Privacy Policy
FORT DIGITAL PTE LTD
PRIVACY POLICY AND PERSONAL DATA PROTECTION NOTICE
This Privacy Policy describes how Fort Digital Pte Ltd (“Fort Digital”, “we”, “us” or “our”) collects, uses, discloses, processes, stores, transfers, protects and otherwise handles personal data in connection with our websites, products, systems, applications, APIs, equipment, software, support services and other services.
This Policy should be read together with any applicable quotation, service agreement, subscription agreement, project requirements, data-processing terms, acceptable-use terms or other contractual document between Fort Digital and its customer.
Where a customer agreement contains specific data-protection requirements applicable to a particular project, those requirements will apply to that project together with this Policy, and the contractual terms will prevail to the extent of any inconsistency where legally permissible.
1. Our Approach to Personal Data
Fort Digital’s systems are generally designed to collect and process only the information reasonably required for the particular service or customer project.
Fort Digital does not seek to collect personal data merely for the purpose of accumulating, profiling or selling information about individuals.
The type and amount of information processed by Fort Digital may differ substantially from one project to another because many Fort Digital solutions are configured according to the customer’s requirements.
For example, a customer may configure a system to request only a name and mobile number, while another customer may choose to request additional information for event registration, queue management, access control, lucky draws, voting, RSVP, notifications, GPS monitoring or another authorised purpose.
Where a customer determines what information is collected and why it is collected, the customer is responsible for those decisions.
2. Fort Digital’s Role: Organisation and Data Intermediary
Depending on the circumstances, Fort Digital may act either as an organisation determining the purposes for which personal data is processed or as a data intermediary processing data on behalf of another organisation.
Customer-controlled data
Where a customer uses a Fort Digital service to collect, store, transmit, manage or otherwise process information concerning the customer’s employees, customers, event participants, visitors, members, recipients or other persons, and the customer determines the purposes and means of that processing:
the customer is the organisation responsible for the relevant collection and use of the personal data, and Fort Digital generally acts as the customer’s data intermediary.
In this capacity, Fort Digital processes the information for purposes such as:
* providing and operating the contracted service;
* transmitting or routing information according to customer instructions;
* hosting or storing customer data where applicable;
* technical support and troubleshooting;
* system maintenance and security;
* backups and disaster recovery where applicable;
* implementing authorised customer configurations;
* preventing abuse or unauthorised use; and
* complying with applicable law.
Under Singapore’s PDPA, data intermediaries have independent obligations relating to the protection and retention of personal data and must inform their customer without undue delay when they have credible grounds to believe that a relevant data breach has occurred. ([PDPC][3])
Data processed by Fort Digital for its own purposes
Fort Digital may act as the responsible organisation for information used for purposes such as:
customer account management, quotations, contracts, billing, warranty administration, technical support records, security monitoring, fraud prevention, legal compliance, supplier management, business communications and administration of Fort Digital’s own websites.
3. Customer Responsibility for End-User Data
Where personal data is submitted to Fort Digital by or on behalf of a customer, the customer is responsible for ensuring that it has all necessary authority to collect and provide that information to Fort Digital.
The customer is responsible for, as applicable:
* determining what personal data should be collected;
* establishing a lawful purpose for collecting it;
* providing appropriate privacy notices;
* obtaining consent where consent is required;
* determining whether another lawful basis or statutory exception applies;
* ensuring data provided is appropriate and not excessive;
* ensuring data is accurate where accuracy is material;
* determining authorised recipients;
* controlling user permissions;
* selecting applicable retention periods;
* responding to its own data subjects where it remains responsible for the data;
* complying with marketing and telecommunications requirements;
* ensuring that message content and recipient lists are lawful; and
* providing Fort Digital only with lawful instructions.
A customer’s use of a Fort Digital system does not transfer the customer’s own statutory obligations to Fort Digital.
Fort Digital may refuse, suspend or discontinue processing instructions that we reasonably believe are unlawful, fraudulent, abusive, technically unsafe, inconsistent with a contractual agreement or likely to compromise the security or rights of another person.
