhatsApp, WeChat and other messaging applications and social media;
responding to and handling queries, requests, complaints and feedback;

(b) Credit, risk and recovery

assessing creditworthiness and credit applications, setting and reviewing credit limits and terms, and obtaining and enforcing guarantees and security;
sending payment reminders and statements, collecting overdue amounts, and engaging debt collection agencies, lawyers and credit insurers;
preventing, detecting and investigating fraud, misconduct, theft, unlawful activity and breaches of our terms;
conducting due diligence, sanctions, anti-bribery and know-your-counterparty checks on customers, suppliers and their owners, directors and guarantors;

(c) Operations, security and safety

managing access to and security of our premises, warehouses, cold rooms, factories, vehicles, systems and assets, including by CCTV, cameras and visitor registration;
workplace safety and health, food safety and hygiene, traceability, quality control, product recalls and incident investigations;
operating, maintaining, securing, testing and improving our IT, ERP, email, messaging, websites and automated workflows;

(d) Business administration and improvement

record-keeping, accounting, financial reporting, budgeting, audits, internal controls (including J-SOX and other requirements of our listed parent company), consolidation and group reporting;
analysing sales, customers, products, pricing, collections and performance, and preparing management reports;
improving and developing our goods, services, processes and methods of operation, including developing and testing automated and AI tools;
understanding customer behaviour, preferences and market trends, and identifying goods and services that may suit customers;
managing, restructuring, merging, selling or transferring all or part of our business or assets, including due diligence;
taking photographs and videos at events, trade shows and deliveries and using them in internal communications and, with consent where required, in our publicity, websites and social media;

(e) Legal and regulatory

complying with laws, regulations, codes, guidelines, licence conditions and the orders and requests of courts, regulators, government agencies and law enforcement;
establishing, exercising and defending legal claims, and responding to legal process, investigations and disputes;
obtaining professional advice;

(f) Marketing (only where permitted, see paragraph 20)

sending information about our goods, services, promotions, price lists, new products and events;

(g) Related purposes

any other purpose reasonably related or incidental to any of the above and notified to you when your personal data is collected.

19. Personal data of other individuals

19.1 If you give us personal data of another individual (for example your staff, owners, guarantors, family members or delivery contacts), you confirm that you have told them about this Notice and obtained any consent needed for us to collect, use and disclose their personal data for the purposes in this Notice. Where our dealings with you are governed by a contract that so provides, you also agree to indemnify us against any claim, loss or penalty arising from your failure to do so.

20. Marketing, Do Not Call and spam rules

20.1 We send marketing messages by any means, including but not limited to voice call, SMS, MMS, fax, email, WhatsApp, WeChat and other messaging applications, as permitted by applicable law, including the Do Not Call provisions of the PDPA and the Spam Control Act 2007.

20.2 You may unsubscribe at any time using the method in the message or by contacting us. Unsubscribing from marketing does not stop service messages about orders, deliveries or your account.

21.1 Our websites and emails may use cookies, pixels and similar technologies to operate, remember preferences, measure usage and, with your consent where applicable law requires it, to show you relevant advertising on other websites and social media (including through Meta and Google). You can block or delete cookies in your browser settings, although some features may then not work.

21.2 Our websites and social media pages may link to or embed content from third parties (including but not limited to Facebook, Instagram, WhatsApp, WeChat, YouTube and Google Maps), which may collect data under their own policies.

21.3 Our goods, services and websites are intended for businesses and adults and are not directed at children. We do not knowingly collect personal data directly from children under 13 without the consent of a parent or guardian. A parent or guardian who believes a child has given us personal data should contact our Data Protection Officer. If you are under 18 and apply to or work with us (for example as an intern or trainee), we may ask a parent or guardian to give consent on your behalf where you may not fully understand the nature and consequences of giving consent.

PART C – JOB APPLICANTS

22. Personal data we collect

22.1 We collect personal data of applicants for employment, internships and traineeships, including but not limited to: name and contact details; eligibility to work in Singapore; education, qualifications, skills and employment history; salary history and expectations; CV contents; interview notes, assessment and test results; references; and, where needed in the recruitment process, identification numbers, date of birth and the results of background, reference and pre-employment medical checks.

23. Purposes

23.1 We use applicants’ personal data for the following purposes: assessing suitability for the position applied for and for other positions in the Group open during the recruitment process, and, if you agree, for future positions; communicating about the application; verifying identity, qualifications, employment history and references and conducting background and pre-employment checks; making and administering offers and preparing for onboarding; complying with law, including fair employment requirements; establishing or defending legal claims; and improving our recruitment processes. Automated and AI tools may be used to help organise and summarise applications.

24. Retention for applicants

24.1 If you are not hired, we may keep your application for as long as reasonably needed for recruitment and related legal purposes, or longer if you agree (for example up to 24 months to be considered for future roles), and otherwise as permitted by applicable law. If you are hired, your application becomes part of your employee record under Part D.

24.2 Opinion data kept solely for evaluative purposes, such as referees’ comments and interview assessments, is exempt from access and correction under the PDPA.

PART D – EMPLOYEES

25. Who this Part covers

25.1 This Part applies to current and former employees, interns, trainees, temporary, part-time, agency and seconded staff of any Group Company. It should be read together with the Employee Handbook and your employment contract; it is not contractual. It applies from when it is given or made available to you, whether or not you sign any acknowledgement. For agency, seconded and contract staff who are not employed by a Group Company, we process personal data for the purposes in paragraph 27.1 that are relevant to their assignment, on the basis of deemed consent (including where their employer or agency provides the data to us as reasonably necessary to perform its own contract with them), the exceptions in paragraph 4.3 that apply to them (other than the employment exception) and the legitimate interests in paragraph 4.4.

26. Personal data we collect

26.1 We collect personal data about you before, during and after your employment, including but not limited to:

identity and contact: name, NRIC/FIN/passport number and copies of identity documents, work pass details, date and place of birth, age, gender, nationality, race, photographs, signature, home address, personal telephone, email and messaging application identifiers (such as WhatsApp and WeChat), and emergency contacts;
family and dependants: marital status and details of spouse, children and dependants for benefits, insurance, leave and tax purposes;
recruitment: application, CV, qualifications, employment history, references, interview notes and background and pre-employment check results;
employment and pay: job title, grade, department, location, contract terms, salary, allowances, bonuses, commission, incentives, CPF and self-help fund contributions, tax information, bank account details, benefits, claims, reimbursements and corporate card transactions;
time and attendance: working hours, shifts, overtime, leave, absences, and attendance and door-access records, including records captured by fingerprint, card or facial systems;
health: medical certificates, pre-employment and periodic medical examinations, fitness-for-work assessments, vaccination status where required by law or reasonably necessary for workplace safety, injury and incident reports, and insurance claims;
biometric data: fingerprint, facial and similar templates used for time attendance, access control and security, including facial recognition (Part E);
performance and conduct: appraisals, objectives, key performance indicators, productivity, accuracy and activity data drawn from our systems, training records, disciplinary records, grievances, investigations and whistleblowing reports;
IT and communications: user IDs, login, activity and audit-trail logs, and the contents of your work email, Microsoft Teams chats, files, calls and meetings (including recordings and transcripts where made). Also work-related messages and groups on WhatsApp, WeChat, Telegram and other messaging applications, whether on a company or a personal device, and your use of the internet, company phones, devices and applications;
images and location: CCTV and camera footage (including audio where signposted), photographs and video at work or company events, and location and telematics data from company vehicles, devices and delivery applications;
foreign employees: work pass applications, housing and dormitory, security bond, medical insurance and repatriation; and
exit: resignation and termination records, exit interviews, final pay and references.

