Introduction

Thank you for your interest in this Data Protection Policy! At NXT Interactive, we take our responsibilities under Singapore’s Personal Data Protection Act (“PDPA”) and the General Data Protection Regulation (“GDPR”) very seriously.

As such, this policy sets out how personal data is managed and dealt with in order to ensure that the obligation to fulfil individuals’ reasonable expectations of privacy is applied and followed and that the responsibilities established under the PDPA and GDPR are complied with.

The requirement specified in this policy applies equally to all staff, contractors and service users and contracting parties engaged with NXT Interactive.

Rationale

NXT Interactive acquires, uses, stores, and otherwise processes personal data and special category data relating to potential and current service users, and personal data of our contracting parties, current and potential and former contractors, employees, and collectively refers to those individuals in this policy as data subjects. Likewise, no distinction is made between the rights of data subjects, and all are treated equally under this policy.

Our Role

During the course of you using our services we are processing and only insofar as this is necessary for our services the following categories of personal data: First Name, Last Name, Contact Data, Payment Data, and Contract Data. As well as special category data which is personal data that needs more protection because it is sensitive. This may include personal data revealing racial or ethnic origin, religious or philosophical beliefs, genetic data, biometric data, or data concerning health. NXT Interactive will process personal data and special category data to the extent permitted by law, for example, in the course of providing our services or to comply with our legal obligations.

The personal data and special category data processed by us is collected and stored and used for the purpose of fulfilling a contract, our legal obligations, protecting legitimate interests, consent and explicit consent for Special Category Data, if necessary.

We may also use personal data for the following purposes: i) managing and planning operational processes; and ii) contractual data processing for payment and administrative purposes and service provision.

Purpose of the policy

This policy seeks to ensure that NXT Interactive is:

• clear about how personal data must be processed;

• complying with the PDPA and GDPR and with good practice;

• protecting the personal data entrusted to us and that it is processed in accordance with data subjects’ rights;

• protecting itself from risks of personal data breaches and breaches of data protection laws;

Scope

The policy covers both personal and special category personal data held by NXT Interactive in relation to data subjects. The policy applies equally to personal data held in print and digital form. All contractors and others processing personal data on behalf of NXT Interactive must read it and a failure to comply may result in disciplinary action. NXT Interactive’s Data Protection Manager is responsible for ensuring that contractors and others working on behalf of the Company comply with this policy and should implement appropriate practices, processes, controls, and training accordingly.

Data Protection Manager

NXT Interactive’s Data Protection Manager (“DPM”) is Naval Joshi, who can be reached at naval@nxtinteractive.com or call +65 31636746.

Data Protection Principles

NXT Interactive is responsible for, and must be able to demonstrate compliance with the data protection principles set out in the PDPA and GDPR and all personal data must be:

• processed lawfully, fairly and in a transparent manner in relation to the data subject,

• collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes subject to appropriate safeguards, and provided that there is no risk of breaching the privacy of the data subject,

• adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed,

• accurate and where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the purposes for which they are processed is erased or rectified without delay,

• kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data is processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the PDPA and GDPR in order to safeguard the rights and freedoms of the data subject, and

• processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.

Data Subjects’ Rights

The PDPA and GDPR grant several rights to data subjects. These are standardised in both provisions and include the following:

• the right to be informed;

• the right of access;

• the right of rectification;

• the right to erasure (the “right to be forgotten”);

• the right to restrict processing;

• the right to data portability;

• the right to object;

• rights with respect to automated decision-making and profiling;

• the right to withdraw consent;

• to be notified of a data breach which is likely to result in high risk to their rights and freedoms.

NXT Interactive requires the verification of the identity of an individual requesting data under any of the rights listed. Requests made must be complied with within one month of receipt and immediately forwarded to the DPM and are processed free of charge.

To assert these rights, please contact our DPM at any time using the details provided above.

You also have the right to lodge a complaint with your local data protection supervisory authority or the Singapore Personal Data Protection Commission (PDPC), 10 Pasir Panjang Road, #03-01 Mapletree Business City, Singapore 117438 www.pdpc.gov.sg. We would, however, appreciate the chance to deal with your concerns before you approach the PDPC or any other supervisory authority.