4. Types of Personal Data We May Process
Depending entirely on the applicable service or customer configuration, personal data may include:
Identification and contact information, such as name, mobile number, telephone number, email address, company, job title or other contact details.
Event and registration information, such as RSVP status, event session, seat assignment, queue number, check-in status, lucky draw number, voting response, polling response, submitted question or other event-related information.
Photographs or media, where a customer specifically enables a function such as selfie registration, photo greeting, award photography, visitor management or another image-based application.
Messaging information, including recipient numbers or addresses, message routing information, delivery information and, where technically necessary to provide the service, message content.
Location information, where the customer or user activates a GPS tracking or location-based product.
Device and sensor information, such as device identifiers, status information, alarms, sensor readings, connectivity information and system events.
Technical information, such as IP address, browser information, device information, login records, timestamps, API activity, diagnostic logs and security logs.
Commercial and administrative information, such as quotation details, invoices, payment status, subscription information, warranty information and support correspondence.
Other information specifically requested by a customer, where Fort Digital has been instructed to configure a system for that customer’s legitimate project requirements.
Fort Digital does not intentionally require sensitive or high-risk personal information unless it is genuinely required for a service and lawful instructions have been provided.
Customers should not submit unnecessary sensitive information to Fort Digital systems.
5. Payment Information
Where payments are processed using an external payment gateway, acquiring bank, card network or payment service provider, payment credentials may be transmitted directly to that provider.
Fort Digital may receive transaction information such as:
payment status, transaction reference, amount, date, payment method or settlement information.
Unless a particular service expressly states otherwise, Fort Digital does not require customers to provide full payment-card numbers to Fort Digital for storage.
Third-party payment processors are responsible for information they independently process under their own contractual and privacy arrangements.
6. Why We Collect, Use or Disclose Personal Data
Where applicable, Fort Digital may process personal data to:
provide requested products and services; perform customer contracts; configure and operate systems; authenticate users; transmit communications; manage registrations and events; process queue, visitor, voting or lucky-draw functions; provide monitoring or alerts; provide technical support; investigate faults; maintain system security; prevent fraud and misuse; process payments and billing; administer warranties; communicate service information; fulfil regulatory and legal obligations; establish or defend legal claims; respond to lawful authorities; and perform other purposes reasonably connected with the purpose for which the information was provided.
Under the PDPA, organisations generally must inform individuals of the purposes for which personal data is collected, used or disclosed and must limit processing to purposes that a reasonable person would consider appropriate, subject to statutory exceptions and other permitted bases. ([PDPC][4])
Fort Digital may also process personal data without fresh consent where permitted by applicable law, including where consent is deemed or an applicable statutory exception or permitted basis applies.
7. Data Minimisation
Fort Digital encourages customers to configure their projects to collect only information that is genuinely required.
Where a service can operate without a particular category of personal data, customers are encouraged not to request that information.
Customers remain responsible for deciding which fields they require from their end users.
8. Messaging Services — SMS, WhatsApp, Email, Calls and Notifications
Fort Digital provides communications technology including APIs and systems capable of transmitting SMS, WhatsApp, email, voice calls, notifications and similar communications.
In customer-initiated messaging campaigns, Fort Digital generally provides the technical infrastructure while the customer determines:
the recipients, content, timing, purpose and legal basis for the communication.
Accordingly, customers are responsible for ensuring that their contact lists and communications comply with the PDPA, applicable Do Not Call requirements, anti-spam requirements, telecommunications requirements and applicable platform policies.
For Singapore telephone numbers, the PDPA’s Do Not Call provisions generally restrict marketing messages to numbers listed on the DNC Registry unless an exception or valid consent applies. Opt-out requests must be honoured within the period required by law, currently 21 days in relevant circumstances. ([PDPC][5])
Fort Digital does not warrant that the mere technical ability to send a communication makes that communication lawful.
9. Service and Transactional Communications
Administrative or transactional communications may be sent where reasonably necessary to provide a requested service.
These may include:
registration confirmations, OTPs, queue notifications, appointment information, event confirmations, lucky draw numbers, operational alerts, payment confirmations, system alerts, maintenance notices and support communications.
