Personal Data Protection Statement

DATA PROTECTION NOTICE

This Data Protection Notice ("Notice") sets out the basis on which Aik Heng Engineering Pte. Ltd. ("we", "us" or "our") may collect, use, disclose or otherwise process personal data in accordance with the Personal Data Protection Act 2012 ("PDPA") of Singapore.

This Notice applies to personal data in our possession or under our control, including personal data processed by organisations and third-party service providers engaged by us to carry out business activities on our behalf.

1. PERSONAL DATA

1.1. For the purposes of this Notice:
"Individual" refers to any person who interacts with Aik Heng Engineering, including customers, prospective customers, employees, job applicants, contractors, suppliers, business partners and website visitors.
"Personal Data" refers to data, whether true or not, about an individual who can be identified from that data or from that data together with other information to which we have or are likely to have access.

1.2. Depending on the nature of your interaction with us, the personal data we may collect includes, but is not limited to:

• Full name and identification details.
• Residential and mailing address.
• Email address and telephone number.
• Nationality, date of birth and gender, where relevant.
• Passport, identity card or other identification document details, where required.
• Photographs and video recordings, including CCTV footage.
• Employment history, qualifications, skills and professional experience.
• Training, certification and workplace safety records.
• Information relating to project assignments and site access.
• Business and company contact information.
• Any other information voluntarily provided to us.

1.3. Other terms used in this Notice shall have the meanings assigned to them under the PDPA, where applicable.

2. COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

2.1. We generally collect personal data directly from individuals or through authorised representatives and other permitted sources. Where required under the PDPA, we will notify you of the purposes for which your personal data is collected, used or disclosed and obtain your consent before proceeding. We may also collect, use or disclose personal data without consent where permitted or required under applicable laws and regulations.

2.2. We may collect and use your personal data for any or all of the following purposes:

• Verifying your identity and processing relevant identification documents.
• Responding to enquiries, requests, applications, complaints and feedback.
• Providing our engineering, construction and related services.
• Managing customer relationships and business communications.
• Processing job applications, recruitment and employment matters.
• Managing employee records, training and professional qualifications.
• Coordinating project operations, site activities and workforce deployment.
• Managing workplace safety, security clearance and site access requirements.
• Arranging relevant work permits, insurance and other employment-related administrative matters, where applicable.
• Maintaining the security of our offices, premises and project locations, including CCTV monitoring.
• Managing relationships with contractors, suppliers, subcontractors and business partners.
• Processing invoices, payments and other administrative transactions.
• Complying with applicable laws, regulations, industry requirements and contractual obligations.
• Responding to requests from government agencies, regulatory authorities and law enforcement bodies.
• Any other purposes for which you have provided your personal data or which are permitted under applicable laws.

2.3. We may disclose your personal data to our authorised employees, contractors, subcontractors, suppliers, professional advisers, auditors, insurers, IT service providers, government bodies, and regulatory authorities where necessary.

2.4. The purposes described above may continue to apply even after your relationship with us has ended, for a reasonable period where necessary to fulfil outstanding contractual, administrative, legal or business obligations.

3. DEEMED CONSENT BY NOTIFICATION

3.1. Where permitted under the PDPA, we may rely on deemed consent by notification to collect, use or disclose personal data for additional purposes beyond those originally notified.
3.2. Before relying on deemed consent by notification, we will assess potential impact, notify individuals through appropriate channels, and provide a reasonable opt-out period.
3.3. Additional purposes may include project-related security clearance, site access, safety management, work insurance, and operational verification.
3.4. Individuals may inform us within the specified reasonable period if they do not wish their personal data to be collected, used or disclosed for the notified purposes.

4. WITHDRAWAL OF CONSENT

4.1. You may withdraw your consent by submitting a written request or email to our Data Protection Officer.
4.2. Upon receiving your request, we will inform you of the consequences of withdrawing consent.
4.3. Depending on the nature of your request, we may be unable to continue providing certain services or fulfilling contractual obligations.
4.4. Withdrawal of consent does not affect our right to continue processing personal data where permitted or required under the PDPA or other applicable laws.

5. ACCESS TO AND CORRECTION OF PERSONAL DATA

5.1. You may submit a request to obtain access to your personal data, enquire about its usage/disclosure, or correct inaccurate data.
5.2. Requests must be submitted in writing or by email to our Data Protection Officer.
5.3. We may require identity verification and, where permitted, charge a reasonable fee for processing access requests.
5.4. We will respond within applicable statutory timeframes.

6. PROTECTION OF PERSONAL DATA

6.1. We implement administrative, physical, and technical safeguards including access restrictions on a need-to-know basis, authentication controls, secure storage, and confidentiality agreements.
6.2. Third-party processors engaged by us are required to maintain comparable data protection standards.
6.3. In the event of a data breach, notifications will be made to authorities and affected individuals in accordance with the PDPA.

7. ACCURACY OF PERSONAL DATA

We take reasonable steps to ensure accuracy and rely on you or your authorised representatives to inform our Data Protection Officer of any changes to your information.

8. RETENTION OF PERSONAL DATA

Personal data is retained only for as long as necessary to fulfil operational, legal, and business purposes. When no longer required, data is securely destroyed, deleted, or anonymised.

9. TRANSFER OF PERSONAL DATA OUTSIDE SINGAPORE

Where overseas service providers are engaged, we ensure transferred personal data receives protection comparable to the requirements under the PDPA.

10. DATA PROTECTION OFFICER CONTACT

11. EFFECT OF NOTICE AND CHANGES

This Notice shall be read together with our Privacy Policy and website Terms & Conditions. We reserve the right to revise this Notice, with updates published on our website together with the latest revision date.

Last Updated: 9 November 2026