Accountability

NXT Interactive must implement appropriate technical and organisational measures in an effective manner to ensure compliance with data protection principles. NXT Interactive is further responsible for and must be able to demonstrate compliance with the data protection principles. Consequently, adequate resources and controls to ensure and document PDPA and GDPR compliance are put into place. Those are:

• the appointment of a DPM,

• security and privacy measures when processing and handling data are implemented,

• a Data Protection Impact Assessment (DPIA) is carried out,

• policies and procedures for processing and handling data are implemented,

• NXT Interactive contractors and others working on behalf of the Company are trained in accordance with the PDPA and GDPR,

• security and privacy measures and processing and handling policies and procedures are reviewed and updated, and

• audits and reviews are carried out regularly.

Responsibility

As the Data Controller, NXT Interactive is responsible for establishing policies and procedures in order to comply with data protection law.

The DPM is responsible for:

• advising NXT Interactive and its contractors and others working on behalf of the Company of its obligations under PDPA and GDPR,

• monitoring that the PDPA and GDPR and other relevant data protection laws are followed and applied,

• monitoring training and audit activities related to PDPA and GDPR compliance,

• advice when requested and conduct data protection impact assessments,

• act as the contact point for the PDPC and data subjects, and

• oversee NXT Interactive’s performance regarding risk deriving from processing operations, considering the nature, scope, context, and purpose.

Contractors and others working on behalf of the Company must ensure that:

• all personal data is kept securely,

• no personal data is disclosed either verbally or in writing, accidentally or otherwise, to any unauthorised third party,

• personal data is kept in accordance with NXT Interactive’s Retention Policy,

• queries concerning data protection, complaints and access requests are forwarded to the DPM immediately,

• data protection breaches are swiftly made known to the DPM and that support in resolving breaches is prioritised,

• any uncertainty about data protection is addressed to the DPM and without delay, and

• they are aware of the Data Protection principles and have read this Policy.

Third-Party Data Processors

Where NXT Interactive is outsourcing or using external companies for the processing of personal data, the responsibility for the data remains with NXT Interactive.

A third-party data processor must:

• provide sufficient guarantees about its data protection and security measures,

• agree to a written contract covering what personal data is processed and for what purpose, and

• agree to a written data processing agreement.

Data Security

We have a clear and specific objective to ensure that personal data is kept secure and up to date. In particular we have agreed to:

• comply with the legal requirements in the provision of services,

• process and use your data only to the extent strictly necessary to perform our obligations or as otherwise provided,

• only disclose your data to contractors and others working on behalf of NXT Interactive that have a need to access your data,

• ensure that all such contractors and others working on behalf of NXT Interactive are bound by a confidentiality agreement,

• take all reasonable steps to ensure the reliability of all its contractors and others working on behalf of NXT Interactive who have access to your data,

• ensure that appropriate controls are in place to prevent access to special categories of Data, where relevant, except in circumstances expressly authorised, and

• implement, maintain and at all times operate adequate and appropriate technical and organisational measures to:

  • protect the security, confidentiality, integrity, and availability of your data, and

  • protect against unauthorised or unlawful processing of your data and against

  • accidental loss, destruction or the making vulnerable of, or damage to, your data,

  • such measures shall, at a minimum, meet

    • the requirements of the PDPA and GDPR, and

    • the standards required by all applicable accepted industry practices.

Data Subject Access Requests

Data subjects have the right to receive a copy of their personal data which is held by NXT Interactive. Likewise, an individual is entitled to receive further information about processing their personal data and in particular on:

• the purpose of processing;

• the categories of personal data being processed;

• the recipients of personal data;

• the retention periods;

• information about their rights;

• the relevant safeguards when personal data is transferred outside Singapore; and

• any third-party source of the personal data.

Do not share any personal data without proper authorization. Do not alter, conceal, block or destroy personal data after such request has been made. Contact the DPM before making any changes or replying to a Data Subject Access Request.

Reporting a personal data breach

The PDPA and GDPR require that NXT Interactive reports any personal data breach to the PDPC if there is a risk or high risk to the rights and freedoms of the data subject. If you know or suspect a personal data breach inform the DPM immediately and follow the instructions set out in NXT Interactive’s Data Breach Procedure.