27. Purposes

27.1 We collect, use and disclose your personal data for the following purposes, which are reasonable for entering into, managing and terminating your employment:

recruitment and onboarding, and verifying identity, qualifications, work eligibility and references;
administering your contract, pay, allowances, commission, bonuses, benefits, CPF, self-help fund contributions, income tax, insurance, medical and dental benefits, leave and claims;
applying for, renewing and cancelling work passes, and complying with Ministry of Manpower requirements, including housing and medical requirements for foreign employees;
managing working time, attendance, shifts, overtime and rosters;
performance management, appraisals, promotion, compensation, training, career development, succession and workforce planning;
measuring and reporting the productivity, workload, accuracy and service levels of teams and individuals using data from our systems, and showing team results on internal dashboards and screens;
managing conduct and discipline, grievances, investigations, whistleblowing reports, disputes and legal claims;
workplace safety and health, food safety and hygiene, fitness for work, incident reporting and work injury compensation;
security of premises, vehicles, stock, systems and information, including by CCTV, cameras, access control and the monitoring described in paragraph 29;
managing and supporting IT, ERP, email, messaging and automated workflows, including AI tools under paragraph 7;
internal communications, staff directories, organisation charts, company events and recognition;
business administration, accounting, audit, internal controls (including J-SOX), group reporting, budgeting, secondments, intra-group transfers and restructuring;
complying with laws and the requests of government agencies, regulators, courts and law enforcement;
after employment: final pay and benefits, references and employment verification, alumni contact (with your consent), record-keeping and claims; and
any other purpose reasonably related or incidental to any of the above and notified to you when your personal data is collected.

28.1 Where applicable law requires, we will obtain your consent before using your name, photograph, image, video or voice in external publicity (including but not limited to our websites, social media, brochures, advertising and recruitment materials), or for any other purpose not reasonably related to your employment. You may withdraw that consent at any time by writing to HR or to our Data Protection Officer. After withdrawal we need not recall printed materials already distributed or content already shared by others.

29. Monitoring

29.1 Our IT systems, networks, email accounts, Microsoft Teams, company messaging accounts, and company devices, telephones and vehicles are provided for business purposes. You should have no expectation of privacy in anything you create, store, send or receive on them, including any personal use you make of them. This paragraph does not apply to your personal devices, which are dealt with in paragraph 29.2.

29.2 We may, without further notice and by manual or automated means (including AI tools), monitor, access, review, copy, record, retain and disclose, including but not limited to:

work email accounts and mailboxes (including shared and former employees’ mailboxes), Teams chats and channels, files and documents;
company telephone numbers and company messaging accounts (including WhatsApp Business and WeChat accounts used for work), and work-related messages and groups on any messaging application, including on personal devices used for work, to the extent they relate to our business. Work-related content on personal devices is obtained only from work accounts and groups that we administer or that you produce at our request. We will not access your personal device without your permission;
system, login, ERP and audit-trail activity, internet use and device use;
calls and online meetings, where recording or transcription is enabled and indicated;
CCTV and camera footage of work areas, entrances, warehouses, cold rooms, production areas, loading bays, car parks, vehicles and dormitory common areas, and facial recognition only at entrances, restricted areas and attendance points, as described in paragraph 33.7; and
location and telematics data of company vehicles and devices.

We do this for the following purposes: security; preventing and detecting misconduct, fraud and data loss; compliance; investigations; business continuity (for example when you are absent or have left); handling customer and supplier matters; quality control; productivity and process analysis; and record-keeping.

30. CCTV analytics

30.1 We may use automated and AI tools to analyse camera footage of production, warehouse, loading and delivery areas to measure and improve workflow, output, safety, hygiene and process efficiency. These analytics are not used for dormitory areas. Results may be used in aggregated, station-level or individual form for safety, security, investigations and performance management. Analysis about an identified individual is never the sole basis for disciplinary action; any action is decided by a manager after reviewing the facts with the employee.

31. Your obligations

31.1 You must keep your personal data with us accurate and tell HR promptly of changes. Before giving us personal data of your family members, dependants, emergency contacts and referees, you must tell them about this Notice and obtain any consent needed.

31.2 You must handle personal data of customers, colleagues and others in accordance with our Data Protection Manual and your employment terms, and report any actual or suspected data breach immediately to your supervisor and the Data Protection Officer. Breaches may lead to disciplinary action including dismissal. Knowingly or recklessly disclosing personal data without authorisation, knowingly or recklessly using it without authorisation where this results in a gain to any person, harm to an individual or loss to another person, or knowingly or recklessly re-identifying anonymised information without authorisation is an offence under the PDPA (ss48D–48F), punishable by a fine of up to S$5,000, imprisonment of up to 2 years, or both.

32. Retention and requests for employees

32.1 We keep employee records for as long as needed for the purposes in this Part and as required or permitted by applicable law.

32.2 Requests for access to or correction of your personal data are handled under paragraph 12.

PART E – CCTV AND CAMERAS

33. CCTV and cameras

33.1 Our premises, vehicles and operations may be monitored by CCTV and other cameras, which may use facial recognition (paragraph 33.7), including but not limited to fixed and pan-tilt-zoom cameras, cameras in or on vehicles (such as dashboard cameras), and cameras on handheld or wearable devices used for work. Some cameras may record audio where this is signposted.

33.2 Cameras may cover areas including but not limited to entrances, perimeters, car parks, loading bays, warehouses, cold rooms, production and packing areas, offices’ common areas, corridors, dormitory common areas, and the inside and outside of vehicles. Cameras are not intended to cover toilets, changing rooms, shower areas, dormitory bedrooms, prayer rooms or nursing rooms.

33.3 Footage is used for the following purposes: security; access control and attendance; preventing and investigating theft, fraud, misconduct and unlawful acts; workplace safety and health; food safety, hygiene and cold-chain compliance; verifying deliveries, loading and receipt of goods; quality control and staff training (using footage of employees, or with other persons’ images blurred); operational analysis of workflows (including by automated and AI tools, as described in paragraph 30); and establishing and defending legal claims.

33.4 Footage may be disclosed to the police and other authorities, insurers, lawyers and the persons listed in paragraph 5 where needed for these purposes.

33.5 Footage is kept for as long as needed for these purposes and as required or permitted by applicable law.

33.6 You may request access to footage of yourself under paragraph 12, subject to applicable law, and a fee may be charged.

33.7 Facial recognition. We may use facial recognition technology with our cameras, access control and attendance systems. Facial recognition is used only at entrances, restricted areas and attendance points, and not in dormitories, toilets, changing rooms or vehicles. We use it for the following purposes:

access control and time attendance of enrolled staff;
alerts about persons who are not authorised to be in restricted areas such as warehouses, cold rooms and production areas;
preventing and investigating theft and security incidents, by matching images against a list of persons involved in documented previous incidents; and
safety head-counts, such as accounting for persons on site in an emergency.

33.8 Facial data of persons who are not matched is deleted promptly; matches are reviewed by a person before any action is taken against anyone; employees may ask for an alternative means of attendance or access where reasonably practicable; and we do not use facial recognition for marketing. We otherwise protect facial recognition data as required by applicable law.

