Personal Data Protection Notice
Draft for review. Items marked 'to confirm' are placeholders that legal counsel will confirm before publication.
Super Arena (Draft, to confirm: [Super Arena Pte. Ltd., UEN to confirm]) is the organisation responsible for your personal data under Singapore’s Personal Data Protection Act 2012. This notice explains what we collect, why, who receives it, how long we keep it, and your rights.
What we collect
When you create an account: your first and last name, the name you prefer to be addressed by, email address, mobile number, how you heard about us, and your consent choices. We do not collect NRIC or FIN numbers, and we will never ask for them.
When you add family members: each child’s first and last name, date of birth, and, if you choose to give them, gender, school and medical notes relevant to sport. For another adult guardian, their name and email address so we can invite them.
When you apply for a sport or programme: what you are interested in, which family members it is for, experience level, preferred days and times, and anything you write in the message box.
Automatically: the time of each sign-in, the device and browser used, your IP address, a record of each consent you give or withdraw, including the version of the text you saw, and the reason a member of venue staff recorded when they opened your record.
Medical information is collected only so that a partner academy can keep your child safe during activity. It is shown only to the academies you apply to, and to venue staff responding to an emergency.
Why we use it
- To run your account and your family’s profiles, and to sign you in securely.
- To pass your application to the partner academy you chose, so it can contact you, arrange a trial and run its programme.
- To send service messages: sign-in codes, invitation emails, confirmations, and safety notices. These are required to provide the Services and do not carry marketing.
- To send marketing by email or WhatsApp, only if you have opted in. You can opt out at any time and it takes effect within 24 hours across all channels.
- To keep the venue safe, investigate incidents, and meet our legal obligations.
- To understand how the Services are used, using aggregated statistics that do not identify you.
Children’s data is never used for marketing profiling.
Who receives it
- Partner academies at the venue. When you apply for or book a programme, that academy receives the application and the details of the family members it is for, including medical notes. Each academy is a separate organisation responsible for its own use of that data under its own terms. An academy never receives data about your family’s applications to other academies.
- Service providers acting for us. Railway, which hosts the Services and database in Singapore; Resend, which delivers our emails; Draft, to confirm: [analytics and error-monitoring providers to confirm]. Each is bound by contract to use your data only to provide its service to us.
- Authorities, where the law requires disclosure.
We do not sell personal data.
Where it is stored and transfers
Your data is stored in Singapore. Some service providers process data outside Singapore, for example email delivery. Where that happens, we have contractual protections in place that meet the PDPA’s transfer requirements, and we keep a register of these providers that is reviewed quarterly.
How long we keep it
| Data | Retained |
|---|---|
| Account and family profiles | While the account is active, then anonymised after three years of inactivity, with 30 days’ notice |
| Applications and enquiries | Three years from the last activity |
| Consent records | For the life of the consent plus two years |
| Sign-in and security logs | Twelve months |
| Payment and settlement records, where applicable | Five years, as required by tax law, in anonymised form after account closure |
| Incomplete registrations (form details held while a sign-in code is pending) | Deleted within 24 hours of the code expiring or the registration completing |
| Access reasons recorded when venue staff open member records | Twelve months, with the sign-in and security logs |
When we anonymise, your name and contact details are removed and records that the law requires us to keep are re-keyed to an anonymous identifier.
Your rights
You can, at any time, from your account or by emailing the contact below:
- see the personal data we hold about you and your family;
- correct anything that is wrong;
- withdraw any consent, including marketing and a child’s media consent; withdrawal takes effect within 24 hours;
- ask us to delete your account, which anonymises your data as described above;
- receive a machine-readable copy of your data.
We respond to requests within 30 days. Withdrawing the consents needed to run your account means we can no longer provide the Services to you, and we will tell you that before acting.
Children and guardians
A child’s profile exists only under a guardian’s account. For children under 18, all consents are given by the guardian. Two guardians may share responsibility for one child, and either may act for the child. We will not link a child to a second family without an invitation from an existing guardian.
Security
Data is encrypted in transit and at rest. Access by venue staff and partner academies is limited by role, scoped to the families and applications they are responsible for, and logged. Sign-in uses one-time codes rather than passwords for members.
If something goes wrong
We will assess a data breach affecting your data within three calendar days of becoming aware of it. Where we determine the breach is notifiable, we will notify the Personal Data Protection Commission within three calendar days of that determination. We will notify you as soon as practicable.
Changes to this notice
We will publish changes here. For a material change we will tell you through the Services or by email and ask you to accept the new version before you next book, apply or change your family’s details; reading your account and withdrawing consents never depend on it. For a non-material change we publish the new version with a dated note. Each version has a version tag, and your consent record shows which version you accepted.
Contact
Data Protection Officer: Draft, to confirm: [name to confirm] Email: Draft, to confirm: [dpo@superarena.com.sg to confirm] Address: 321 Clementi Avenue 3, Singapore 129905 Phone: +65 8795 0053
You may also contact the Personal Data Protection Commission at pdpc.gov.sg.