Personal Data Protection Policy
1. Introduction
The Singapore Tourism Board, of 1 Orchard Spring Lane, Singapore 247729, as controller, (“STB”, “we”, “us”, or “our”) is committed to protecting information under our control that identifies you (“personal data”), including your name and identifying contact details. This personal data protection policy (“Policy”) serves to inform you of your rights in respect of your personal data, why we collect your personal data, how we use, share and process your personal data, and for how long we store your personal data.
2. General information on our processing of personal data
We collect personal data in furtherance of:
(a) the statutory functions of STB under the Singapore Tourism Board Act (Chapter 305B of Singapore), which are to: (i) develop and promote Singapore as a travel and tourist destination; (ii) advise the Government of Singapore on matters relating to travel and tourism; (iii) enhance the travel and tourism sector’s contribution to the Singapore economy; and (iv) exercise licensing and regulatory functions in respect of such tourism enterprises as we may determine; and
(b) the statutory purposes of the following legislation: (i) Travel Agents Act (Chapter 334 of Singapore); (ii) Singapore Tourism (Cess Collection) Act (Chapter 305C of Singapore); (iii) Casino Control (Evaluation Panel) Regulations 2014; and (iv) Consumer Protection (Fair Trading) Act (Chapter 52A of Singapore).
Carrying out these functions and purposes involves us providing services through and hosting our websites, applications, data analytics platforms, interactive kiosks or other STB platforms, the conduct of surveys or elicitation of feedback, the organisation and running of events and programmes, and the administration of grants.
We will process all personal data lawfully, fairly and in a transparent manner. We will collect personal data that is adequate, relevant, and limited to what is necessary for the purposes for which they are processed. We will take reasonable steps to ensure that personal data is accurate and updated where necessary, and to erase or rectify inaccurate personal data upon request without delay.
We will not store personal data longer than is necessary for the purposes for which the personal data is processed. We will inform you of the period for which we will store your personal data but, if this is not possible, we will instead inform you of the criteria used to determine that period. We will ensure appropriate security of all personal data, including ensuring that all personal data is protected against unauthorised or unlawful processing and accidental loss, destruction, or damage, by implementing and using appropriate technical and organisational measures. We will not subject you to any decision based solely on automated processing (including profiling) which would prejudice you.
3. Personal data we will not collect
We will not collect personal data that reveals any of the following about you: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, or data concerning health or sex life, or sexual orientation, unless we have a legitimate interest, or have obtained your explicit consent to do so.
4. No requirement to provide personal data
The provision of your personal data will generally be voluntary where there is no statutory obligation to provide your personal data. Generally, we do not contractually require the provision of your personal data. However, please note that in any event, the provision of your personal data may be necessary and not providing such personal data might mean that you are not able to receive or use our services (or part thereof) or that you are disqualified from receiving certain benefits. We elaborate on the specific consequences in paragraph 9 of this Policy.
5. Sharing of personal data
Unless expressly stated otherwise in this Policy, we will only share personal data with others where you have consented to us doing so or where it is otherwise lawful for other reasons to do so, even without your consent. For example, we may share personal data with another Singapore public sector body pursuant to a data sharing direction under the Public Sector (Governance) Act 2018 (No. 5 of 2018) of Singapore. Where we share personal data with other persons or entities, we will ensure that all appropriate contractual arrangements and security mechanisms are in place to meet the standards under this Policy.
6. Transfer of personal data across borders
Your personal data may be collected, used, shared or otherwise processed by our regional offices both within and outside the European Economic Area, provided always that such collection, use, sharing and/or processing shall only be for the purposes for which you have provided your consent and/or in accordance with the manner of collection, use, sharing and/or processing as described in this Policy. Our regional offices are all bound to keep any information (including personal data) which they collect, use, process and share with us or that we collect, use and share with them confidential, and to protect such information with security measures that are equivalent to our own.
