1. Introduction

“We”, “Our” or “Koomi” (previously known as “Novitee”) means Novitee Pte. Ltd. and any of our related companies. We respect the privacy and confidentiality of the personal data of our clients, end users and others whom we interact with in the course of providing our services. We have developed this Data Privacy Notice to assist you in understanding how we collect, use, disclose, process, protect and retain your personal data that is in our possession. We are committed to implementing policies, practices and processes to safeguard the collection, use and disclosure of the personal data you provide us, in compliance with the Singapore Personal Data Protection Act (PDPA) 2012.

Koomi collects your personal data when you sign up for an account (“Koomi” Account) when using the Koomi software, applications/and or platforms, and when you visit or make transactions with any of our network participating merchants.

This Notice supplements but does not supersede nor replace any other consents you may have previously provided to the Firm in respect of your Personal Data, and your consents herein are additional to any rights which to Koomi may have at law to collect, use or disclose your personal data.

In this Notice, “personal data” refers to any data, whether true or not, about an individual who can be identified (a) from that data; or (b) from that data and other information to which we have or are likely to have access, including data in our records as may be updated from time to time, but excludes “business contact information” as defined in the PDPA.

Other terms used in this Notice shall have the meanings given to them in the PDPA (where the context so permits).

2. Types of Personal Data Collected

We may collect personal data from you in the course of our business, including through your use of our sites, when you contact or request information from us, when you engage our services or as a result of your relationship with one or more of our staff and customers. Depending on the nature of your interaction with us, the personal data that we may collect includes:

• Unique identifiers (e.g. full name);
• Contact information (e.g. email address and/or personal mobile telephone number));
• Financial information (e.g. account numbers and/or banking transactions);
• Technical information (e.g. information from your visits to our website or applications or in relation to materials and communications we send to you electronically);
• Personal opinions made known to us (e.g. feedback or responses to surveys);
• Any other information relating to you or any individuals which you have provided us in any forms you may have submitted to us, or via other forms of interaction with you.

As the purposes for which we may collect, use, disclose and/or process your personal data may change depending on the circumstances at hand, such purpose may not appear above. However, we will notify you of such other purpose at the time of obtaining the necessary consent(s), unless consent is not required under the PDPA or by law.

3. Use of Cookies

We use “cookies” to collect information about your online activity on our website. A cookie is a small text file created by the website that is stored in your computer to provide a way for the website to recognise you and keep track of your preferences. The cookie makes it convenient for you such that you do not have to retype the same information again when you revisit the website or in filling electronic forms.

Most cookies we use are “session cookies”, which will be deleted automatically from the hard disk of your computer at the end of the session.

You may choose not to accept cookies by turning off this feature in your web browser. Note that by doing so, you may not be able to use some of the features and functions in our web applications.

4. Use and Processing of Information

Generally, the purposes for which Koomi collects, uses and discloses personal data include:

• Providing and administering your Koomi account;
• Providing updates and other communications on development relating to Koomi;
• To send administrative email notifications (regarding security, support and/or maintenance notices);
• To improve our services and communications to you and the quality of your interaction with our Sites, include auditing and monitoring its use;
• Send promotional communications, such as providing you with information about products and services, features, surveys, newsletters, offers, promotions, contests, and events;
• Personalise the sites and services, including by providing features or advertisements that match your interest and preferences;
• Page visits or mobile application usage that may store information about your computer or mobile phone configuration such as your IP address, location, where you have executed transactions stored within the application, screens viewed within the mobile application, cookie information and the pages you requested. Koomi may use this information to help make changes to the service to better serve you and our users;
• For the purpose of recruitment; and/or
• Any other purposes which we notify you of at the time of obtaining your consent.

Although the sections above describe our primary purpose in collecting your information, in many situations we have more than one purpose. As a result, our collection and processing of your information is based in different contexts upon your consent, our need to perform a contract, our obligations under the PDPA or by law, and/or our legitimate interest in conducting our business.

5. Sharing Of Information

In addition to the specific situations discussed elsewhere in this policy, we disclose information in the following situations:

• Affiliates and Acquisitions. We may share information with our corporate affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If another company acquires, or plans to acquire, our company, business, or our assets, we will also share information with that company, including at the negotiation stage.
• Other Disclosures with Your Consent. We may ask if you would like us to share your information with other unaffiliated third parties who are not described elsewhere in this policy.
• Other Disclosures without Your Consent. We may disclose information in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws. We may also share your information in order to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our policies, or to comply with your request for the shipment of products to or the provision of services by a third party intermediary.
• Service Providers. We share your information with service providers. Among other things service providers help us to administer our website, provide technical support, process payments, etc.