These communications are different from promotional marketing communications.
10. Disclosure of Personal Data
Fort Digital may disclose or make personal data available only where reasonably necessary, including to:
telecommunications operators; messaging or communications platforms; hosting and cloud providers; payment processors; IT and cybersecurity providers; authorised subcontractors; equipment suppliers where necessary for support; professional advisers; insurers; auditors; banks; governmental or regulatory authorities; law-enforcement authorities; courts; and other parties where required or permitted by law.
Where Fort Digital processes customer-controlled data, disclosures will ordinarily occur according to the customer’s instructions or as necessary to provide the requested service.
We do not sell customer personal data as a business practice.
11. Third-Party Networks and Platforms
Some Fort Digital services necessarily interact with third-party networks or platforms, such as:
mobile network operators, Internet service providers, WhatsApp or other communications providers, email networks, payment networks, cloud providers and customer-owned systems.
Once information is transmitted to an independent third party, that third party may process information under its own legal obligations and privacy practices.
Fort Digital cannot control the security, availability, conduct or privacy practices of independent third-party networks and services.
Nothing in this section limits any responsibility that Fort Digital is legally required to assume.
12. International Transfers
Depending on the service and infrastructure used, personal data may be processed or stored outside Singapore.
Where the PDPA’s Transfer Limitation Obligation applies, Fort Digital will take appropriate steps required by law to ensure that transferred personal data receives a standard of protection comparable to that required under the PDPA, such as through legally enforceable obligations or other permitted mechanisms. ([PDPC][3])
Customers acknowledge that communications such as international SMS, email, WhatsApp traffic, cloud services or Internet services may technically involve infrastructure located in multiple jurisdictions.
13. Security
Fort Digital takes reasonable technical and organisational measures appropriate to the nature of the system and personal data concerned.
Measures may include, as applicable:
access controls, account authentication, encryption in transit, network controls, system hardening, security updates, logging, monitoring, vulnerability testing, malware protection, backups, restricted administrative access, password controls, staff procedures and vendor security controls.
The PDPA requires organisations to put in place reasonable security arrangements against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. ([PDPC][4])
However, no Internet-connected system, electronic transmission, wireless network, telecommunications network, software or storage technology can be guaranteed to be absolutely secure.
Accordingly, Fort Digital does not represent or warrant that unauthorised access, cyberattack, equipment failure, telecommunications failure or other security incident can never occur.
This does not exclude any obligation imposed by applicable law.
14. Customer Security Responsibilities
Customers must also take reasonable steps to protect systems and accounts under their control.
Customers are responsible for:
protecting usernames, passwords, API credentials, QR administration credentials and authentication tokens; restricting administrator access; securing their local network; securing end-user devices; removing access for former staff; using appropriate passwords; keeping customer-operated systems updated; notifying Fort Digital promptly of suspected compromise; and preventing unauthorised persons from using the service.
Fort Digital is not responsible for unauthorised access caused solely by customer-controlled credentials, systems, networks or devices to the extent permitted by law.
15. Retention and Deletion
Fort Digital does not intend to retain personal data indefinitely.
Personal data will be retained only for as long as reasonably necessary for:
the applicable customer project, provision of the service, contractual requirements, legitimate business needs, dispute resolution, security purposes, regulatory requirements, accounting or legal obligations.
The PDPA requires personal data to cease being retained, or to be anonymised, when retention no longer serves the purpose for which it was collected and is no longer necessary for legal or business purposes. ([PDPC][4])
Where Fort Digital acts as a data intermediary, project data may be returned, exported, anonymised or deleted in accordance with the customer’s instructions, the applicable service arrangement and legal requirements.
Where information is held in routine system backups, deletion from backup media may occur through the ordinary backup lifecycle rather than instantaneous deletion, provided the information is not restored or used for unrelated purposes except where reasonably necessary.
16. Anonymous and Aggregated Information
Where reasonably possible, Fort Digital may aggregate or de-identify technical or operational information so that it no longer identifies an individual.
