Data Protection Notice

Introduction and Scope of This Notice

Focal Search Pte Ltd (“Focal Search”, “we”, “our”, or “us”) is a licensed employment agency registered with the Ministry of Manpower (MOM) of Singapore. We are committed to protecting the personal data of all individuals who interact with us, in full compliance with the Personal Data Protection Act 2012 (PDPA), its subsequent amendments, and all subsidiary legislation, advisory guidelines, and codes of practice issued by the Personal Data Protection Commission (PDPC).

This Data Protection Notice (“Notice”) governs the collection, use, disclosure, and management of personal data by Focal Search in relation to:

• Job applicants, candidates, and jobseekers who register with or are referred to Focal Search;
• Clients and employer-contacts at organisations that engage Focal Search for recruitment services;
• Visitors to our website at sg.focal-s.com;
• Any individual whose personal data is provided to or processed by Focal Search.

This Notice is published in compliance with the Notification Obligation (Section 13, PDPA) and reflects all eleven data protection obligations as prescribed by the PDPC.

Personal Data We Collect

2.1   Categories of Personal Data

In the course of providing recruitment and employment agency services, Focal Search may collect, use, or disclose the following categories of personal data:

2.2   Special Note on NRIC/FIN Numbers

2.3   Data Collected Via Website Forms

Our website at sg.focal-s.com may collect personal data via the following mechanisms:

• Candidate registration and job application forms;
• Client inquiry and contact forms;
• Email subscription or newsletter opt-in forms;
• Cookies and analytics tools (see Section 13).

No form on our website uses pre-ticked consent boxes. All consent is obtained through active opt-in mechanisms, consistent with the Consent Obligation under the PDPA.

Purposes of Collection, Use and Disclosure

In compliance with the Purpose Limitation Obligation and the Notification Obligation, Focal Search collects, uses, and discloses personal data only for the following purposes that a reasonable person would consider appropriate in the circumstances:

3.1   For Candidates and Jobseekers

• Assessing suitability for current and future job vacancies;
• Preparing, submitting, and managing applications to prospective employers;
• Conducting background screening and reference checks;
• Preparing and submitting work pass applications to MOM (including S Pass, Employment Pass, and related applications) — this constitutes the primary legal basis for NRIC/FIN collection;
• Maintaining candidate profiles for future opportunities (with your consent);
• Processing payroll or contractor payments where applicable;
• Communicating with you about your application, interview scheduling, and placement status;
• Complying with MOM licensing requirements, Employment Agencies Act obligations, and other applicable laws.

3.2   For Client Contacts

• Managing the business relationship between Focal Search and your organisation;
• Providing recruitment services and communicating on active mandates;
• Processing invoices and maintaining financial records;
• Complying with applicable corporate, tax, and regulatory obligations.

3.3   For Website Visitors

• Responding to inquiries submitted via the contact form;
• Improving website performance and user experience;
• Marketing and promotional communications — only with your explicit prior opt-in consent.

Consent — How We Obtain and Manage It

4.1   Obtaining Consent

Focal Search obtains your consent before or at the time of collecting your personal data. Our consent mechanisms include:

• Active opt-in checkboxes on all web forms (pre-ticked boxes are not used);
• A clear consent statement accompanying all paper and digital forms;
• Candidate registration agreements that specify the purposes for which data will be used.

4.2   Deemed Consent

In certain circumstances, consent may be deemed to have been given where you voluntarily provide personal data for an obvious purpose — for example, providing your contact details to a recruiter to pursue a job application, or supplying a shipping address when ordering branded materials.

4.3   Withdrawal of Consent

You may withdraw your consent at any time by contacting our DPO at the details provided in this Notice. Upon receipt of your withdrawal request:

• We will inform you of the likely consequences of withdrawal (e.g., we may no longer be able to represent you for active vacancies or maintain your profile);
• We will cease processing your personal data for the relevant purpose within a reasonable time;
• Withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal.

Please note that withdrawal of consent does not override any legal obligation we have to retain your data (e.g., under the Employment Agencies Act or MOM requirements).

Disclosure of Personal Data to Third Parties

Focal Search may disclose your personal data to the following categories of third parties, strictly for the purposes outlined in Section 3:

Focal Search does not sell, rent, or trade your personal data to any third party for commercial purposes.

Accuracy of Personal Data

Focal Search takes reasonable steps to ensure that personal data in our possession is accurate and complete, particularly where it is used to make decisions that affect you — such as assessing your suitability for a position or disclosing your profile to a prospective employer.

You are responsible for ensuring that the information you provide to us is accurate and current. If your circumstances change — such as a new employer, updated qualifications, or revised contact details — please notify our DPO or your dedicated recruiter promptly.

We will verify data at the point of collection for roles requiring MOM work pass applications, as inaccuracies may have legal consequences.

Transfer of Personal Data Outside Singapore

In accordance with the Transfer Limitation Obligation under the PDPA, Focal Search will only transfer personal data to recipients outside Singapore if we are satisfied that the recipient provides a standard of protection that is comparable to that under the PDPA.