SCHEDULE 1 – GROUP COMPANIES COVERED BY THIS NOTICE

Company	UEN	Address
Yoshimura Food Holdings Asia Pte. Ltd.	201912231E	1 Second Chin Bee Road, Singapore 618768
Sin Hin Frozen Food Private Limited	199605480G	1 Second Chin Bee Road, Singapore 618768
Sharikat National Food Pte. Ltd.	200906002K	1 Second Chin Bee Road, Singapore 618768
JSTT Singapore Pte. Ltd.	200613899R	1 Second Chin Bee Road, Singapore 618768

SCHEDULE 2 – VENDOR DATA PROTECTION TERMS

These terms form part of every purchase order, service order and supplier contract of a Group Company that refers to them.

1. Scope. These terms apply whenever a supplier, contractor or service provider (“Vendor“) collects, receives, accesses, stores or otherwise processes personal data on behalf of and for the purposes of the Group Company that issues the order or contract (“Company“). Where the Vendor receives personal data from the Company for its own purposes, only clauses 1, 3, 4, 6, 7, 10, 12, 13, 14 and 16 apply. These terms prevail over any inconsistent Vendor terms on the same subject, including terms in any quotation, acceptance, delivery note or invoice issued before or after the order, unless the Company has agreed otherwise in writing.

2. Instructions. The Vendor shall process the Company’s personal data only to provide the goods or services ordered and on the Company’s documented instructions, and for no purpose of its own, except where the law requires otherwise, in which case the Vendor shall tell the Company first unless the law prohibits it.

3. Confidentiality. The Vendor shall ensure that only staff who need the data have access to it, and that they are bound by confidentiality.

4. Security. The Vendor shall protect the data by reasonable security arrangements, including at least: access control and multi-factor authentication; encryption in transit and, for sensitive data, at rest; timely security updates; back-ups; and secure disposal.

5. Sub-contractors. The Vendor shall not engage a sub-contractor to process the data unless it has told the Company in writing at least 10 business days before, and shall bind any sub-contractor to terms no less protective than these. If the Company objects on reasonable data protection grounds within those 10 business days, the Vendor shall not use that sub-contractor for the data. The Vendor remains liable for its sub-contractors’ acts and omissions. If the Vendor cannot then provide the services without that sub-contractor, the Company may terminate the affected order or services by written notice without liability for doing so.

6. Transfers. The Vendor may transfer, store or access the data only in Singapore and in the countries and territories stated in the order or otherwise notified to and accepted in writing by the Company, and in no other country or territory without the Company’s prior written consent. The Vendor shall itself provide, and shall ensure that each person to which it transfers or gives access to the data is bound by legally enforceable obligations to provide, a standard of protection for the data that is at least comparable to the protection under the PDPA.

7. Breach notification. The Vendor shall notify the Company at dpo@y-food-h-asia.com without undue delay, and in any case within 24 hours, after becoming aware of any actual or suspected data breach affecting the data. It shall provide all information and cooperation the Company reasonably needs.

8. Requests and investigations. The Vendor shall promptly help the Company respond to access, correction and withdrawal requests, complaints and PDPC investigations.

9. AI. The Vendor shall not use the data to train or improve any artificial intelligence model, and shall not keep it in any AI system longer than needed to provide the services.

10. Return and deletion. At the end of the services, or on request, the Vendor shall return or securely delete the data and confirm this in writing, unless the law requires it to be kept.

11. Information and audit. The Vendor shall provide information reasonably requested to show compliance, including certifications and security reports.

12. Liability. To the extent permitted by law, the Vendor shall indemnify the Company against all losses, penalties, claims and costs arising from the Vendor’s breach of these terms or of the PDPA.

13. Law. These terms are governed by Singapore law.

14. Survival. Clauses 2 to 11, to the extent they apply to the Vendor, continue after the order or the services end for as long as the Vendor or any sub-contractor holds the data. Clauses 12 and 13 continue without limit of time, and clause 15 for 2 years after the services end. The end of the order or the services does not affect any accrued right or liability, or any claim under clause 12 for a breach that occurred before the end, whenever the loss is suffered.

15. Insurance. A Vendor that processes personal data on behalf of the Company shall maintain cyber and professional indemnity insurance with a reputable insurer for an amount reasonable for the services, and shall provide evidence on request.

16. Interpretation. ‘PDPA’ means the Personal Data Protection Act 2012 of Singapore and its subsidiary legislation, as amended; ‘personal data’ and ‘data breach’ have the meanings in the PDPA; ‘the data’ means personal data that the Vendor collects, receives, accesses, stores or otherwise processes on behalf of the Company, or receives from or through the Company, under or in connection with the order, but not personal data of the Vendor’s own staff or customers that the Vendor processes only for its own purposes.

Effective date: 7 October 2026 · Last updated: 7 October 2026

个人资料保护通知（简体中文版本）

本通知以英文及简体中文发布；如两个版本有任何不一致，以英文版本为准。

本通知的结构：A部分适用于所有人。B部分为客户、供应商、业务联系人、访客及网站用户补充具体内容。C部分适用于求职者，D部分适用于雇员，E部分说明闭路电视及摄像设备。请将A部分与适用于您的部分一并阅读。

适用于新加坡 Yoshimura Food Holdings Asia 集团旗下公司（Yoshimura Food Holdings Asia、Sin Hin Frozen Food、Sharikat National Food 及 JSTT）· 适用对象：客户、供应商、业务联系人、访客、网站及通讯应用程序用户、求职者及雇员 · 生效日期：2026年10月7日 · 最后更新：2026年10月7日

A部分 – 总则（适用于所有人）

1. 关于本通知

1.1 我们重视您的隐私。本个人资料保护通知（”本通知“）说明附表1所列公司（各称”集团公司“，合称”本集团“、”我们“）如何根据新加坡《2012年个人资料保护法令》（”PDPA“）收集、使用、披露、转移、保留及以其他方式处理个人资料。

1.2 本通知适用于我们处理其个人资料的每一位个人（”您“），包括但不限于：

客户及潜在客户，以及我们企业客户的东主、合伙人、董事、雇员、代理人及代表；
供应商、制造商、品牌拥有者、服务提供者、承包商、分包商及其员工；
收货人、担保人、商业推荐人及与我们业务往来有关的其他个人；
我们的场所、仓库、工厂及车辆的访客；
我们的网站、网上商店、社交媒体页面及通讯渠道的用户，以及以任何方式联系我们的任何人；
求职者、实习生及受训人员；以及
现任及前任雇员、临时及兼职员工、中介派遣及借调员工，以及他们的家属、受抚养人、紧急联系人及推荐人。

1.3 每家集团公司对其管有或控制的个人资料负责。如某集团公司代表另一集团公司并为其目的处理个人资料，则该集团公司作为后者的资料中介行事；如其为自身目的（例如集团报告或共享服务）使用个人资料，则由其对该使用负责。与您往来或雇用您的集团公司对您的个人资料负主要责任。

1.4 本通知的适用。 本通知自发布或以其他方式向您提供之时起（包括通过我们的网站、电邮、布告栏，或我们的表格、文件及信息中的链接）对您适用，无论您是否签署、交回或回复任何确认书。如我们请您签署本通知末尾的《确认书》，您的签署记录您已收到本通知以及您选择给予的任何可选同意。

1.5 本通知是对适用于您的任何其他通知、同意、合同、业务条款或雇用条款，以及您以往给予我们的任何同意的补充，而非取代或替代。本通知不影响我们根据适用法律收集、使用或披露个人资料的任何权利。您根据本通知给予的任何同意，均为累积性质，并附加于该等权利。