Such information may be used for:
system performance analysis, troubleshooting, capacity planning, statistical reporting, product development and security improvement.
Fort Digital will not intentionally attempt to re-identify properly anonymised information except where legally permitted and necessary for legitimate security or compliance purposes.
17. Data Accuracy
Fort Digital relies substantially on customers and individuals to provide accurate information.
Where personal data is likely to be used to make a decision affecting an individual or disclosed to another organisation, reasonable steps should be taken to ensure that it is accurate and complete. ([PDPC][4])
Customers and users should promptly notify the responsible organisation if information supplied to a Fort Digital system is materially inaccurate or outdated.
18. Access to Personal Data
Subject to the PDPA and applicable exceptions, an individual may request access to:
personal data about that individual in Fort Digital’s possession or control; and
information concerning how such personal data was used or disclosed during the applicable period prescribed by law.
Under the PDPA, access generally includes information concerning use or disclosure within one year before the request. ([AGC Singapore][6])
Where Fort Digital holds the information solely as a data intermediary for a customer, Fort Digital may refer the request to the relevant customer or coordinate the response with that customer.
19. Correction of Personal Data
An individual may request correction of an error or omission in personal data about that individual that is in Fort Digital’s possession or control, subject to applicable statutory exceptions.
Where required, corrected information may also be transmitted to organisations to which the relevant information was previously disclosed in accordance with the PDPA. ([AGC Singapore][7])
20. Withdrawal of Consent
Where processing depends on consent, an individual may give reasonable notice withdrawing that consent.
Upon receiving a valid withdrawal request, Fort Digital will inform the individual of any likely consequences where required and will cease the relevant collection, use or disclosure after a reasonable period, unless continued processing is permitted or required by law.
Withdrawal of consent does not affect processing that occurred lawfully before withdrawal.
Withdrawal may also make it impossible for Fort Digital or the relevant customer to continue providing a service where the information is necessary for that service.
21. No General Statutory “Right to Erasure”
The Singapore PDPA does not create an unrestricted right requiring an organisation to erase every record merely upon request.
Nevertheless, individuals may request deletion, and Fort Digital will consider such requests in accordance with:
the Retention Limitation Obligation, applicable customer instructions, contractual requirements, legitimate business requirements and applicable law.
Fort Digital may retain information where retention remains reasonably necessary or legally required.
22. How to Exercise Your Rights
Requests should be made in writing to:
Data Protection Officer
Fort Digital Pte Ltd
Email: [support@fortdigital.com.sg](mailto:support@fortdigital.com.sg)
Website: [www.FortDigital.com.sg](http://www.FortDigital.com.sg)
The subject line should preferably state:
“Personal Data Request — Access”
“Personal Data Request — Correction”
“Personal Data Request — Withdrawal of Consent”
or
“Personal Data Request — Privacy Complaint”
The request should provide enough information for Fort Digital to identify the requester and locate the relevant information, including where appropriate:
full name; contact information; organisation or customer relationship; event/project/system involved; approximate dates; account or registration reference; description of the requested information; and the action requested.
Current regulations require access and correction requests to be made in writing with sufficient detail to enable the organisation to identify the applicant and relevant information with reasonable effort. ([AGC Singapore][8])
23. Identity Verification
To protect personal data from unauthorised disclosure, Fort Digital may require reasonable evidence of identity before responding to a request.
Verification may include:
confirmation using an existing registered email or telephone number; proof of identity; account verification; security information; or other reasonable evidence appropriate to the request.
Fort Digital may refuse to disclose personal data where the identity or authority of the requester cannot reasonably be established.
Any identity document supplied for verification should be limited to what is reasonably necessary, and Fort Digital may ask unnecessary information to be redacted.
24. Requests by Authorised Representatives
An individual may appoint another person to communicate with Fort Digital on his or her behalf where permitted by law.
A representative should provide:
1. satisfactory proof of the representative’s identity;
2. satisfactory proof of the data subject’s identity where appropriate;
3. a written and signed authorisation identifying the representative;
4. a clear description of the powers granted to the representative; and
5. any additional document reasonably necessary to verify authority.