Limitations on the transfer of personal data

The transfer of personal data to a country outside Singapore, will only take place if one or more of the following applies:

• the PDPC confirmed that the particular country ensures an adequate level of protection for the data subjects’ rights and freedoms,

• the particular country provides appropriate safeguards such as binding corporate rules, standard contractual clauses approved by the PDPC, an approved code of conduct or a certification mechanism,

• the data subject has explicitly agreed to the transfer,

• the transfer is necessary for the performance of a contract between the data subject and NXT Interactive, and

• the transfer is necessary for one of the other reasons set out in the PDPA and GDPR including:

  • the public interest,

  • establish, exercise, or defend legal claims,

  • to protect the vital interests of the data subjects, and

  • if the data subject is physically or legally unable to give their consent.

Record Keeping

The PDPA and GDPR require NXT Interactive to keep full and accurate records of all data processing activities. Keep and maintain accurate corporate records reflecting personal data processing, including Consent Form. Records should include, at a minimum, the name and contact details of the DPM, clear descriptions of the personal data types, data subject types, processing activities, processing purposes, third-party recipients of the personal data, personal data storage locations, personal data transfers, the personal data’s retention period and a description of the security measures in place.

Similarly, records of personal data breaches must also be kept and cover the following:

• the facts surrounding the breach,

• its effects, and

• the remedial action taken.

Secure Deletion and Archiving of Personal Data

Personal Data must be deleted and stored using one of the following secure methods:

• Documents in electronic format must be deleted with a secure deletion utility and standard deletion utilities should not be used,

• Personal Data on hard drives, removable drives, storage devices or any similar item must be securely erased before any disposal or reassignment of the equipment,

• Personal Data that is Archived on hard drives, removable drives, storage devices or any similar item must be organised in an orderly manner and encrypted using at least AES-256,

• Paper copies must be destroyed using cross-cut shredders, and

• The DPM must approve and record the destruction or deletion of personal data.

Sensitive and Special Category data

NXT Interactive is through the performance of its services not routinely collecting Sensitive and Special Category data. If the processing of Sensitive and Special Category data during the course of the provision of services or employment becomes necessary, we first need to obtain consents. In this context, consent means any freely given indication of the data subject’s wishes for the specific case in an informed and unambiguous manner, in the form of a declaration or any other unambiguous affirmative act by which the data subject indicates that he or she consents to the processing of personal data relating to him or her.

Audit and Training

NXT Interactive is required to ensure that all contractors and others working on behalf of NXT Interactive are adequately trained and compliance with the PDPA and GDPR is possible. We also regularly test our policies, systems, and processes to assess and ensure compliance.

Data privacy by design and default

NXT Interactive has to ensure that by default only personal data which is necessary for each specific purpose is processed. The obligation applies:

• to the volume of personal data collected,

• the extent of the processing, and

• the period of storage and the accessibility of the personal data.

In particular, personal data should not be available to an indefinite number of persons, and you must ensure that you adhere to those measures.

Data Protection Impact Assessments (DPIAs)

NXT Interactive must also conduct DPIAs in respect of high-risk processing before that processing is undertaken. NXT Interactive’s DPM will conduct a DPIA when:

• new or changing technologies such as programs, systems or processes are introduced,

• automated processing including profiling takes place,

• sensitive and special category data is processed on a large scale, and

• systematic monitoring of a publicly accessible area on a large scale takes place.

A DPIA must include:

• a description of the processing, its purposes and the Data Controller’s legitimate interests if appropriate,

• an assessment of the necessity and proportionality of the processing in relation to its purpose,

• an assessment of the risk to individuals, and

• the risk-mitigation measures in place and demonstration of compliance.

Marketing

NXT Interactive is subject to certain rules and privacy laws when marketing to our service users, residents, guests and clientele. A data subject’s prior consent is required for electronic direct marketing (for example, by email, text or automated calls). The right to object to direct marketing must be explicitly offered to the data subject in an intelligible manner so that it is clearly distinguishable from other information. A data subject’s request to object to direct marketing must be respected. If a data subject opts out at any time, their details should be suppressed as soon as possible. Suppression involves retaining just enough information to ensure that marketing preferences are respected in the future.

Access Control

Access to all information will be controlled and will be driven by business requirements. Access will be granted, or arrangements made for users according to their role and the classification of information, only to a level that will allow them to carry out their duties.

A formal user registration and deregistration procedure will be maintained for access to all information systems and services. This will include mandatory authentication methods based on the sensitivity of the information being accessed and will include consideration of multiple factors as appropriate.