Our regional offices will only transfer your personal data to third parties outside of its own jurisdiction where it has obtained an adequacy decision by an applicable judicial or legislative body for the recipient jurisdiction, or in accordance with other appropriate or suitable safeguards implemented which are sufficient under applicable data protection legislation. In the event of such transfer which relies on appropriate or suitable safeguards, a detailed description of the implemented safeguards can be obtained by contacting our Data Protection Officer at stb_feedback@stb.gov.sg
7. Your rights and how to exercise them
You have rights over your personal data, and we are committed to fulfilling these rights. You may be entitled to exercise some or all of the following rights:
(a) the right to access: (i) information regarding whether your personal data is retained; and/or (ii) a copy of all personal data relating to you which we retain, including information on the purposes of the processing, the categories of personal data concerned, the data recipients as well as potential retention periods;
(b) the right to request rectification, removal or restriction of your personal data, e.g. because: (i) it is incomplete or inaccurate; (ii) it is no longer needed for the purposes for which it was collected; or (iii) the consent on which the processing was based has since been withdrawn;
(c) the right to refuse to provide your personal data and, without impact to data processing activities that have taken place before such withdrawal, the right to withdraw your consent to the processing of your personal data at any time;
(d) the right to object, on grounds relating to your particular situation, that your personal data be subject to processing. In the event that you wish to exercise this right, please provide us with information about your particular situation. After the assessment of the information about your situation as presented by you, we will either stop processing your personal data or present you with our compelling legitimate grounds for the ongoing processing;
(e) the right to take legal action in relation to any potential breach of your rights regarding the processing of your personal data, as well as to lodge complaints before the competent data protection authority; and/or
(f) the right to require that we: (i) send to you personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format; and/or (ii) transmit such data to another controller without hindrance. Where it is technically feasible, you shall have the right to require such data to be transmitted directly from us to another controller.
To exercise these rights or to raise any complaint of our non-compliance with this Policy, please contact our Data Protection Officer1 at stb_feedback@stb.gov.sg. Please note that should you wish to exercise some or all the rights above, you must be prepared to authenticate your identity. Other grounds under which we may refuse a request is if the request is manifestly unfounded or excessive.
8. General information on consent
We will obtain your consent for the processing2 of any personal data concerning you where we are required to do so under any applicable laws. Where we seek your consent, we will inform you of the specific, explicit, and legitimate purposes for which your consent is being sought and thereafter only process the personal data for those specific, explicit, and legitimate purposes for which your consent has been obtained. Where consent is required from a child who is under the age of 16 years, we will obtain such consent from the parent or guardian instead or otherwise restrict access if consent from the parent or guardian cannot be obtained.
We will obtain such consent from you in a manner which is clearly distinguishable from other matters, and in an intelligible and easily accessible form using clear and plain language. As mentioned above, you have the right to refuse to provide or to later withdraw your consent, however, note that doing so may mean that you are not able to receive or use our services (or part thereof) or that you are disqualified from receiving certain benefits. Where applicable, we elaborate on the specific consequences in paragraph 9 of this Policy.
9. Specific information on the collection of personal data
The following are the circumstances under which your personal data may be collected, used, shared or otherwise processed by us:
(a) If you are browsing our websites (e.g. www.expo2025singapore.sg):
i) General
When you visit any of our websites (e.g. www.expo2025singapore.sg) for informational purposes only (i.e. without registering for any of our provided services such as Visit Singapore Account or otherwise providing us with personal data in any other form), we will automatically collect your IP address and store information on your browser (mostly in the form of cookies), in order to operate and facilitate your access to our websites as well as to ensure system stability and efficiency and to implement proper safeguards as to the security of our websites and services. The personal data collected as a result is necessary to operate and facilitate your access to our websites, or to fulfil our legitimate interest with regards to our use of technical information to enhancing our systems, making your usage of the websites more convenient or ensuring the security of our websites. This is based on our legitimate interest as the data used for these purposes are stored for a limited period only and we are generally not able to personally identify the user without larger efforts. We will not store cookies longer than is necessary for the abovementioned purposes unless the user clears their cookies.
ii) Cookies and other similar tracking technologies
Our websites use cookies in several cases. Cookies are small text files that are stored on your device. This data does not contain information that we could allocate to a natural person. Cookies do not harm your device and do not contain any viruses.
We use cookies or other tracking technologies to enhance your customer experience by making our offers more user-friendly, more effective, and safer. Our legitimate interests pursued are that of the provision and/or promotion of further products and/or services to you.