1.6 本通知不具合同性质，亦不构成与您订立的任何合同的一部分，除非某份合同另有明确规定。

2. 主要用语

2.1 “个人资料“指关于某一个人的资料（无论是否属实），而该个人可通过该资料，或通过该资料及我们已取得或可能取得的其他信息，被识别出来。

2.2 PDPA的主要义务不适用于商业联系资料，即个人的姓名、职位或职衔、商业电话号码、商业地址、商业电邮地址、商业传真号码及类似信息，但以该等信息并非纯粹为个人目的而提供者为限。我们所持有的关于客户及供应商员工的大部分信息属于商业联系资料。尽管如此，我们仍会审慎处理这些信息。

3. 我们收集个人资料的方式及来源

3.1 我们通过任何渠道收集个人资料，包括但不限于：

当面收集，例如在我们的场所、送货时、贸易展、活动及会议上，以及通过名片；
邮寄、快递、传真及电邮；
电话、语音信箱、SMS及MMS；
WhatsApp、微信 (WeChat)、Telegram、LINE、Signal、Viber、Facebook Messenger、Instagram、LinkedIn 及其他通讯、聊天及社交媒体应用程序，包括通过这些应用程序发送的语音信息、图片、视频、文件及位置标记；
视频及网上会议（包括 Microsoft Teams、Zoom、Google Meet、WhatsApp 及微信 (WeChat) 通话）；
我们的网站、网上表格、网上商店及订购渠道、零售商订购平台、电商平台、电子数据交换（EDI）及电子发票网络（包括 InvoiceNow/Peppol）；
申请表格、合同、开户及信贷表格、送货单及其他文件；
闭路电视及其他摄像头（包括人脸识别）、门禁及考勤系统、访客登记、车载远程信息系统及GPS；以及
我们的资讯科技系统、ERP及人力资源系统、Cookies及类似技术。

3.2 我们直接向您收集个人资料，也从以下来源收集，包括但不限于：您的雇主、公司或业务；您授权代表您行事的人士；其他集团公司；信贷资料机构、信用保险公司、银行及商业推荐人；招聘中介、求职网站、推荐人、前雇主、教育机构及背景调查服务提供者；物流及送货合作伙伴；零售商、电商平台及订购平台营运商；我们的服务提供者；政府机构；以及公开来源（包括会计与企业管制局（ACRA）及其他公共登记册、法庭记录、网站、社交媒体及名录）。

4. 我们处理个人资料的法律依据

4.1 同意。 我们在取得您同意的情况下收集、使用及披露个人资料，包括您为某一目的自愿提供个人资料时以行为表示的同意（例如您下订单或向我们发送信息时）。

4.2 为合同目的视为同意。 如为与您订立或履行合同或交易，或应您的要求订立或履行合同或交易而合理需要作出披露，您即被视为同意该项披露，以及同意接收方为该目的而进一步收集、使用及披露有关个人资料。

4.3 例外情况。 在PDPA或其他成文法允许或规定的情况下，我们也可在未经同意的情况下收集、使用及披露个人资料。这包括但不限于：管理或终止雇佣关系；评估目的（例如评估求职者）；调查及法律程序；追讨债务；公开可得的个人资料；业务资产交易；业务改进；以及合法利益。

4.4 合法利益。 如收集、使用或披露个人资料符合本集团或其他人士的合法利益，且该等利益超过对您可能造成的任何不利影响，我们可在未经同意的情况下进行。我们会在适用法律允许的情况下这样做。我们的合法利益为：

侦测、预防及调查欺诈、盗窃、不当行为、损失及其他非法或有害活动，包括通过闭路电视及其他摄像头，以及为第33.7段所述目的使用人脸识别；
保护我们的场所、车辆、存货、系统、网络及信息的安全，以及防止资料外泄；
评估信用及追讨债务；
为安全、合规、质量、效率及记录保存的目的，监控、管理及分析我们的商业电邮、通讯、电话及资讯科技系统，包括通过自动化工具及人工智能（AI）工具；
分析营运、生产、仓库及送货流程，以提高安全、效率及质量；
利用来自我们系统的数据，衡量及报告团队和个人的生产力、准确度及服务水平；
食品安全、卫生、可追溯性及产品回收；
登记及管理我们场所的访客；
管理为我们工作的中介派遣、借调及合约员工的工作、考勤、督导及安全；
我们的上市母公司所要求的内部控制、审计及集团报告（包括 J-SOX）；
管理全集团共享的服务、系统及职能；以及
确立、行使及捍卫法律权利及申索。

您可联系我们的个人资料保护主任，以进一步了解我们依据合法利益的情况。

4.5 业务改进。 在适用法律允许的情况下，我们可在未经同意的情况下，为以下业务改进目的使用个人资料，并在适用法律允许的情况下，在属于关联法团的集团公司之间共享：改进或开发货品、服务、流程及营运方法（包括自动化工具及AI工具）；了解及理解客户的行为及偏好；以及识别或个性化可能适合我们客户的货品及服务。

4.6 经通知视为同意。 在适用法律允许的情况下，我们可基于经通知视为同意，按照适用法律规定的方式，为新目的收集、使用或披露个人资料。

4.7 撤回同意并不影响根据适用法律无需同意而允许或规定进行的任何收集、使用或披露。

5. 我们向谁披露个人资料

5.1 为本通知所述的目的，我们可向新加坡境内或境外的接收方披露个人资料，包括但不限于：

其他集团公司，以及我们的母公司 Yoshimura Food Holdings K.K.（日本）及其在日本、马来西亚及其他地方的其他子公司及关联公司；
服务提供者、代理人及承包商，包括以下服务的提供者：物流、送货、仓储及冷链服务；资讯科技、云端托管、资料储存及备份；ERP（包括 Odoo）；电邮、协作及生产力工具（包括 Microsoft）；软件开发及托管（包括 GitHub）；通讯、电话及社交媒体（包括 Meta（WhatsApp、Facebook、Instagram）、Tencent（微信 (WeChat)）、Telegram、LINE 及SMS网关及其解决方案提供者）；人工智能及数据分析（包括 Anthropic）；电子发票及数据交换（包括 InvoiceNow/Peppol 接入点及EDI服务提供者）；人力资源、薪资、考勤及福利系统（包括 Whyze）；付款处理；印刷、邮寄及文件销毁；保安、闭路电视及门禁；招聘、背景调查及医疗服务；培训及差旅；以及保险；
银行、金融机构、付款及汇款服务提供者、发卡机构及贸易融资提供者；
信贷资料机构、信用保险公司、商业推荐人、讨债公司及担保人；
专业顾问，包括律师、审计师（包括我们母公司的审计师）、税务顾问、公司秘书及顾问；
保险公司、保险经纪及理赔师；
您的雇主、公司、业务伙伴、授权代表，以及在紧急情况下您的紧急联系人；
客户、供应商、零售商、电商平台、订购平台营运商、分销商、制造商及品牌拥有者，以订单、送货、场地出入、促销、索赔、可追溯性或产品回收所需为限；
要求提供推荐信或雇佣核实的潜在雇主或核实方；
新加坡境内或境外的法院、审裁处、监管机构、政府及法定机构及执法机构（包括人力部、公积金局、内陆税务局、会计与企业管制局、移民与关卡局、新加坡关税局、新加坡食品局、警方及个人资料保护委员会），以及接收基金捐款的自助团体；
与我们全部或部分业务或资产的任何合并、收购、出售、转让、融资、上市或重组有关的潜在及实际收购方、买方、继承方、投资者、融资方、受让人及其顾问；以及
您已同意的任何其他人士，或法律允许或规定向其披露的任何其他人士。