We respect the confidentiality of the personal data you have provided to us. We will not disclose personal data provided to us to third parties (such as new merchants that join our network or new merchants whose loyalty programmes you would like to join) without first obtaining consent(s) permitting us to do so. However, please note that we may disclose the personal data you provided to third parties without first obtaining your permission in certain situations:

• cases in which the disclosure is required or authorised based on applicable laws and/or regulations;
• cases in which purpose of such disclosure is clearly in your interests and if consent cannot be obtained in a timely manner;
• cases in which disclosure is necessary to response to emergencies that threatens the life, safety and health of yourself or another individual;
• cases in which disclosure is necessary for any investigations or proceedings;
• cases in which personal data is disclosed to any officer of a prescribed law enforcement agency, upon production of written authorisation signed by the head or director of that law enforcement agency or a person of a similar rank, certifying that the personal data is necessary for the purposes of the functions or duties of the officer; and/or
• where such disclosure without your consent is permitted by the PDPA or by law.

The instances listed above are not intended to be exhaustive. For more information on the exceptions, you are encouraged to peruse the Second, Third and Fourth Schedules of the PDPA which is publicly available at https://sso.agc.gov.sg/Act/PDPA2012.

6. Your Choices

You can make the following choices regarding your information:

• Marketing Emails. You may choose to provide us with your email address for the purpose of allowing us to send free newsletters, surveys, offers, and other promotional materials to you. You can stop receiving promotional emails by following the unsubscribe instructions in e-mails that you receive. If you decide not to receive promotional emails, we may still send you service related communications.
• Access To Your Personal Information. You may request access to your personal information by contacting us at the address below. If required by law, upon request, we will grant you reasonable access to the personal information that we have about you.
• Changes To Your Personal Information. You can contact us at the address described below in order to request that your information be modified. Please note that the PDPA exempts certain types of personal data from being subject to your correction request.
• Deletion Of Your Personal Information. Typically we retain your personal information for the period necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required or permitted by law. You may, however, request information about how long we keep a specific type of information, or request that we delete your personal information by contacting us at the address below. In addition, we may keep your personal information as needed to comply with our legal obligations, resolve disputes, and/or enforce any of our agreements.
• Revocation Of Consent. If you revoke your consent for the processing of personal information, it is deemed that you wish to delete your Koomi account in which case we will no longer be able to provide you our services. In some cases, we may limit or deny your request to revoke consent if the law permits or requires us to do so, or if we are unable to adequately verify your identity. You may revoke consent to processing (where such processing is based upon consent) by contacting us at the address below.

7. How We Protect Personal Information

We will take reasonable efforts to ensure that the personal data you provided is reflected accurately and completely, if your personal data is likely to be used by Koomi to make a decision that affects you, or disclosed to another organisation. However, this means that you must also update us of any changes in relation to personal data that you had initially provided us with. We will not be responsible for relying on inaccurate or incomplete personal data arising from you not updating us of any changes in the personal data that you had initially provided us with.

Where personal data you provided is to be transferred out of Singapore, we will comply with the PDPA in doing so. In this regard, this includes us obtaining the necessary consent(s) unless an exception under the PDPA or law applies, and taking appropriate steps to ascertain that the foreign recipient organisation of the personal data is bound by legally enforceable obligations to provide to the transferred personal data a standard of protection that is at least comparable to the protection under the Act. This may include us entering into an appropriate contract with the foreign recipient organisation dealing with the Personal Data transfer or permitting the personal data transfer without such a contract if the PDPA or law permits us to.

We will also put in place measures such that personal data you provided in our possession or under our control is destroyed and/or anonymised as soon as it is reasonable to assume that the purpose for which the personal data was collected is no longer being served by the retention of such personal data or is no longer necessary for any other legal and businesses purposes.

No method of transmission over the Internet, or method of electronic storage, is fully secure. While we use reasonable efforts to protect your personal information from unauthorised access, use, or disclosure, we cannot guarantee the security of your personal information. In the event that we are required by law to inform you of unauthorised access to your personal information we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

8. Miscellaneous

The following additional information relates to our privacy practices: Where there is a need to transfer your personal data to another country outside Singapore, we will ensure that the standard of data protection in the recipient country is comparable to that of Singapore’s PDPA. If this is not so, we will enter into a contractual agreement with the receiving party to accord similar levels of data protection as those in Singapore.

9. Contacting Us

If you have any query or feedback regarding this Notice, or any complaint you have relating to how we manage your personal data, you may contact our Data Protection Officer (DPO) at: [email protected]. Any query or complaint should include, at least, the following details:

• Your full name and contact information
• Brief description of your query or complaint

We treat such queries and feedback seriously and will deal with them confidentially and within reasonable time.

10. Updates on Privacy Policy

To ensure that we properly collect, use, store, disclose, process and/or protect your personal data, we may update this Privacy Policy Notice from time to time. Updated version(s) of this notice/statement will be posted to the Koomi website. We may or may not inform you of the updated version(s) via email, text or other mode of communications. We reserve the right to amend the terms of this personal data protection notice and privacy statement at our sole and absolute discretion. Please visit our website periodically to note any changes.

Last updated: 01 March 2024