You can prevent the use of cookies or tracking technologies by adjusting your browser settings. Please note that in this case you may not be able to fully utilise all functions of this website.
iii) Web Analytics
Some of our websites use the following web analytics:
a. Google analytics: a web analytics service provided by Google LLC, (Mountain View, CA, USA) (“Google”).
i. What it does: Google Analytics uses cookies to help the website analyse how users use the site. The information generated by the cookies about your use of the website will be transmitted to and stored by Google on servers in the USA.
ii. How it works: IP-anonymisation is a functionality that is activated on our website, and as such your IP address will be truncated within the area of Member States of the European Union or other parties to the Agreement on the European Economic Area. However, in exceptional cases the whole IP address will be first transferred to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of the website for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing them other services relating to website activity and internet usage. The IP address that your browser conveys within the scope of Google Analytics, will not be associated with any other data held by Google.
iii. Validity of cookies: Google Analytics cookies are valid for up to 24 months by default, unless the user clears their cookies earlier.
iv. Opt-out: You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of the website. You can also opt-out from being tracked by Google Analytics with effect for the future by downloading and installing “Google Analytics Opt-out Browser Add-on for your current web browser: https://tools.google.com/dlpage/gaoptout?hl=en
Please refer to further information on usage rights or data protection of Google at the following websites:
https://policies.google.com/privacy
https://policies.google.com/terms
(b) If you are participating in our events, contests, surveys, or other similar programmes organised by us:
i) Events, programmes or other similar interactions organised by us:
For individual’s resident in the European Economic Area, if you are participating in an event, programme or other similar interaction organised by us, we will collect, use and process your name and business contact information as well as other related business information, for the purposes of processing your specific request or application for a particular event or program. Your personal data will solely be processed for the fulfilment of the respective contract related to such specific event or program you are applying to.
If, in the course of such events or programs, you provide us with your business card, we will also collect, use and process your contact details on the business card, for the purposes you provided the business card, which may include adding and storing your contact details in our systems. The processing of your personal data is based on our legitimate interest in delivering our services to you.
ii) Contests organised by us:
If you take part in one of our contests, we will collect, use and process your name, telephone number, address, e-mail and/or other data which we may request and which you provide voluntarily, for the purposes of executing such contest and providing you with your prize in the event that you are determined to be the winner of the relevant contest. The processing of your personal data is based on the fulfilment of the terms of participation in the relevant contest or, in case these do not exist, our legitimate interest in offering the services and promoting our services and tourism in Singapore. If the processing of your personal data is based on consent, you may withdraw consent granted at any time. We will delete your personal data without undue delay after you withdraw your consent, but we will not be able to assess and process your eligibility for the contest thereafter.
iii) Surveys organised by us or on our behalf:
If you participate in our surveys, we and/or our vendors (who are acting on our behalf) will collect, use and process your name, e-mail address, telephone number and any other data which we may request and which you provide voluntarily, for the purposes of fieldwork validation and data quality checks. All personal data is provided on a completely voluntary basis. Where surveys are conducted by our vendors on our behalf, we will only receive anonymised data. The processing of your personal data is based on our legitimate interest in order to enhance and improve our services. If the processing of your personal data is based on consent, you may withdraw consent granted at any time. We will delete your personal data without undue delay after you withdraw your consent.
(c) If you are entering into a non-disclosure agreement or undertaking with us:
If you enter into a non-disclosure agreement or undertaking with us, we will collect, use and process your name, national identification number or passport number, telephone number, email address and company name, designation, and/or any other data which may be provided by you, for the purposes of enforcing the relevant agreement or undertaking. The processing of your personal data is based on the fulfilment of the contractual agreements as specified in the relevant non-disclosure agreement or understanding.
(d) If you are an individual interacting with us:
i) Contacting us or using our feedback forms:
If you want to make an enquiry, give compliments, or submit a complaint, we offer you the opportunity to contact us thorough the email(s) provided in the website. Your name, e-mail address and place of residence and in some cases further contact details are required to process your request and follow up as required. You may also receive assistance from the chatbot, and live chat found on our corporate website, Visit Singapore Meetings, Incentives, Conventions and Exhibition (VS MICE) website, LinkedIn, Facebook and other STB social media platforms. Personal data will not be collected when you initiate a conversation with the chatbot and live chat, except for Facebook and LinkedIn where we will automatically receive your name. If you require more assistance from us through the chatbot and live chat, we will need to collect your contact information like name and email for a follow up. The processing of your personal data is necessary for us to contact you to fulfil our obligations under a contract or based on our legitimate interest to enhance your travel experience and improve our services, as required to follow up on your request. The processing of your personal data may involve the transfer to third parties as far as this is necessary to follow up on your request (e.g. when it concerns the business of other entities or legal bodies). If the processing of your personal data is based on consent, you may withdraw consent granted at any time. We will delete your personal data without undue delay after you withdraw your consent, but we will not be able to continue providing the services thereafter.