6. 向新加坡境外转移

6.1 我们可将个人资料转移至新加坡境外的国家和地区，并在该等国家和地区储存或处理，包括但不限于：日本（我们的母公司及其集团）；马来西亚（我们的关联公司）；我们的服务提供者及其次级处理者营运所在的国家，可能包括美国、欧盟、英国、澳大利亚、印度、中华人民共和国（包括与微信 (WeChat) 有关者）及香港；以及我们的海外供应商、制造商、品牌拥有者、物流服务提供者及客户所在的国家，以与我们和他们的往来相关者为限。

6.2 如我们将个人资料转移至新加坡境外，我们会按照适用法律的规定进行。

7. 人工智能及自动化处理

7.1 我们使用自动化工具及AI服务（包括由第三方提供者），用于以下目的：阅读、分类、分派及摘要电邮、信息及文件（例如订单、采购订单、发票、送货文件、收据、索赔及人力资源信函）；提取信息；拟备报价单、回复、信函及报告的草稿；回答问题；分析闭路电视影像（包括按第33.7段所述通过人脸识别）及营运数据；以及侦测错误、异常及欺诈。这些工具可能会处理上述材料中所含的个人资料。如这些工具协助作出有关信贷、雇佣或纪律处分的决定，将有人员参与作出该决定。

8. 录音及监控

8.1 您与我们之间的电话、网上会议及视频通话可能会被录音或转录为文字。您通过任何渠道（包括但不限于电邮、SMS、WhatsApp 及微信 (WeChat)）发送给我们的信息、聊天内容、语音信息及附件，可能会作为业务记录保存。

8.2 我们的场所及车辆受闭路电视及其他摄像头监控，详见E部分。雇员亦应阅读D部分第29段。

9. 保护

9.1 我们按照适用法律的规定，保护我们管有或控制的个人资料。

9.2 任何通过互联网传输或电子储存的方法均非绝对安全，我们无法保证绝对安全。您有责任妥善保管我们提供给您的任何登录资料，并只通过安全渠道向我们发送敏感信息。

10. 准确性

10.1 我们依赖您或您的代表所提供的个人资料。请确保该等资料准确、完整及最新，并在有任何变更时通知我们。在法律允许的范围内，对于因向我们提供的个人资料不准确或不完整而引致的损失，我们概不负责，但如损失是由我们违反适用法律或我们的疏忽所致，则在该范围内不适用。

11. 保留

11.1 我们在收集个人资料的目的所需期间内保留个人资料，或在法律、监管、会计、税务、审计、保险或业务目的所规定或允许的期间内保留，包括可提出或抗辩申索的任何期间，以及适用法律另行规定或允许的期间。

11.2 我们可无限期保留匿名化资料。

12. 您的权利

撤回同意

12.1 您可向我们的个人资料保护主任发出合理通知（例如通过电邮），或（如您是雇员或求职者）向人力资源部发出合理通知，撤回您对我们收集、使用或披露您个人资料的同意。撤回同意可能意味着（包括但不限于）我们无法再供应货品或服务、提供信贷、考虑您的求职申请或继续与您的关系，以及有关终止的合同条款将会适用。我们会按照适用法律的规定处理您的请求。

12.2 撤回同意并不影响撤回之前已进行的处理。

查阅及更正

12.3 您可按照适用法律的规定，要求查阅或更正您的个人资料。

12.4 我们可在适用法律允许的范围内就查阅请求收取费用，并可在费用获同意之前不处理有关请求。

12.5 我们会在适用法律规定的时间内回应请求。在适用法律允许的情况下，我们可拒绝全部或部分请求。

12.6 我们可在处理请求前核实您的身份，并只在确信第三方已获授权代表您行事时，才处理该第三方提出的请求。

13. 个人资料保护主任及投诉

13.1 有关本通知或我们处理个人资料的疑问、请求及投诉，应发送给我们的个人资料保护主任：

电邮	dpo@y-food-h-asia.com

13.2 我们按照适用法律的规定处理投诉。

14. 责任限制

14.1 在适用法律允许的最大范围内，对于因任何未经授权查阅、收集、使用、披露、复制、修改、处置或遗失个人资料而引起的任何损失、损害、费用或开支，如其由以下情况所致，本集团在该范围内概不负责：

并非作为我们资料中介行事的任何第三方的作为或不作为，包括黑客及其他不法分子、电信及互联网服务提供者，以及通讯、社交媒体及云端平台；
您本人通过电邮、通讯应用程序、传真或任何其他并非完全安全的方式向我们传送个人资料，或要求我们以该等方式向您发送个人资料；
您本人的设备、账户、密码、网络或系统，或您未能妥善保管任何登录资料；
您已公开或与他人分享的个人资料；或
超出我们合理控制范围的事件，

但如损失是由我们违反适用法律或我们的疏忽所致，则在该范围内不适用。

14.2 本通知并不排除或限制根据适用法律不能排除或限制的任何责任。

15. 管辖法律、语言及可分割性

15.1 本通知受新加坡法律管辖。

15.2 本通知以英文及简体中文发布。如两个版本之间有任何不一致之处，概以英文版本为准。如您不明白本通知的任何部分，可联系我们的个人资料保护主任，雇员亦可联系人力资源部。

15.3 可分割性。 如本通知的任何条文或条文的任何部分被裁定为无效、不合法或不可执行，该条文或该部分应被视为已删除，本通知其余部分继续有效。

16. 本通知的修订

16.1 我们可随时更新或修改本通知，并可以我们认为适当的任何形式将更新通知您，包括将更新后的通知连同更新日期发布于我们的网站。如适用法律有所规定，我们亦会张贴通告，或使用我们记录中的联系资料（例如通过电邮、SMS或通讯应用程序）联系您，或取得您的同意。请定期查阅本通知。

B部分 – 客户、供应商、业务联系人、访客及网站用户

17. 我们收集的个人资料

17.1 视乎您与我们的往来方式，我们收集的个人资料包括但不限于：

身份及联系资料：姓名、别名、职衔、公司、商业及个人电话及手机号码、电邮地址、邮寄、账单及送货地址、通讯及社交媒体识别信息（例如 WhatsApp 号码、微信 (WeChat) ID、Telegram 及 LINE 账号，以及账户名称及头像），以及签名（手写、电子或数码签名）；
身份证明资料：身份证/准证号码（NRIC/FIN）、护照或其他身份证明号码（例如用于担保、独资经营者的信贷申请或法律程序）；
交易及账户资料：询价、报价、订单、采购订单、合同、送货、送货单及送货证明（包括照片、印章及签名）、退货、信用票据、索赔、发票、账户结单、付款记录、价格、回扣及促销；
财务及信贷资料：银行账户及付款资料、信贷申请及额度、商业推荐、担保、会计与企业管制局（ACRA）及公共登记册信息、信贷资料机构及信用保险公司报告、未付款项、付款安排及追债记录；
通讯：电邮、信函、传真、语音信箱、SMS，以及通过任何通讯或社交媒体应用程序发送的信息（包括语音信息、图片、视频及文件）、通话记录，以及通话及会议录音和文字记录；
影像及录像：在我们的场所、送货时、贸易展及活动中拍摄的闭路电视及摄像头录像、照片及视频，以及使用人脸识别时的人脸影像及模板（见E部分）；
车辆及送货资料：送货路线及时间、车辆位置（GPS）及远程信息数据，以及行车记录仪录像；
访客资料：姓名、公司、联系号码、车辆号码、来访目的、进出时间，以及健康及安全声明；
网上资料：IP地址、设备识别码、设备及浏览器信息、大致位置、Cookies、像素标签及类似技术、浏览的页面、点击的链接、电邮打开记录，以及与我们的网站、网上商店、社交媒体页面及通讯渠道的互动；
偏好及反馈：产品偏好、调查回复、投诉及反馈；以及
其他资料，即您或您的代表提供的，或我们在与您往来过程中取得的其他资料。