Specific controls will be implemented for users with elevated privileges and leavers, to reduce the risk of negligent or deliberate system misuse. Segregation of duties will be implemented, where practical.

Antivirus/Anti-malware Protection

All workstation and server-based assets used, whether connected to the NXT Interactive network or as stand-alone units, must use NXT Interactive approved antivirus/anti-malware protection software and configuration provided by NXT Interactive. The following procedures shall be followed:

• Virus protection software must not be disabled or bypassed,

• Settings for the virus protection software must not be altered in a manner that will reduce the software effectiveness,

• Automatic update frequency cannot be altered to reduce the frequency of updates,

• All servers attached to the NXT Interactive network must utilise NXT Interactive approved/standard virus protection software and setup to detect and clean viruses,

• All electronic mail gateways, devices, and servers must use NXT Interactive approved e-mail virus/malware/spam protection software and must adhere to NXT Interactive rules for the set-up and use of this software,

• Any threat that is not automatically cleaned, quarantined, and subsequently deleted by malware protection software constitutes a security incident and must be reported, and

• Antivirus/anti-malware signature updates shall occur on a frequency defined by NXT Interactive but shall occur minimally once each calendar month.

Glossary of Terms

Automated Decision-Making (ADM)

When a decision is made which is based solely on automated processing (including profiling) which produces legal effects or significantly affects an individual. The PDPA and GDPR prohibit Automated Decision-Making (unless certain conditions are met) but not automated processing.

Profiling

Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Profiling is an example of automated processing.

Consent

An agreement which must be freely given, specific, informed and be an unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear positive action, signifies agreement to the processing of personal data relating to them.

Data Controller

The person or organisation that determines when, why and how to process personal data. It is responsible for establishing practices and policies in accordance with the PDPA and GDPR. NXT Interactive is the Data Controller of all personal data relating to it and used delivering education and training and all other purposes connected with it including business purposes.

Data Subject

A living identified or identifiable individual about whom we hold personal data.

Data Protection impact assessment (DPIA)

An assessment tool used to identify and reduce risks of a data processing activity. A DPIA can be carried out as part of Privacy by Design and should be conducted for all major system or business change programs involving the processing of personal data.

Data Protection Manager (DPM)

The person appointed as such under the PDPA and GDPR and in accordance with its requirements. A DPM is responsible for advising NXT Interactive on their obligations under the PDPA and GDPR, for monitoring compliance with the PDPA and GDPR, as well as with policies, cooperating with the PDPC and acting as a point of contact.

Personal Data

Any information identifying a data subject or information relating to a data subject that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Personal data includes sensitive personal data and pseudonymized personal data but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour.

Special category data

Special category data is personal data that needs more protection because it is sensitive. This may include personal data revealing racial or ethnic origin, religious or philosophical beliefs, genetic data, biometric data, or data concerning health. In order to process special category data, we first need to obtain consent.

Consent

Consent means any freely given indication of the data subject’s wishes for the specific case in an informed and unambiguous manner, in the form of a declaration or any other unambiguous affirmative act by which the data subject indicates that he or she consents to the processing of personal data relating to him or her.

Personal Data Breach

Any breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data, where that breach results in a risk to the data subject. It can be an act or omission.

Privacy by Design and Default

Means implementing appropriate technical and organisational measures in an effective manner to ensure compliance with the PDPA and GDPR.

Privacy Policy

A separate policy setting out information that may be provided to data subjects when NXT Interactive collects information for example through the website. These notices may take the form of general privacy statements applicable to a specific group of individuals or they may be stand-alone, one-time privacy statements covering processing related to a specific purpose.

Processing or Process

Any activity that involves the use of personal data. It includes obtaining, recording, or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties. Basically, it is anything that can be done to personal data from its creation to its destruction, including both creation and destruction.

Pseudonymization or Pseudonymized

Replacing information that directly or indirectly identifies an individual with one or more artificial identifiers or pseudonyms so that the person, to whom the data relates, cannot be identified without the use of additional information which is meant to be kept separately and secure.

Review

NXT Interactive will continue to review the effectiveness of this policy to ensure it is achieving its stated objectives on at least an annual basis and more frequently if required taking into account changes in the law and organisational or security changes.

Concerns and Contact

If you have any questions or comments about our Data Protection Policy or wish to exercise your rights under applicable laws, please contact our DPM.