ii) Subscribing to our services or products
If you have contacted us for the purpose of signing up to have access to our services or products (e.g. MICE Event Legacy Toolkit) for business development purposes, your name, contact details, job designation and company information as provided are required to assess your eligibility for redirection to third parties assessed to be relevant to your business, to register you for our newsletter, to contact you about our services or products and/or to transfer your contact information to third parties regarding third party services or products assessed to be relevant to your business.
iii) Subscribing to our newsletter:
Where you have granted consent, we will collect, use and process your name, e-mail address, country and other data you provide voluntarily, for the purposes of sending you our newsletters which contain information on our services and products and for the purposes of performing retargeting and possible assessment for business development. Such newsletters might include advertisements for third parties and their products or services. You may withdraw consent granted at any time. We will delete your personal data for marketing purposes without undue delay after you withdraw your consent, but we will not be able to continue providing you the newsletter thereafter.
iv) Our Social Media Platforms:
Singapore Tourism Board owns and manages several social media pages on various platforms like Facebook, Instagram, X (formally known as Twitter), Youtube, LinkedIn, TikTok, Weibo, Naver, Wechat, RED (Xiaohongshu) and Line. We may also receive your information through content you have submitted to these social networking sites. Content submitted could be a photo you shared with us on any of the above social media platforms through participating in our promotional activities such as tagging us in your captions in Instagram, or hash tagging #VisitSingapore or #PassionMadePossible #MadeInSingapore.
If you initiate a conversation with us through the chatbot found on our Facebook page, we will receive your name automatically but seek your consent before viewing your public profile or collect any personal data. We comply with Facebook’s Terms of Service and Data Policy when collecting your personal information. The chatbot will not be used to publish any content or use data you have provided to show you advertisements. In the event where you have additional enquiries and the chatbot is unable to assist you, our Customer Service Officer will be notified and will seek your consent before collecting your contact information in order to follow-up. Content submitted through the chatbot can be deleted by contacting us.
(e) If you are a journalist who has worked with us or otherwise interacted with us:
Where you have provided us with your information (e.g. via e-mail or in the form of a business card) and granted us consent, we will collect, use and process your name, e-mail address, company name, designation and other data you provide voluntarily (e.g. contact number), for the purposes of sending you media releases, advisories, invites and/or project factsheets. If the processing of your personal data is based on consent, you may withdraw consent granted at any time. We will delete your personal data without undue delay after you withdraw your consent, but we will not be able to continue providing you such media releases and other information or invitations thereafter.
(f) If you are a stakeholder / business partner:
i) If you are one of our stakeholders participating in a site visit or site inspection to a secure site:
If you are one of our stakeholders participating in a site visit or site inspection to a secure site (e.g. Marina Bay Cruise Centre Singapore, which is a gazetted security checkpoint), we will collect, use and process your name, national identification number or passport number, telephone number, email address, company name and designation, for the purposes of obtaining security registrations and clearances for your visit to the relevant site. The processing of your personal data is based on our legitimate interest to maintain necessary site security.
ii) If you are one of our overseas business partners or stakeholders and are participating in a familiarisation tour in Singapore:
If you are one of our overseas business partners or stakeholders and are participating in a familiarisation tour in Singapore, we will collect, use and process your name, telephone number, email address, passport details and other data requested directly from you by us or on our behalf, for the purposes of helping you make the necessary travel arrangements to Singapore for your participation in the familiarisation tour. The processing of your personal data is based on the fulfilment of the respective agreement between us as well as on our legitimate interest to provide you with the requested tour in order to enhance our business.
(i) Processing personal data for regulatory or legal defence purposes:
Notwithstanding anything within this policy, we reserve the right to freely process your personal data for regulatory purposes under the statutory functions of STB (e.g. travel agent licensing, tourist guide licensing or the collection of cess for tourism events) or to defend ourselves against any legal claim. The processing is based on our legitimate interest in fulfilling our public obligations and statutory functions.
10. Updates to this Policy
We reserve the right to update this Policy for reasons including but not limited to complying with relevant Singapore legislation, Singapore Government guidelines, regulatory directions, and other requirements of similar nature. Examples of these include future amendments to the Personal Data Protection Act 2012 (No. 26 of 2012) of Singapore or amendments to the Singapore Government Instruction Manual. Translations of this Policy is provided only for reference and convenience to non-English readers. In case of discrepancies between the translated versions and this English version, the English version shall prevail.
Policy updated as at 26 Jul 2024
1The Data Protection Officer (DPO) is also the Quality Service Manager (QSM).
2“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