17.2 如您不提供我们所需的个人资料，我们可能无法开立或维持账户、提供信贷、接受订单、送货、付款或收款，或以其他方式与您往来。

18. 目的

18.1 我们为以下目的，收集、使用及披露本部分所涵盖个人的个人资料：

(a) 供应货品与服务及管理业务关系

处理通过任何渠道收到的询价、报价、订单及采购订单，包括零售商订购平台、EDI、电子发票及通讯应用程序；
拣货、包装、送货、收取及安装货品和设备，提供维修保养及售后服务，安排及追踪送货，以及记录送货证明；
开具发票、发出账户结单、收取款项，以及处理退货、信用票据、回扣、促销、保修及索赔；
开立、管理、审核及关闭客户和供应商账户，以及设定付款条件及信贷额度；
采购货品及服务、管理供应商及承包商，以及审批及支付款项；
以任何方式（包括但不限于邮寄、电邮、电话、传真、SMS、WhatsApp、微信 (WeChat) 及其他通讯应用程序和社交媒体）就订单、送货、账户、付款、产品信息、产品回收、食品安全、我们业务的变更及服务事宜与您沟通；
回应及处理询问、请求、投诉及反馈；

(b) 信贷、风险及追讨

评估信用状况及信贷申请，设定及审核信贷额度和条件，以及取得及执行担保和抵押；
发送付款提醒及结单、追收逾期款项，以及委托讨债公司、律师及信用保险公司；
预防、侦测及调查欺诈、不当行为、盗窃、非法活动及违反我们条款的行为；
对客户、供应商及其东主、董事和担保人进行尽职调查、制裁筛查、反贿赂及交易对手核实；

(c) 营运、保安及安全

管理我们的场所、仓库、冷库、工厂、车辆、系统及资产的出入和安全，包括通过闭路电视、摄像头及访客登记；
工作场所安全与卫生、食品安全与卫生、可追溯性、质量控制、产品回收及事故调查；
营运、维护、保护、测试及改进我们的资讯科技、ERP、电邮、通讯、网站及自动化工作流程；

(d) 业务管理及改进

记录保存、会计、财务报告、预算、审计、内部控制（包括 J-SOX 及我们上市母公司的其他要求）、合并报表及集团报告；
分析销售、客户、产品、定价、收款及绩效，以及编制管理报告；
改进及开发我们的货品、服务、流程及营运方法，包括开发及测试自动化工具及AI工具；
了解客户行为、偏好及市场趋势，以及识别可能适合客户的货品及服务；
管理、重组、合并、出售或转让我们的全部或部分业务或资产，包括尽职调查；
在活动、贸易展及送货时拍摄照片及视频，并将其用于内部沟通，以及在法律规定须取得同意时经同意后用于我们的宣传、网站及社交媒体；

(e) 法律及监管

遵守法律、法规、守则、指引、执照条件，以及法院、监管机构、政府机构及执法机构的命令和要求；
确立、行使及捍卫法律申索，以及回应法律程序、调查及争议；
获取专业意见；

(f) 营销（仅在允许的情况下，见第20段）

发送有关我们的货品、服务、促销、价目表、新产品及活动的信息；

(g) 相关目的

与上述任何目的合理相关或附带，并在收集您的个人资料时已告知您的任何其他目的。

19. 其他个人的个人资料

19.1 如您向我们提供其他个人的个人资料（例如您的员工、东主、担保人、家属或送货联系人），即表示您确认已告知他们本通知，并已取得我们为本通知所述目的收集、使用及披露其个人资料所需的任何同意。如我们与您之间的往来受载有此项规定的合同约束，您亦同意就因您未能做到这一点而引致的任何申索、损失或罚款向我们作出弥偿。

20. 营销、谢绝来电及垃圾信息规则

20.1 我们在适用法律（包括PDPA的谢绝来电条文及《2007年垃圾邮件管制法令》）允许的情况下，以任何方式（包括但不限于语音通话、SMS、MMS、传真、电邮、WhatsApp、微信 (WeChat) 及其他通讯应用程序）发送营销信息。

20.2 您可随时通过信息中所述的方式或联系我们取消订阅。取消订阅营销信息不会停止有关订单、送货或您账户的服务信息。

21. 网站、Cookies、社交媒体及儿童

21.1 我们的网站及电邮可能使用 Cookies、像素标签及类似技术，以便运作、记住偏好、衡量使用情况，以及在适用法律要求时经您同意后，在其他网站及社交媒体（包括通过 Meta 及 Google）向您显示相关广告。您可在浏览器设置中阻止或删除 Cookies，但部分功能可能因此无法使用。

21.2 我们的网站及社交媒体页面可能链接至或嵌入第三方内容（包括但不限于 Facebook、Instagram、WhatsApp、微信 (WeChat)、YouTube 及 Google Maps），该等第三方可能根据其自身政策收集资料。

21.3 我们的货品、服务及网站以企业及成年人为对象，并非针对儿童。未经父母或监护人同意，我们不会在知情的情况下直接向未满13岁的儿童收集个人资料。如父母或监护人认为儿童曾向我们提供个人资料，应联系我们的个人资料保护主任。如您未满18岁并向我们求职或为我们工作（例如作为实习生或受训人员），而您可能未能充分理解给予同意的性质及后果，我们可要求您的父母或监护人代表您给予同意。

C部分 – 求职者

22. 我们收集的个人资料

22.1 我们收集应征职位、实习及受训职位的申请人的个人资料，包括但不限于：姓名及联系资料；在新加坡工作的资格；教育、资历、技能及工作经历；薪资记录及期望；履历内容；面试记录、评估及测试结果；推荐信；以及在招聘过程中有需要时，身份证明号码、出生日期以及背景调查、推荐人查核及入职前体检的结果。

23. 目的

23.1 我们为以下目的使用申请人的个人资料：评估申请人是否适合所申请的职位及招聘期间本集团其他空缺职位，以及（如您同意）未来的职位；就申请事宜进行沟通；核实身份、资历、工作经历及推荐，并进行背景及入职前检查；发出及处理聘用通知并为入职作准备；遵守法律，包括公平雇佣规定；确立或抗辩法律申索；以及改进我们的招聘流程。我们可能使用自动化工具及AI工具协助整理及摘要申请。

24. 求职者资料的保留

24.1 如您未获聘用，我们可在招聘及相关法律目的合理所需的期间内保留您的申请；如您同意（例如最多保留24个月以便考虑未来的职位），则保留更长时间；其他情况则按适用法律允许的方式保留。如您获得聘用，您的申请将根据D部分成为您雇员记录的一部分。

24.2 纯粹为评估目的而保存的意见资料，例如推荐人的评语及面试评估，根据PDPA可获豁免查阅及更正。

D部分 – 雇员

25. 本部分的适用范围

25.1 本部分适用于任何集团公司的现任及前任雇员、实习生、受训人员、临时、兼职、中介派遣及借调员工。本部分应与《员工手册》及您的雇佣合同一并阅读；本部分不具合同性质。本部分自交给您或以其他方式向您提供之时起适用，无论您是否签署任何确认书。对于并非受雇于集团公司的中介派遣、借调及合约员工，我们为第27.1段所述与其派驻工作相关的目的处理其个人资料，依据为：视为同意（包括其雇主或中介为履行其与该员工之间的合同而合理需要向我们提供资料的情况）、第4.3段所述适用于他们的例外情况（雇佣关系例外除外），以及第4.4段所述的合法利益。

