# Privacy notice URL: https://skillsforce.com.sg/privacy Title: Privacy Notice | Skillsforce Singapore Description: How Skillsforce collects, uses and protects personal data under Singapore’s PDPA, what the website measures and stores, and how to reach our Data Protection Officer. Last updated 03 September 2026. How Skillsforce collects, uses, discloses and protects personal data, written against Singapore's Personal Data Protection Act 2012. - Legal entity: Skillsforce Management Consultancy Pte Ltd - UEN: 199900539E - EA Licence No.: 99C3289 ## 1. About this notice This notice explains how Skillsforce Management Consultancy Pte Ltd ("Skillsforce", "we", "us", "our") collects, uses, discloses, and protects personal data in the course of operating the website at skillsforce.com.sg (the "Site") and delivering our recruitment, HR outsourcing, payroll processing, and manpower outsourcing services. This notice is written to be consistent with the Personal Data Protection Act 2012 (the "PDPA") and the advisory guidelines issued by the Personal Data Protection Commission ("PDPC"). Where this notice refers to an "obligation" under the PDPA, that reference is a plain-language summary and not a substitute for the statute itself. This notice applies to two broad groups of individuals: - **Employer-side contacts:** people who enquire about our services, or who work for our client organisations, and whose personal data we handle in the course of providing recruitment, HR, payroll, or manpower outsourcing services. - **Candidates and employees:** job seekers who contact us directly, and candidates or employees whose personal data we process on behalf of our employer clients as part of delivering our services. ## 2. What personal data we collect and how ### 2.1 Through the website enquiry form The Site carries a single enquiry form for employers. When a form is submitted, we collect: name, company name, email address, contact number, enquiry type (the service the enquirer is interested in), and, where the enquirer chooses to provide it, a free-text description of what they need. Name, company name, email address and contact number are required to submit the form. The enquiry type is pre-set to a default and is always submitted with the form; the free-text description is optional. The form is processed by a third-party form-to-email service, Web3Forms, which relays the submission to our inbox at info@skillsforce.com.sg. We do not use it as a database or a CRM; we work from the email it sends. Web3Forms handles the submission under its own privacy terms. ### 2.2 Through unsolicited CV submissions Job seekers may choose to email a CV directly to info@skillsforce.com.sg. This is entirely the sender's choice; the Site does not host a job application form or a candidate portal. Any personal data in a CV sent this way (which may include name, contact details, work history, education, and other details the sender chooses to include) is handled under this notice from the point we receive it. ### 2.3 Through our services In the course of providing recruitment, HR outsourcing, payroll processing, and manpower outsourcing services to our employer clients, we handle personal data belonging to candidates and employees on our clients' behalf and, where relevant, as an organisation in our own right. This can include: CVs and employment history, identification details (such as NRIC or work pass numbers), salary and compensation data, CPF contribution data, and tax data (including IR8A records) required for payroll and statutory filing. Full identification numbers are collected only where the law requires them or where they are needed to verify a person's identity, which in practice means statutory filing, CPF submission and work-pass matters. At the earlier stage of considering someone for a role, less is needed and less is asked for. Personal data sometimes reaches us through a person's authorised representative rather than from the person directly. For a candidate, that can include another employment agency acting on their behalf. How we handle this data depends on the arrangement. Where we process personal data on a client's instructions, as we do for recruitment, HR outsourcing and payroll, the client remains the organisation primarily responsible for obtaining the consent required from the individual under the PDPA, and we act on that client's instructions. Where Skillsforce is itself the employing entity, as it is for staff employed under a manpower outsourcing arrangement, we handle their personal data as their employer and this notice applies to us directly. ### 2.4 Cookies, analytics and what the website stores The Site measures traffic in two ways, and they are governed differently because they collect different things. The first is a cookieless page count provided by our hosting provider, Cloudflare. It records aggregate information such as the page requested, the referring page and general performance timing. It sets no cookies, stores nothing on the visitor's device, and does not identify individual visitors, so it runs on every visit. The second is Google Analytics, which does set cookies on the visitor's device and reports to Google LLC, meaning that data is handled outside Singapore. What it collects includes the pages viewed and the route taken through the Site, an approximate location derived from the visitor's IP address (city level, not a precise position), and technical details of the device and browser in use, such as screen