Privacy & PDPA

WorkPass Pilot is an HR compliance tool that helps Singapore small and medium enterprises (SMEs) and employment agencies track foreign employee work pass renewals, estimate levies and manage related documentation. This privacy policy explains how we collect, use, disclose and protect personal data when you use our website and application, in accordance with the Personal Data Protection Act 2012 ("PDPA") of Singapore.

In this policy, "we", "us" and "our" refer to the operator of WorkPass Pilot. Where your employer or employment agency uses WorkPass Pilot to manage your work pass records, your employer remains the data controller of your personal data, and we process that data on their behalf as part of providing the service.

Account and contact data: your name, email address and role within your company or agency, collected when you register or are invited to a workspace.

Employee pass data: for each work pass holder, the company (as data controller) submits the employee's full name, nationality, work pass type and number, pass issue and expiry dates, work sector, monthly salary details (for Employment Pass and S Pass holders) and free-form notes.

Documents: files uploaded by the company, such as pass cards, In-Principle Approval (IPA) letters, insurance proofs and employment contracts.

Usage and audit data: we log which user viewed, created, edited or downloaded which record and when, and we collect basic technical information (such as device and browser type) to keep the service secure and improve it.

We use personal data to: provide and operate the WorkPass Pilot service, including expiry tracking, renewal reminders and levy estimation; maintain an audit trail of actions taken on pass holder records; communicate with you about your account, service updates and support requests; process subscription payments through our payment provider; and comply with applicable laws and protect the service against misuse.

We do not sell personal data, and we do not use employee pass data for advertising or unrelated commercial purposes.

We process personal data on the basis of consent, contractual necessity and legitimate interests, as applicable under the PDPA. When a company creates a workspace, its owner confirms that employees have been notified that their personal data is processed in the app for work pass compliance purposes. Employees who wish to withdraw consent or object should contact their employer in the first instance.

We share personal data only with the parties and for the purposes described below:

Cloud hosting and infrastructure providers, who store and process data on our behalf to run the service; our payment provider, which processes subscription payments and card details (card data goes directly to the payment provider and is not stored on our servers); our email and messaging providers, for transactional notifications such as renewal reminders and support replies; and professional advisers or authorities, where required by law, court order or to protect our legal rights.

Agencies using WorkPass Pilot can access a client company's pass data only after the client company approves the link, and only for the roles the client approves.

Your data is stored on secure cloud infrastructure that may be located outside Singapore. Where personal data is transferred out of Singapore, we put in place safeguards comparable to the PDPA standard, as required under the Transfer Limitation Obligation, and the employer remains accountable for its own transfers as data controller.

Account data is retained while your workspace is active and for a reasonable period afterwards for record-keeping and dispute resolution.

Each company sets its own retention period for pass holder records (12 months after pass expiry by default). Records of passes that expired beyond that period are flagged for the company owner to review, archive or delete. Nothing is erased automatically — every deletion is an explicit owner action, and the audit trail records it.

Audit logs are retained to keep the service accountable and may be retained for a longer period where required by law.

Employees may request access to, or correction of, their personal data through their employer, who acts as the data controller. Companies can view, export and correct pass holder records within the app, and we will respond to reasonable requests in accordance with the PDPA.

Workspace users may also update their own account profile details at any time from the Settings page.

We use essential cookies and similar technologies to keep you signed in and keep the app secure. We also collect aggregate usage analytics to understand which features are used and to improve the product. Analytics do not contain the contents of your pass holder records.

WorkPass Pilot is a business tool intended for employers, HR staff and agencies. It is not directed at individuals under the age of 13, and we do not knowingly collect personal data from children.

We apply technical and organisational measures to protect personal data, including encryption in transit, access controls and company-level data isolation so that a workspace's records are visible only to its approved members and agency links. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We may update this policy from time to time to reflect changes in the service or the law. The "last updated" date at the top of this page shows when the current version took effect. Material changes will be highlighted in the app or on our website.

If you have questions about this policy, or to exercise your access or correction rights, contact us through our contact page or email privacy@workpasspilot.com.

For data held about an employee by their employer, please contact your employer first, as they are the data controller of that information.