26. 我们收集的个人资料

26.1 我们在您受雇之前、期间及之后收集关于您的个人资料，包括但不限于：

身份及联系：姓名、身份证/准证号码（NRIC/FIN）/护照号码及身份证明文件副本、准证资料、出生日期及出生地、年龄、性别、国籍、种族、照片、签名、住址、个人电话、电邮及通讯应用程序识别信息（例如 WhatsApp 及微信 (WeChat)），以及紧急联系人；
家属及受抚养人：为福利、保险、假期及税务目的所需的婚姻状况，以及配偶、子女及受抚养人的资料；
招聘：申请、履历、资历、工作经历、推荐信、面试记录，以及背景和入职前检查结果；
雇佣及薪酬：职衔、职级、部门、工作地点、合同条款、薪金、津贴、花红、佣金、奖励、公积金及自助基金捐款、税务资料、银行账户资料、福利、报销申请、偿付款项及公司信用卡交易；
工时及考勤：工作时间、轮班、加班、假期、缺勤，以及考勤及门禁记录，包括通过指纹、卡片或人脸识别系统采集的记录；
健康：病假证明、入职前及定期体检、工作适任评估、在法律规定或为工作场所安全合理需要时的疫苗接种状况、受伤及事故报告，以及保险索赔；
生物识别资料：用于考勤、门禁及保安的指纹、人脸及类似模板，包括人脸识别（见E部分）；
绩效及操守：考核、目标、关键绩效指标、从我们系统中提取的生产力、准确度及活动数据、培训记录、纪律记录、申诉、调查及举报报告；
资讯科技及通讯：用户ID、登录、活动及审计跟踪日志，以及您的工作电邮、Microsoft Teams 聊天、文件、通话及会议（包括所作的录音及文字记录）的内容。还包括 WhatsApp、微信 (WeChat)、Telegram 及其他通讯应用程序上与工作相关的信息及群组（无论在公司设备还是个人设备上），以及您对互联网、公司电话、设备及应用程序的使用；
影像及位置：闭路电视及摄像头录像（包括在有标示的情况下的音频）、在工作场所或公司活动中拍摄的照片及视频，以及来自公司车辆、设备及送货应用程序的位置及远程信息数据；
外籍雇员：准证申请、住房及宿舍、保证金、医疗保险及遣返；以及
离职：辞职及终止雇佣记录、离职面谈、最后薪金及推荐信。

27. 目的

27.1 我们为以下目的收集、使用及披露您的个人资料，该等目的对于订立、管理及终止您的雇佣关系属合理：

招聘及入职，以及核实身份、资历、工作资格及推荐；
管理您的合同、薪金、津贴、佣金、花红、福利、公积金、自助基金捐款、所得税、保险、医疗及牙科福利、假期及报销申请；
申请、更新及取消准证，以及遵守人力部的规定，包括有关外籍雇员住房及医疗的规定；
管理工作时间、考勤、轮班、加班及排班；
绩效管理、考核、晋升、薪酬、培训、职业发展、接班及人力规划；
利用来自我们系统的数据，衡量及报告团队和个人的生产力、工作量、准确度及服务水平，并在内部仪表板及屏幕上显示团队结果；
管理操守及纪律、申诉、调查、举报报告、争议及法律申索；
工作场所安全与卫生、食品安全与卫生、工作适任、事故报告及工伤赔偿；
场所、车辆、存货、系统及信息的安全，包括通过闭路电视、摄像头、门禁及第29段所述的监控；
管理及支持资讯科技、ERP、电邮、通讯及自动化工作流程，包括第7段所述的AI工具；
内部沟通、员工名录、组织架构图、公司活动及表彰；
业务管理、会计、审计、内部控制（包括 J-SOX）、集团报告、预算、借调、集团内部调动及重组；
遵守法律以及政府机构、监管机构、法院及执法机构的要求；
雇佣结束后：最后薪金及福利、推荐信及雇佣核实、前员工联系（经您同意）、记录保存及申索；以及
与上述任何目的合理相关或附带，并在收集您的个人资料时已告知您的任何其他目的。

28. 宣传用途的同意

28.1 如适用法律有所规定，在将您的姓名、照片、肖像、视频或声音用于对外宣传（包括但不限于我们的网站、社交媒体、宣传册、广告及招聘材料），或用于与您的雇佣关系无合理关联的任何其他目的之前，我们会取得您的同意。您可随时以书面形式通知人力资源部或我们的个人资料保护主任撤回该同意。撤回后，我们无需收回已分发的印刷材料或他人已转发的内容。

29. 监控

29.1 我们的资讯科技系统、网络、电邮账户、Microsoft Teams、公司通讯账户，以及公司设备、电话及车辆均为业务目的而提供。您不应期望您在其上创建、储存、发送或接收的任何内容（包括您对其作出的任何个人用途）享有隐私。本段不适用于您的个人设备；个人设备由第29.2段处理。

29.2 我们可在不另行通知的情况下，以人工或自动化方式（包括AI工具）监控、查阅、审阅、复制、记录、保留及披露以下内容，包括但不限于：

工作电邮账户及邮箱（包括共享邮箱及前雇员的邮箱）、Teams 聊天及频道、文件及文档；
公司电话号码及公司通讯账户（包括用于工作的 WhatsApp Business 及微信 (WeChat) 账户），以及任何通讯应用程序上与工作相关的信息及群组，包括用于工作的个人设备上的信息及群组，以与我们业务相关者为限。个人设备上与工作相关的内容，只会从我们管理的工作账户及群组取得，或由您应我们要求出示。未经您的许可，我们不会查阅您的个人设备；
系统、登录、ERP及审计跟踪活动、互联网使用及设备使用；
已启用并已标示录音或文字转录的通话及网上会议；
工作区域、出入口、仓库、冷库、生产区、装卸区、停车场、车辆及宿舍公共区域的闭路电视及摄像头录像，以及按第33.7段所述仅在出入口、限制区域及考勤点使用的人脸识别；以及
公司车辆及设备的位置及远程信息数据。

我们为以下目的这样做：保安；预防及侦测不当行为、欺诈及资料外泄；合规；调查；业务连续性（例如在您缺勤或离职时）；处理客户及供应商事宜；质量控制；生产力及流程分析；以及记录保存。

30. 闭路电视分析

30.1 我们可使用自动化工具及AI工具分析生产、仓库、装卸及送货区域的摄像头录像，以衡量及改进工作流程、产量、安全、卫生及流程效率。此类分析不用于宿舍区域。分析结果可以汇总、工作站层面或个人层面的形式，用于安全、保安、调查及绩效管理。针对已识别个人的分析绝不会作为纪律处分的唯一依据；任何行动均由经理在与该雇员一同审视事实后决定。

31. 您的义务

31.1 您必须确保您提供给我们的个人资料准确无误，并在有变更时及时通知人力资源部。在向我们提供您的家属、受抚养人、紧急联系人及推荐人的个人资料之前，您必须告知他们本通知，并取得任何所需的同意。

31.2 您必须按照我们的《个人资料保护手册》及您的雇佣条款处理客户、同事及其他人士的个人资料，并须立即向您的主管及个人资料保护主任报告任何实际或怀疑发生的资料泄露事件。违反规定可能导致包括解雇在内的纪律处分。明知或罔顾后果地未经授权披露个人资料、明知或罔顾后果地未经授权使用个人资料而导致任何人获利、他人受到伤害或他人蒙受损失，或明知或罔顾后果地在未经授权的情况下重新识别匿名化资料，均属PDPA下的罪行（第48D至48F条），可处最高S$5,000罚款或最长2年监禁，或两者兼施。

