PropSeek DPO and Data Breach Notification Terms

1. Scope

1.1 These Terms describe the Data Protection Officer (DPO) arrangements of the PropSeek Platform (App and Website) and how data breaches are assessed, notified and communicated.

1.2 The operator is Redland Pte. Ltd. (UEN 202304648K). These Terms are made under the Personal Data Protection Act 2012 (PDPA) and its regulations.

2. DPO designation and contact

2.1 Under section 11(3) of the PDPA, we designate at least one individual to be responsible for ensuring that we comply with the PDPA.

2.2 DPO contact details (made available under section 11(5) of the PDPA):

• Title: Data Protection Officer
• Email: dpo@propseek.homes

2.3 Where published: the "Privacy and DPO" link in the Website footer, the Privacy Policy anchor /privacy#dpo, and the DPO contact registration that the operator completes through ACRA BizFile+ before the official launch.

2.4 DPO responsibilities:

1. Advise on and oversee PDPA compliance;
2. Receive and handle data subject requests (access, correction, withdrawal of consent, export, deletion);
3. Set and maintain the data breach response process and run exercises;
4. Act as the contact point with the PDPC;
5. Keep public privacy documents consistent with actual practice.

3. What counts as a data breach

3.1 A data breach is any event that leads or may lead to unauthorised access, collection, use, disclosure, copying, modification or loss of personal data, including misdirected messages, lost devices or credentials, intrusions and internal access beyond authority.

3.2 Unauthorised access or disclosure that occurs only within our organisation does not need to be notified under section 26B(4) of the PDPA, but must still be logged and remedied internally.

4. Assessment process and timing

4.1 A suspected breach is logged within 24 hours of discovery (internal target).

4.2 The assessment must be done reasonably and expeditiously (section 26C(2) of the PDPA). Our internal target is to finish within 7 days. PDPC guidance gives 30 calendar days as a reference limit; beyond that we must be able to explain the delay to the PDPC.

4.3 The assessment covers:

1. The nature of the breach, the categories of personal data and the number of people affected;
2. Whether it results or is likely to result in significant harm (judged under regulation 3 and the Schedule of the Personal Data Protection (Notification of Data Breaches) Regulations 2021, for example a name or ID number combined with Schedule data, or an account identifier combined with a password or verification code);
3. Whether it affects 500 or more people (regulation 4 of the same Regulations);
4. Whether remedial action has made harm unlikely (for example strong encryption with keys not exposed, or immediate revocation of credentials);
5. Whether a statutory exception to notification applies.

4.4 The result is recorded in the breach log with the timeline, decision makers and reasons.

5. Notifying the PDPC

5.1 If notification is required, we notify the Personal Data Protection Commission (PDPC) within 3 calendar days after completing the assessment (section 26D(1) of the PDPA).

5.2 Notification uses the PDPC's designated channel and covers the nature of the breach, data categories and numbers, cause, remedial actions taken and planned, and a contact person.

5.3 The DPO is responsible for notification. If the DPO is unavailable, a deputy named by the DPO acts and informs the DPO within 24 hours.

5.4 Notification templates and steps are kept in the runbook (WP-68). A tabletop exercise (WP-86) is held at least once a year.

6. Notifying individuals

6.1 If the breach is likely to cause significant harm, we notify affected individuals at the same time as or after notifying the PDPC (section 26D(2) of the PDPA). If notification is required only because 500 or more people are affected, without significant harm, only the PDPC is notified.

6.2 How we notify: App push and email, in Chinese and English, covering the nature of the breach, the data categories involved, actions taken, steps you can take to protect yourself, and how to contact us.

6.3 Exceptions (sections 26D(5) and (6) of the PDPA):

1. Remedial action has made significant harm unlikely;
2. Technological protection makes the data unintelligible (for example strong encryption with keys not exposed);
3. A law enforcement agency or the PDPC directs that individuals not be notified.

6.4 Use of an exception is recorded in writing with the reasons and decision maker.

7. Obligations of data intermediaries

7.1 Service providers processing data for us (data intermediaries) must notify us without undue delay when they discover a breach (section 26C(3) of the PDPA). We ask providers to notify us as soon as possible, with a target of 24 hours.

7.2 The provider list is in Section 6 of the Privacy Policy (AWS, Cloudflare, Twilio, Google, Apple, Expo, Sentry, Anthropic, Crisp, OneMap and others).

7.3 On receiving a provider's notice, we start an assessment under Section 4.

8. Records, training and exercises

8.1 The breach log is kept for at least 3 years.

8.2 The runbook (WP-68) includes the logging template, assessment checklist, PDPC notification template, individual notice template, contact list and escalation path.

8.3 A tabletop exercise (WP-86) is held at least once a year, covering discovery, assessment, notification, communication and review.

9. How to report a suspected breach

9.1 If you notice unusual account activity, a suspected data breach, or phishing in PropSeek's name, please at once:

• email the DPO at dpo@propseek.homes for breaches and privacy matters, or support at support@propseek.homes for account and security matters;
• use the in-App report entry.

9.2 Please do not post your ID number or verification codes in public. PropSeek staff will never ask you for a verification code.

10. Relationship with the PDPC

10.1 We cooperate with PDPC investigations and directions as required by law.

10.2 You may complain to the PDPC about how we handle your data (https://www.pdpc.gov.sg).

11. Contact

11.1 DPO: dpo@propseek.homes.

11.2 Support: support@propseek.homes; Website /support.