size, operating system and browser version. Google Analytics is not loaded at all unless the visitor turns on the "Analytics" switch in the Site's "Cookies and data" panel. Turning that switch off again stops the collection and deletes the cookies it set, without the visitor needing to reload the page. Two capabilities that Google Analytics offers are switched off, in our property configuration and in the signal the Site sends with every measurement. The first is advertising personalisation and remarketing: we do not run advertising, we do not build advertising audiences, and we do not share this data with advertisers. The second is the collection of user identifiers and user-provided data: the Site sends Google no name, email address, telephone number or account identifier, and enquiries submitted through the Site's form do not pass through Google Analytics at all. Google retains the Analytics data under the retention period set in our property, which is measured in months rather than years, and deletes it at the end of that period. The seven-year outer limit described in section 8 applies to personal data we hold ourselves, not to this. Separately from cookies, three items are stored locally in a visitor's browser (in browser localStorage), on the visitor's own device: two display preferences (a light or dark theme setting and a reduced-motion setting), and a record of the choice the visitor makes in the "Cookies and data" panel. None of the three is transmitted to us or to any third party, and none identifies the visitor. ## 3. Purpose limitation: why we collect and use personal data We only collect and use personal data for purposes a reasonable person would consider appropriate in the circumstances, and only for the purposes we have notified (see section 4). These purposes include: - responding to enquiries submitted through the website; - assessing a candidate's suitability for a role, and presenting shortlists to prospective employers; - administering HR outsourcing services on behalf of a client, including HR record-keeping and Work Pass administration; - processing payroll, CPF contributions, and statutory tax filings (including IR8A and IR21) on behalf of a client; - administering manpower outsourcing arrangements, including contracting, payslip issuance, and CPF payment where Skillsforce is the contracting party; - maintaining our own business records, invoicing, and compliance with our obligations as a licensed Employment Agency under the Employment Agencies Act; - complying with legal and regulatory obligations, including those owed to MOM, CPF Board, and IRAS. We do not use personal data collected through the enquiry form or unsolicited CVs for any purpose beyond what is described in this notice, unless we separately notify the individual and, where required, obtain consent. We disclose personal data only where it is necessary for the purposes above. Depending on the service, that can mean: the employer client who instructed us, for candidate shortlists and for HR, payroll or manpower outsourcing records; government agencies, including MOM, the CPF Board and IRAS, for statutory filings and work-pass matters; the client's bank, for payroll disbursement; and the service providers that operate the Site and relay its enquiry form, described in sections 2.1 and 9. We do not sell personal data, and we do not disclose it to advertisers. ## 4. Notification and consent ### 4.1 Notification Where we collect personal data directly from an individual (for example, through the enquiry form, or a CV sent to us), we notify the individual, at or before the point of collection, of the purposes for which the data is collected. The enquiry form carries a short statement of those purposes immediately above its submit button, so the notification is given before any details are sent to us. This notice sets out the same purposes in full. ### 4.2 Consent We collect, use, and disclose personal data only where the individual has given consent, where consent is deemed to be given under the PDPA, or where an exception in the PDPA applies (for example, where the collection, use or disclosure is required or authorised by law). Submitting the enquiry form, or sending a CV to us, constitutes an individual's consent to us using the data provided for the purposes set out in this notice. Where an employer client gives us personal data about a candidate or an employee, we act on that client's instructions and rely on the client having obtained the consent required, or on an exception under the PDPA applying. If you believe data about you has been given to us without your consent, contact us using the details in section 13 and we will take it up with the client. ### 4.3 Withdrawing consent An individual may withdraw consent to our collection, use, or disclosure of their personal data at any time by giving us reasonable notice, using the contact details in section 13. On receiving a withdrawal request, we will inform the individual of the likely consequences (for example, that we may no longer be able to consider a candidate for a role, or continue certain services), stop the relevant processing, and not treat the withdrawal as terminating any existing legal relationship. ## 5. Access and correction An individual may request: - access to the personal data we hold about them, and information about how it has been used or disclosed in the past year; or - correction of an error or omission in their personal data. We will respond to a properly made request as