The PDPC specifically recognises requests made on behalf of another individual and recommends obtaining appropriate authorisation, such as a letter of authorisation. ([PDPC][9])
Fort Digital may contact the individual directly to verify the authorisation where appropriate.
25. Parents, Guardians, Attorneys and Other Legal Representatives
Where a request is submitted by a parent, guardian, donee under a valid power of attorney, deputy, executor, administrator or other legal representative, Fort Digital may require documentary proof of the person’s legal authority.
Depending on the circumstances, this may include:
a guardianship document; court order; power of attorney; grant of probate; letters of administration; written authority; or other evidence reasonably sufficient to establish legal authority.
Fort Digital will disclose only information that the representative is legally entitled to receive.
Fort Digital may withhold information where disclosure would unlawfully reveal another person’s personal data, prejudice another person’s rights, breach confidentiality obligations or fall within a statutory exception.
The current Personal Data Protection Regulations also contain provisions governing the exercise of certain rights in respect of deceased individuals. ([AGC Singapore][10])
26. Response Time
Fort Digital will respond to valid requests as soon as reasonably possible.
Where an access or correction request cannot be completed within 30 days, Fort Digital will inform the requester in writing within that period of the estimated time by which a response will be provided, as required by the applicable regulations. ([AGC Singapore][11])
Complex requests may require additional time.
27. Fees for Access Requests
Fort Digital may charge a reasonable fee for processing an access request where permitted by law.
Where a fee applies, Fort Digital will provide an estimate before processing or before incurring the relevant charge.
The PDPA does not prescribe a standard fee; the amount should reasonably reflect the effort required to respond. ([PDPC][12])
Fort Digital may decline to provide access until an applicable fee has been accepted or paid where the law permits.
No fee will ordinarily be charged merely to submit a correction or privacy complaint.
28. Grounds for Limiting or Refusing Requests
Rights under the PDPA are subject to statutory exceptions.
Fort Digital may limit, redact or refuse a request where permitted or required by law, including where disclosure could:
reveal another person’s personal data; threaten another person’s safety; breach legal privilege; disclose confidential commercial information; reveal information generated in certain investigations or evaluative processes; conflict with a court order or legal restriction; be contrary to national interest; or fall within another applicable statutory exception.
Fort Digital may also request clarification where a request is so broad that the relevant information cannot reasonably be identified.
Where legally required, Fort Digital will inform the requester of an applicable exclusion.
29. Obligations of Individuals and Data Subjects
Persons using Fort Digital services should:
provide accurate information; not impersonate another person; not provide another person’s personal data without lawful authority; keep login credentials secure; use the service lawfully; avoid submitting unnecessary sensitive information; promptly correct materially inaccurate information; follow customer and Fort Digital security procedures; and notify the appropriate party promptly if unauthorised use is suspected.
Submitting another person’s information does not by itself establish authority to do so.
30. Personal Data Concerning Children
Fort Digital’s general commercial services are not designed specifically for children.
Where a customer chooses to operate an event, education, healthcare, family or other project involving minors, the customer is responsible for determining and implementing any consent, notification, parental or guardian requirements applicable to that project.
Fort Digital will process such information only as necessary to provide the relevant service and according to lawful instructions.
31. Data Breaches
Fort Digital maintains procedures for investigating suspected personal-data breaches.
Where Fort Digital is acting as a data intermediary and becomes aware of a relevant breach, Fort Digital will notify the responsible customer without undue delay where required under the PDPA. ([PDPC][3])
Where Fort Digital is responsible for determining whether a breach is notifiable, Fort Digital will assess the incident in accordance with applicable law.
A breach may require notification where it is likely to result in significant harm or is of significant scale. Where notification to the PDPC is required, the PDPC must generally be notified as soon as practicable and in any event no later than three calendar days after the organisation determines that the breach is notifiable. Affected individuals must also be notified as soon as practicable where required. ([PDPC][13])
32. Cookies and Website Information
Fort Digital websites may use cookies and similar technologies required for:
site operation, authentication, security, preferences, analytics and improving website performance.