32. 雇员资料的保留及请求

32.1 我们在本部分所述目的所需的期间内，并按照适用法律的规定或允许，保留雇员记录。

32.2 查阅或更正您个人资料的请求根据第12段处理。

E部分 – 闭路电视及摄像头

33. 闭路电视及摄像头

33.1 我们的场所、车辆及营运可能受闭路电视及其他摄像头监控（可能使用人脸识别，见第33.7段），包括但不限于固定摄像头及云台变焦摄像头、车内或车上的摄像头（例如行车记录仪），以及用于工作的手持或穿戴式设备上的摄像头。在有标示的情况下，部分摄像头可能会录音。

33.2 摄像头的覆盖范围包括但不限于出入口、周界、停车场、装卸区、仓库、冷库、生产及包装区、办公室公共区域、走廊、宿舍公共区域，以及车辆内外。摄像头无意覆盖厕所、更衣室、淋浴区、宿舍卧室、祈祷室或哺乳室。

33.3 录像用于以下目的：保安；出入管制及考勤；预防及调查盗窃、欺诈、不当行为及非法行为；工作场所安全与卫生；食品安全、卫生及冷链合规；核实送货、装货及收货；质量控制及员工培训（使用雇员的录像，或将其他人士的影像模糊处理）；工作流程的营运分析（包括通过第30段所述的自动化工具及AI工具）；以及确立及抗辩法律申索。

33.4 为上述目的所需，录像可披露给警方及其他当局、保险公司、律师及第5段所列人士。

33.5 录像在上述目的所需的期间内，并按照适用法律的规定或允许予以保留。

33.6 您可根据第12段并在适用法律的规限下，要求查阅有关您本人的录像，我们可收取费用。

33.7 人脸识别。 我们可能在摄像头、门禁及考勤系统中使用人脸识别技术。人脸识别仅在出入口、限制区域及考勤点使用，不在宿舍、厕所、更衣室或车辆中使用。我们为以下目的使用人脸识别：

已登记员工的门禁及考勤；
就未获授权进入仓库、冷库及生产区等限制区域的人士发出警示；
通过将影像与曾涉及有记录的过往事件的人员名单进行比对，预防及调查盗窃及保安事件；以及
安全点名，例如在紧急情况下清点场内人员。

33.8 未获匹配人士的人脸资料会被及时删除；在对任何人采取任何行动之前，匹配结果须经人员审核；在合理可行的情况下，雇员可要求以其他方式进行考勤或出入；我们不会将人脸识别用于营销。除此之外，我们按照适用法律的规定保护人脸识别资料。

附表1 – 本通知涵盖的集团公司

公司	UEN	地址
Yoshimura Food Holdings Asia Pte. Ltd.	201912231E	1 Second Chin Bee Road, Singapore 618768
Sin Hin Frozen Food Private Limited	199605480G	1 Second Chin Bee Road, Singapore 618768
Sharikat National Food Pte. Ltd.	200906002K	1 Second Chin Bee Road, Singapore 618768
JSTT Singapore Pte. Ltd.	200613899R	1 Second Chin Bee Road, Singapore 618768

附表2 – 供应商个人资料保护条款

本条款构成任何集团公司提及本条款的每份采购订单、服务订单及供应商合同的一部分。

1. 范围。 每当供应商、承包商或服务提供者（”供应商“）代表发出订单或合同的集团公司（”公司“）并为其目的收集、接收、查阅、储存或以其他方式处理个人资料时，本条款即适用。如供应商为其自身目的从公司接收个人资料，则只适用第1、3、4、6、7、10、12、13、14及16条。除非公司另有书面同意，本条款优先于供应商就同一事项订立的任何不一致条款，包括供应商在订单之前或之后发出的任何报价、确认书、送货单或发票中的条款。

2. 指示。 供应商只可为提供所订购的货品或服务并按照公司有记录的指示处理公司的个人资料，而不得为其自身的任何目的处理该资料，但法律另有规定者除外；在此情况下，除非法律禁止，供应商须事先通知公司。

3. 保密。 供应商须确保只有需要该资料的员工才可查阅该资料，且该等员工受保密义务约束。

4. 安全。 供应商须以合理的安全安排保护该资料，至少包括：访问控制及多重身份验证；传输过程中加密，敏感资料并须在储存时加密；及时进行安全更新；备份；以及安全处置。

5. 分包商。 供应商须至少提前10个工作日以书面形式通知公司，方可委托分包商处理该资料，并须使任何分包商受保护程度不低于本条款的条款约束。如公司在该10个工作日内以合理的资料保护理由提出反对，供应商不得使用该分包商处理该资料。供应商须对其分包商的作为及不作为负责。如供应商因此无法在不使用该分包商的情况下提供服务，公司可书面通知终止受影响的订单或服务，而无须为此承担责任。

6. 转移。 供应商只可在新加坡以及订单所列明或以其他方式通知公司并经公司书面接受的国家和地区转移、储存或查阅该资料；未经公司事先书面同意，不得在任何其他国家或地区转移、储存或查阅该资料。供应商本身须对该资料提供至少与PDPA所规定的保护相当的保护标准，并须确保其向之转移该资料或允许其查阅该资料的每一人士均受具法律约束力的义务约束，对该资料提供至少与PDPA所规定的保护相当的保护标准。

7. 泄露通知。 供应商在知悉任何影响该资料的实际或怀疑资料泄露事件后，须无不当延迟地，且无论如何在24小时内，通过 dpo@y-food-h-asia.com 通知公司，并须提供公司合理需要的一切信息及配合。

8. 请求及调查。 供应商须及时协助公司回应查阅、更正及撤回同意的请求、投诉以及个人资料保护委员会的调查。

9. AI。 供应商不得使用该资料训练或改进任何人工智能模型，且在任何AI系统中保留该资料的时间不得超过提供服务所需的时间。

10. 交还及删除。 在服务结束时或应要求，供应商须交还或安全删除该资料，并以书面形式确认，但法律规定须保留者除外。

11. 信息及审计。 供应商须提供为证明合规而被合理要求的信息，包括认证及安全报告。

12. 责任。 在法律允许的范围内，对于因供应商违反本条款或PDPA而引致的一切损失、罚款、申索及费用，供应商须向公司作出弥偿。

13. 法律。 本条款受新加坡法律管辖。

14. 持续有效。 第2至11条（以适用于供应商者为限）在订单或服务结束后，只要供应商或任何分包商仍持有该资料，继续有效。第12及13条继续有效，不受时间限制；第15条在服务结束后继续有效两年。订单或服务的结束不影响任何已产生的权利或责任，亦不影响就结束前发生的违约根据第12条提出的任何申索（不论损失何时产生）。

15. 保险。 代表公司处理个人资料的供应商须向信誉良好的保险公司投保网络安全保险及专业责任保险，保额须与所提供的服务相称并属合理，并须应要求提供投保证明。

16. 释义。 ‘PDPA’指新加坡《2012年个人资料保护法令》及其附属法例（经不时修订）；’个人资料’及’资料泄露’具有PDPA所赋予的含义；’该资料’指供应商根据订单或与订单有关而代表公司收集、接收、查阅、储存或以其他方式处理的个人资料，或从公司或经由公司接收的个人资料，但不包括供应商纯粹为其自身目的而处理的其本身员工或客户的个人资料。

生效日期：2026年10月7日 · 最后更新：2026年10月7日