Circumstances in which overseas transfer may occur include:

• Your application for a position is with an employer headquartered or operating outside Singapore;
• We use cloud-based technology platforms with servers hosted outside Singapore (including applicant tracking systems, email, and data backup services);
• We work with affiliated or partner recruitment agencies in other jurisdictions.

Safeguards we employ include:

• Contractual clauses with overseas recipients that mirror PDPA obligations;
• Verification that overseas cloud providers meet or exceed Singapore’s data protection standard;
• Where specific exemptions apply (e.g., you have given explicit informed consent after being briefed on the risks of the transfer, or the transfer is necessary for the performance of a contract to which you are a party).

Protection of Your Personal Data

Focal Search implements reasonable and appropriate technical, organisational, and physical security arrangements to protect your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks.

Our security measures include:

• Digital security: SSL/TLS encryption on our website; password-protected and access-controlled systems; multi-factor authentication for staff accounts; regular security audits;
• Vendor management: We contractually require all data intermediaries and third-party technology vendors to implement adequate security measures consistent with the PDPA Protection Obligation;
• Physical security: Sensitive documents are stored in locked facilities with access restricted to authorised personnel;
• Staff training: All Focal Search personnel who handle personal data receive regular training on PDPA obligations and our internal data protection policies;
• Incident response: We maintain a documented Data Breach Response Plan as described in Section 11 below.

Retention and Disposal of Personal Data

In compliance with the Retention Limitation Obligation, Focal Search will cease to retain personal data — or remove the means by which the data can be associated with specific individuals — once it is no longer necessary for any legal or business purpose.

Our standard retention schedule is as follows:

Upon expiry of the applicable retention period, Focal Search will securely dispose of personal data by: shredding physical documents using cross-cut shredders; permanently deleting digital files using secure deletion software; removing candidate profiles from our applicant tracking system. Data will not be recoverable following secure disposal.

Your Rights — Access, Correction and Portability

10.1   Right of Access

You have the right to request access to the personal data we hold about you, and information about how that data has been used or disclosed within the one year preceding your request.

• Submit your request in writing to our DPO at [email protected];
• We may charge a reasonable administrative fee to cover the cost of retrieving and preparing the data;
• We will respond within 30 calendar days. If more time is required, we will notify you of the extended timeline.

10.2   Right of Correction

If you believe that the personal data we hold about you is inaccurate or incomplete, you may submit a correction request to our DPO.

• Upon verification, we will correct the data as soon as practicable;
• Where the corrected data was previously disclosed to a third party (e.g., an employer) within the year before the correction, we will send the corrected data to that third party unless it is not reasonable or practicable to do so;
• We will notify you when the correction has been made.

10.3   Right of Data Portability

Under the Data Portability Obligation (which will take effect upon the issuance of supporting regulations by the PDPC), you will have the right to request that Focal Search transmit your user-provided data and user activity data held in electronic format to another organisation in a commonly used, machine-readable format.

To submit an access, correction, or portability request, please contact our DPO using the details at the top of this Notice. We may request proof of identity before processing your request.

Data Breach Notification

In the event of a data breach, Focal Search will act in accordance with the Data Breach Notification Obligation under Part VIA of the PDPA.

Our process:

• We will assess whether the breach is likely to result in significant harm to affected individuals or is of a significant scale;
• If the breach is notifiable, we will inform the PDPC and the affected individuals as soon as practicable, and in any case within three (3) calendar days of determining that the breach is notifiable;
• Our notification will include: the nature of the breach, the data involved, the likely consequences, and the measures taken or proposed to address the breach;
• We maintain a documented Data Breach Response Plan and conduct regular breach simulation exercises.

If you believe that your personal data held by Focal Search has been compromised, please contact our DPO immediately at [email protected].

Cookies and Website Analytics

Our website uses cookies and similar tracking technologies to enhance your browsing experience and to collect anonymised analytics data. Cookies may be used for:

• Session management (e.g., keeping you logged in during a session);
• Analytics (e.g., understanding which pages are visited most frequently);
• Marketing and retargeting — only where you have provided explicit consent.

You may control cookie settings through your browser settings. Disabling certain cookies may affect the functionality of parts of the website. Where we use marketing or analytics cookies requiring your consent, we will present a cookie consent banner that uses active opt-in mechanisms — consistent with the PDPA Consent Obligation.

Updates to This Notice and Governing Law

Focal Search reserves the right to update this Data Protection Notice at any time to reflect changes in our practices, regulatory requirements, or the law. The current version, including its effective date and version number, is always published at sg.focal-s.com/privacy. Where updates are material, we will notify you by email or via a notice on our website.

This Notice is governed by and construed in accordance with the laws of the Republic of Singapore. Any dispute arising in connection with this Notice shall be subject to the exclusive jurisdiction of the Singapore courts.