soon as reasonably possible. If we cannot respond within 30 days of receiving it, we will tell the individual in writing, within those 30 days, of the time by which we will be able to respond. A reasonable fee may be charged for an access request; where one applies, we will tell the individual what it is before we process the request. We may decline certain requests where the PDPA permits (for example, where providing access would reveal another individual's personal data, or where an exception applies), and where we decline a request we will inform the individual of the reason, so far as reasonably practicable. Where we hold personal data only as a service provider processing it on a client's instructions, the client is the organisation responsible for responding to an access or correction request. In that case we will pass the request to the client and tell the individual that we have done so. An access request is a request for the personal data itself, not for every document that happens to contain it. Where a person's personal data forms only a small part of a document, we may provide the personal data we hold about them, or confirmation of what is on record, rather than the whole document. To make a request, use the contact details in section 13. ## 6. Accuracy We take reasonable steps to ensure that personal data we collect is accurate and complete, in particular where the data is likely to be used to make a decision affecting the individual (for example, a hiring decision) or disclosed to another organisation. Individuals can help by keeping us informed of changes to their personal data, and by using the correction process in section 5. ## 7. Protection of personal data We make reasonable security arrangements to protect personal data in our possession or under our control, to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks. These arrangements include administrative and organisational measures appropriate to the sensitivity of the data involved. ## 8. Retention limitation We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law, whichever is longer. Seven (7) years is the outer limit we work to, not a period we hold everything for: where the purpose has been served and no legal or business need remains, we dispose of or anonymise the data sooner. Anything still held at the end of that period is disposed of or anonymised. A longer period applies where the law requires it, for example under statutory record-keeping obligations in tax, CPF, or employment legislation, or where a legal claim requires us to retain the data for longer. ## 9. Transfer limitation The Site is hosted on infrastructure provided by Vercel Inc. Vercel's servers may be located outside Singapore. Where we transfer personal data outside Singapore, whether through our hosting provider or otherwise, we take the steps required under the PDPA to satisfy ourselves that the recipient organisation is bound to provide the transferred data a standard of protection comparable to the protection under the PDPA, before making the transfer. ## 10. Data Protection Officer Questions about this notice, and requests made under it, can be addressed to our Data Protection Officer: - Designation: The Data Protection Officer - Organisation: Skillsforce Management Consultancy Pte Ltd - Email: info@skillsforce.com.sg - Phone: +65 6291 5200 Email sent to the address above should be marked for the attention of the Data Protection Officer. ## 11. Data breach notification If we become aware of a possible data breach, we assess it promptly. Where that assessment shows the breach is one we are required to notify, because it is likely to result in significant harm to the affected individuals or is of a significant scale as defined under the PDPA, we notify the Personal Data Protection Commission as soon as practicable and no later than three (3) calendar days after making that assessment, and we notify the affected individuals as soon as practicable, unless an exception under the PDPA applies. ## 12. Do Not Call (DNC) provisions Skillsforce does not run telemarketing calls, SMS, or fax campaigns to Singapore telephone numbers. Calls we make are to conduct business the person has asked us to conduct: replying to an enquiry, discussing a role with a candidate, or administering a service for a client. If we ever send a message that falls within the Do Not Call provisions of the PDPA, we will check the number against the relevant Do Not Call Registry and honour any applicable registration before sending it, unless an exemption applies (for example, an existing relationship with the recipient, or a message the recipient has consented to). ## 13. Contact us For any question about this notice, or to make an access, correction, or withdrawal-of-consent request, contact: - Organisation: Skillsforce Management Consultancy Pte Ltd - Phone: +65 6291 5200 - Email: info@skillsforce.com.sg You may also lodge a complaint with the Personal Data Protection Commission if you believe we have not handled your personal data in accordance with the PDPA. ## 14. Changes to this notice We may update this notice from time to time to reflect changes in our practices or in the law. The updated notice will be posted on the Site with a revised "last updated" date at the top of the page. Where a change materially affects how we handle personal data we already hold, we will take reasonable steps to bring the change to the attention of the individuals affected, rather than relying on republication alone.