Effective date: 24 April 2026
Last updated: 24 April 2026

1. About this Notice

This Data Protection Notice (“Notice“) sets out how the People Profilers group of companies (“People Profilers“, “we“, “us“, or “our“) collects, uses, discloses, retains, and protects personal data across our operations in Singapore, Malaysia, Thailand, Vietnam, and Indonesia.

This Notice applies to personal data in our possession or under our control, including personal data held by third-party organisations we have engaged to collect, use, disclose, or process personal data on our behalf.

By providing personal data to us, or by continuing to use our services, you acknowledge that you have read and understood this Notice.

2. The People Profilers Group & Your Data Controller

Depending on which of our websites, offices, or services you interact with, the specific legal entity that acts as the data controller of your personal data will be one or more of the following group companies:

In general, the country site or office through which you engage our services determines the primary data controller. Where our group companies share personal data among themselves to deliver services, we act as joint controllers.

3. Applicable Data Protection Laws

This Notice is designed to comply with, and should be read alongside, the following laws and any implementing regulations:

• Singapore: Personal Data Protection Act 2012 (“SG PDPA”)
• Malaysia: Personal Data Protection Act 2010 (“MY PDPA”)
• Thailand: Personal Data Protection Act B.E. 2562 (2019) (“TH PDPA”)
• Vietnam: Decree No. 13/2023/ND-CP on Personal Data Protection (“VN PDPD”) and subsequent legislation
• Indonesia: Law No. 27 of 2022 on Personal Data Protection (“UU PDP”)

Where any provision of this Notice is inconsistent with the mandatory requirements of applicable local law, the local law shall prevail for the relevant jurisdiction.

4. Personal Data We Collect

We may collect the following categories of personal data: identification data (including government-issued IDs such as NRIC/FIN, MyKad, Thai National ID, CCCD/CMND, KTP/NIK, or passport number), contact data, employment and professional data, financial data, technical and usage data, and (where required and permitted by law) sensitive personal data such as health or background check information with your explicit consent.

5. Purposes for Which We Use Personal Data

We may collect, use, and disclose your personal data for recruitment and executive search, EOR and payroll services, HR advisory and outplacement, work pass / visa applications, identity and eligibility verification, background and reference checks (with consent), contract performance, responding to your queries, managing our relationships, processing payments, marketing communications (with consent), legal compliance, sharing among group entities for coordinated regional service delivery, and other purposes you have been notified of.

6. Legal Bases for Processing

We rely on the following legal bases as applicable under the relevant jurisdiction: consent, contract performance, legal obligation, legitimate interests (where recognised), vital interests, and public interest / legal proceedings.

7. Disclosure of Personal Data

We may disclose your personal data to our group companies, our clients (with your knowledge and consent where required), third-party service providers and agents, government and regulatory authorities where required by law, professional advisers and auditors, and acquirers or successors in the event of a merger, acquisition, or sale of all or part of our business.

8. Cross-Border Data Transfers

Because we operate across five Southeast Asian countries, your personal data may be transferred to and processed in jurisdictions other than the one in which you are located. Such transfers comply with the cross-border requirements of the applicable law, which may include ensuring the recipient jurisdiction provides a comparable standard of protection, binding contractual arrangements with the recipient, or obtaining your explicit consent where required (e.g. under VN PDPD and UU PDP).

9. Data Retention

We retain personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by applicable laws. When no longer required, we will securely delete, destroy, or anonymise it.

10. Your Rights

Subject to the applicable law in your jurisdiction, you have the following rights in respect of your personal data: access, correction, withdrawal of consent, objection to or restriction of processing, data portability, erasure, and the right to lodge a complaint with the data protection authority in your country. To exercise these rights, contact our Data Protection Officer (see below). We will respond within the timeframes required by the applicable law (generally 30 days).

11. Withdrawing Your Consent

You may withdraw your consent at any time by submitting a written request to our Data Protection Officer. We shall generally process withdrawal requests within ten (10) business days of receipt. Please note that withdrawing consent may prevent us from continuing to provide our services to you.

12. Data Protection Officer & Contact

Our Group Data Protection Officer is the primary point of contact for all data protection matters across our five markets:

• Email: dpo@peopleprofilers.com
• Mailing address: Data Protection Officer, People Profilers Pte. Ltd., 20 Cecil Street #08-09 Plus, Singapore 049705

13. Regulatory Authorities

If you believe we have not handled your personal data in accordance with applicable law, you may lodge a complaint with the data protection authority in your country:

• Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg
• Malaysia: Department of Personal Data Protection (JPDP) — pdp.gov.my
• Thailand: Office of the Personal Data Protection Committee (PDPC) — pdpc.or.th
• Vietnam: Ministry of Public Security (Department of Cyber Security and Hi-Tech Crime Prevention)
• Indonesia: Personal Data Protection Supervisory Agency (currently administered by the Ministry of Communication and Informatics)

14. Security of Personal Data

We take reasonable administrative, technical, and physical measures to protect personal data including access controls, encryption in transit, confidentiality obligations on staff, staff training, incident response procedures, and regular security reviews. No method of electronic storage or transmission is 100% secure.

15. Children’s Personal Data

Our services are directed at adults (generally age 18 and above, or the age of majority in the applicable jurisdiction). We do not knowingly collect personal data from children.

16. Changes to this Notice

We may update this Notice from time to time to reflect changes in our practices, services, or applicable laws. The updated Notice will be posted on our websites with a revised “Last updated” date.

17. Governing Law

This Notice shall be interpreted in accordance with the applicable data protection law of the country in which the relevant group entity is established.

For questions about which specific entity is the data controller of your personal data, please contact our Data Protection Officer at dpo@peopleprofilers.com.