Browser settings can generally be used to restrict cookies, although disabling necessary cookies may prevent certain site functions from operating correctly.
Where third-party website services independently collect information, their respective privacy policies may also apply.
33. Links to External Websites
Fort Digital websites or systems may contain links to external websites.
Fort Digital is not responsible for the privacy practices, security or content of independent websites merely because they are linked from a Fort Digital service.
Users should review the privacy policies of the relevant third party.
34. Automated Functions
Certain Fort Digital systems may automate operational tasks such as:
queue allocation, notifications, event check-in, random lucky-draw selection, alarm triggering, threshold monitoring or message routing.
Unless expressly stated otherwise, Fort Digital does not ordinarily use personal data to create behavioural profiles for the purpose of independently making decisions having legal or similarly significant effects on individuals.
Automated functions configured by customers operate according to the applicable customer-defined project requirements.
35. Business Transfers
If Fort Digital undergoes a merger, restructuring, acquisition, financing, transfer of business or sale of assets, information may be transferred to relevant parties where legally permitted and subject to appropriate confidentiality and data-protection safeguards.
36. Legal and Regulatory Disclosure
Fort Digital may retain, use or disclose information where reasonably necessary to:
comply with applicable law, regulation, licence conditions, court orders or regulatory directions; respond to lawful requests from governmental or enforcement authorities; investigate fraud, abuse or security incidents; protect legal rights; enforce contracts; or establish, exercise or defend legal claims.
Nothing in this Policy requires Fort Digital to disclose information where disclosure is prohibited by law.
37. Other Jurisdictions
Fort Digital is based in Singapore and this Policy is primarily designed around Singapore’s Personal Data Protection Act 2012.
Where mandatory privacy legislation of another jurisdiction applies to a particular processing activity, Fort Digital will comply with those requirements to the extent legally applicable.
Nothing in this Policy is intended to confer additional statutory rights where the applicable law does not provide them.
38. Complaints
Individuals who have concerns about Fort Digital’s handling of personal data should first contact the Data Protection Officer so that the matter can be investigated.
Fort Digital may ask the complainant to provide sufficient details to understand the complaint and verify identity where appropriate.
Where the matter concerns information controlled by a Fort Digital customer, Fort Digital may refer or coordinate the complaint with that customer.
Individuals may also approach the Personal Data Protection Commission where applicable.
39. Limitation Relating to Customer-Controlled Processing
To the fullest extent permitted by applicable law, Fort Digital is not responsible for:
a customer’s decision to collect particular personal data; a customer’s failure to obtain required consent or provide required notices; unlawful recipient lists supplied by customers; unlawful marketing content; inaccurate information supplied by customers or individuals; a customer’s independent disclosure of information; unauthorised use caused by customer-controlled credentials or systems; or processing undertaken by a customer outside Fort Digital’s systems.
Nothing in this provision excludes or limits any liability that cannot lawfully be excluded or limited.
40. No Guarantee of Absolute Security
Fort Digital will make reasonable security arrangements as required by applicable law.
However, no organisation can guarantee that electronic systems, telecommunications networks, wireless connections, Internet connections, third-party platforms or storage systems will be completely immune from:
cyberattack, malware, unauthorised access, telecommunications failure, software vulnerability, equipment malfunction, human error or other security incidents.
Accordingly, references to security in this Policy describe Fort Digital’s practices and obligations and do not constitute an absolute guarantee that a security incident can never occur.
41. Changes to this Policy
Fort Digital may amend this Privacy Policy from time to time to reflect:
changes in law, regulatory guidance, technologies, products, services, security practices or business operations.
The revised version will be published with an updated effective date.
Where required by law, additional notice or consent will be obtained before materially different uses of personal data are introduced.
42. Contact Details
Questions, requests and complaints concerning personal data should be directed to:
Data Protection Officer
Fort Digital Pte Ltd
Da Jin Factory Building 03-04
362 Upper Paya Lebar Road
Singapore 534963
Email: support@fortdigital.com.sg
Website: http://www.FortDigital.com.sg
Telephone: +65 6484 3863