PDPA notice

Draft, not legal advice This page is a structural scaffold produced during the site rebuild. It has not been drafted or reviewed by a lawyer. Every marked block below needs text from a Singapore-qualified adviser before this page is published. Do not rely on it and do not put it live as it stands.

About this notice

This notice covers our obligations under the Singapore Personal Data Protection Act 2012. It sits alongside the general privacy notice, which covers the same ground in less Singapore-specific terms.

Data Protection Officer

The PDPA requires us to designate a Data Protection Officer and to make their business contact information available.

Needs an owner, this is a legal requirementName the DPO and give a monitored contact address. Publishing this page without a named DPO does not satisfy section 11(3) of the Act.

Where Aivobot handles a phone call, the caller is told at the start of the call that the call is being recorded. We supply the customer organisation with the wording for that notification.

Needs counselConfirm the notification wording meets the notification and consent obligations, and cover deemed consent, withdrawal of consent, and what happens to a call already in progress when a caller objects.

What we use personal data for

Needs counselState each purpose and the basis relied on. Where deemed consent or a legitimate interests exception is relied on, say which.

Access and correction requests

You can ask what personal data we hold about you and ask us to correct it.

Needs counsel and an ownerGive the request route, the identity verification steps, the response timeline and any fee. Under the PDPA a response timeline must be communicated where the request cannot be met promptly.

How it is protected

Calls and chats are handled on the customer's own Microsoft Azure instance and can be stored in Singapore. Retention is set by the customer organisation and content is deleted on that schedule.

More detail is on the security page.

Needs engineeringConfirm the technical and organisational measures actually in place before describing them in more detail here.

Do Not Call

Where Aivobot makes outgoing calls on a customer's behalf, the Do Not Call provisions of the PDPA apply to those calls.

Needs counsel, high riskThis is the clause most likely to create exposure for an outbound voice product. Set out who is responsible for DNC register checks, what the platform does or does not check automatically, and what the customer must do. Do not publish a claim that the platform screens the register unless engineering confirms it does.

Data breach notification

Needs counsel and engineeringSet out the assessment and notification process for a notifiable data breach, including the timeline for notifying the Commission and affected individuals.

Complaints

If you are not satisfied with how we have handled your personal data, tell us first and we will look into it. You can also complain to the Personal Data Protection Commission of Singapore.

Needs an ownerGive the internal escalation route and the timeline for a substantive answer.