Compliance
Data subjects are notified at the time of collection. Additionally, users can reference the privacy policy at datadirect.com.sg, which informs the Data Subject how their data was collected, its use and disclosure.
The organisation records the notification provided to the data subject regarding their personal information collection, use and disclosure. These records are recorded with the data subject's personal details as a record in our database.
The legal basis Data Direct relies on to collect the personal data from the Data Subject is opt-in consent.
Consent is obtained from Data Subjects through an online web page where they are presented with a user journey where they are provided with information and respond using tick boxes that are NOT pre-ticked.
Consent is obtained explicitly from Data Subjects through an online web page, with tick boxes that are NOT pre-ticked.
The purpose for collecting, use and disclosure of the Data Subject's personal data is clearly stated on the online web page during the user journey with non-pre-ticked checkboxes.
Consent is obtained explicitly from Data Subjects through an online web page, with individual consent obtained from each Data Subject rather than bulk consent.
Consent to each explicitly presented notification is recorded in our database with the associated Data Subject's collected data, including consent status, notification details, date and source.
Yes. We provide a contact point on our web page and privacy policy so Data Subjects can make withdrawals. Four key policies are maintained: a Data Subject Rights Policy (covering GDPR Article 21 objection/withdrawal rights), a Consent Management Policy (ensuring explicit, informed, freely given consent that's as easy to withdraw as to give), an Opt-Out Mechanism Policy (complying with direct-marketing rules under Article 21(2)), and a Data Processing and Retention Policy (ensuring processing stops upon opt-out). Related articles: GDPR 7(3), 21(1), 21(2), and 17.
Handling depends on request type. A partial opt-out is recorded and the Data Subject's record is processed accordingly only within the remaining consent. A full opt-out is recorded and no further processing is allowed. For a Right to Erasure request (Article 17 GDPR), the Data Subject's record, including backups, is deleted.
We maintain a complete Data Subject Enquiry and complaint process with three levels: Level 1 (complaint to the Data Controller with internal review and response), Level 2 (escalation to the Supervisory Authority with investigation), and Level 3 (judicial remedies, GDPR Articles 77/78, Alternative Dispute Resolution available). We record approximately 1 Level 1 enquiry per month with no Level 2 or above progression.
We collect personal information directly from the Data Subject under conditions where it's advantageous for them to provide it correctly. Collection processes include Input QA on name, address, mobile and email, plus repeat QA that cross-validates repeated records across campaigns.
Campaign targets use existing records for client campaigns in direct marketing, and failed records are removed. Liveness services (HLR, email bounce, "left address" flags, call-centre dial flags, and mail services) run periodically to confirm data. Data subjects also have a right to update their own details.
Through point-of-collection quality assurance, ongoing verification and maintenance (liveness) services, and a data refresh cycle with internal cross-validation.
