Privacy Policy

1. Introduction & Data Protection Officer

PMOS Pte. Ltd. (UEN: 202400001A) ("PMOS", "we", "us", "our") is committed to protecting your personal data in compliance with the Personal Data Protection Act 2012 (PDPA) of Singapore. This Privacy Policy explains how we collect, use, disclose, and protect personal data obtained through our platform at pmos.asia and all associated subdomains.

Our Data Protection Officer (DPO) can be contacted at:

2. Personal Data We Collect

We may collect the following categories of personal data:

Category	Examples	Source
Identity Data	Full name, NRIC/FIN (last 4 characters only), job title	Registration forms, contracts
Contact Data	Email address, phone number, mailing address	Forms, business cards
Account Data	Username, password (hashed), role, preferences	Account creation
Transaction Data	Orders, invoices, payment records (no full card numbers stored)	PMOS Market purchases
Technical Data	IP address, browser type, device info, login timestamps	Automatic collection
Usage Data	Pages visited, features used, session duration	Analytics
Location Data	GPS coordinates (field technicians, with consent)	Mobile app with permission
Professional Data	Certifications, skills, work history, performance metrics	Technician profiles
Pool Facility Data	Water test results, equipment logs, compliance records	Operations platform

3. Purposes for Collection, Use & Disclosure

Under the PDPA, we collect and use your personal data for the following purposes:

• Service Delivery: Operating the PMOS platform, processing work orders, managing technician assignments, facilitating marketplace transactions
• Account Management: Creating and maintaining your account, authenticating access, managing subscriptions and billing
• Communication: Responding to enquiries, sending service notifications, providing customer support
• Compliance: Meeting NEA/PUB water quality standards, generating compliance reports, fulfilling regulatory requirements
• Safety: Live tracking of field technicians for safety purposes (with consent), emergency coordination
• Improvement: Analysing platform usage to improve features, fix bugs, and enhance user experience
• Marketing: With your opt-in consent, sending promotional materials about new features, services, or partnerships
• Legal: Enforcing our Terms of Service, complying with court orders, preventing fraud

4. Consent

In accordance with the PDPA, we obtain your consent before collecting, using, or disclosing your personal data, except where permitted under the Act (e.g., business contact information, publicly available data, or where necessary for contractual obligations).

By using the PMOS platform, you consent to the collection, use, and disclosure of your personal data as described in this Policy. For purposes beyond what is described here, we will seek your explicit consent before proceeding.

5. Disclosure to Third Parties

We may share your personal data with:

• Service Providers: Cloud hosting (Singapore-based AWS/GCP data centres), payment processors (Stripe, Tazapay), email services — all bound by data processing agreements
• Business Partners: Equipment suppliers (only when you initiate a transaction on PMOS Market), laboratories (for water testing services)
• Regulatory Bodies: NEA, PUB, or other government agencies when required by law or for compliance reporting
• Professional Advisors: Auditors, lawyers, insurers — under strict confidentiality

We do not sell your personal data to any third party. We do not share data for third-party marketing without your explicit consent.

6. Data Protection & Security

We implement comprehensive security measures to protect your personal data:

• Encryption: AES-256 encryption at rest; TLS 1.3 for data in transit
• Access Control: Role-based access control (RBAC), multi-factor authentication for admin accounts
• Infrastructure: All data hosted on Singapore-based servers with ISO 27001 certified data centres
• Monitoring: 24/7 security monitoring, intrusion detection, regular vulnerability assessments
• Staff Training: Annual PDPA training for all employees handling personal data
• Incident Response: Data breach notification procedures in place — PDPC will be notified within 3 calendar days of discovering a notifiable data breach, as required under the PDPA

7. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

Data Type	Retention Period	Basis
Account Data	Duration of account + 2 years	Contractual + legal
Transaction Records	7 years from transaction date	IRAS tax requirements
Water Quality Records	5 years	NEA/PUB compliance
Communication Records	3 years	Service improvement
Marketing Consent	Until consent withdrawn	PDPA consent obligation
Technical/Usage Logs	12 months	Security & analytics

Upon expiry of the retention period, personal data is securely destroyed or anonymised.

8. Access & Correction Rights

Under the PDPA, you have the right to:

• Access: Request a copy of your personal data held by us (Section 21, PDPA)
• Correction: Request correction of any inaccurate or incomplete personal data (Section 22, PDPA)

To make a request, email dpo@pmos.asia with subject line "PDPA Access Request" or "PDPA Correction Request". We will respond within 30 calendar days. A reasonable fee may apply for access requests involving substantial effort.

9. Withdrawal of Consent

You may withdraw your consent for the collection, use, or disclosure of your personal data at any time by contacting our DPO. Please note:

• Withdrawal may affect our ability to provide certain services to you
• Withdrawal does not affect the lawfulness of processing carried out before withdrawal
• We will process your withdrawal request within 10 business days
• We will inform you of the likely consequences of withdrawal

10. Cookies & Analytics

We use cookies and similar technologies for:

• Essential Cookies: Required for platform functionality (session management, authentication)
• Analytics Cookies: Understanding usage patterns to improve the platform (anonymised data)
• Preference Cookies: Remembering your language selection and display preferences

You can manage cookie preferences through your browser settings. Disabling essential cookies may impair platform functionality.

11. Transfer of Data Outside Singapore

Your personal data is primarily stored and processed in Singapore. In limited circumstances where data may be transferred overseas (e.g., global cloud infrastructure redundancy), we ensure:

• The recipient country has comparable data protection standards, or
• Binding contractual obligations are in place ensuring equivalent protection, in compliance with the PDPA's Transfer Limitation Obligation (Section 26)

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email and/or a prominent notice on our platform at least 30 days before they take effect.

13. Contact & Complaints

For any questions, requests, or complaints regarding this Privacy Policy or our data protection practices: