How we protect candidate and client data under Singapore's PDPA
40%
4/10 controls passing
Continuously monitored · last automated check 15 hours ago
Privately verified
Identity data is kept separate and never shown publicly.
Publicly pseudonymous
Candidates are presented by CandidateID, not by name.
Access logged
Every CV view is recorded and reviewed.
Consent obligation
Data protection consent checkbox on candidate forms; Direct Apply consent audit records.
Purpose limitation & notification
Privacy policy link on forms and emails; Original CV purpose note in CV Studio.
Access & correction
Candidate Portal profile editing and CV Studio.
Protection obligation
Row-level security on candidate records, private CV storage, bot guard and rate limiting.
Retention limitation
Archived job orders, auto-clean of old logs and applications, account deletion.
Transfer limitation
Confidential CVs with redacted PII sent to companies; partner API keys.
Data breach notification
Security scan results and incident response policy.
Accountability & DPO
Approved policies in the Compliance Hub.
Access logging
CV access log and user activity log.
Do Not Call & marketing consent
Suppression list and unsubscribe links on marketing emails.
Policies are being finalised.
Chris Ho · chris@jjobb.com
Contact our DPO for access, correction or withdrawal-of-consent requests, or audit enquiries.
Retention: candidate personal data is anonymised after 2 years of inactivity.