Privacy Policy

1.Definitions

"Personal data" means data, whether true or not, about an individual who can be identified: (a) from that data; or (b) from that data and other information to which we have or are likely to have access.

"Data Intermediary" means an organisation that processes personal data on behalf of SL2, under a written contract.

2.Personal Data We Collect

Depending on the nature of your interaction with us, we may collect personal data such as your full name, residential address, email address, telephone or mobile number, age or age group, gender, preferred language, household composition, flat type, emergency contact or next-of-kin information, caregiver or authorised representative details, photographs, audio and video recordings, feedback, enquiries and correspondence, information submitted through forms, surveys, household assessments, registrations and applications, information provided when you take part in our events, programmes, projects, workshops, training or other activities, and other personal data that you voluntarily provide to us or that is reasonably necessary for the purposes described in this Privacy Policy.

Where you take part in a programme that involves sensors or wearable devices, we may also collect indoor temperature and humidity readings from sensors placed in your home or another location where you take part in the programme and, where you use a wearable device we issue, readings such as heart rate, movement and activity levels, and body temperature indicators. These readings are used to give you personalised guidance on staying cool. They are not used to diagnose, assess or record any medical condition.

The types of personal data collected will depend on the nature of the particular interaction, service, programme or activity. We collect only what is reasonably necessary for the purposes described in this Privacy Policy.

Where we collect personal data relating to a minor, SL2 will obtain consent from a parent, legal guardian or other authorised representative where appropriate or required by law. Where an individual is unable to give consent on their own behalf, we will seek consent from a person who is lawfully authorised to act for them.

3.How We Collect Personal Data

We generally collect your personal data:

• Directly from you (or your authorised representative) when you complete an enquiry or registration form on our Site, sign up for or take part in our events, programmes, projects, workshops or training, or subscribe to our communications;
• When you communicate with us by email, telephone, SMS, WhatsApp or other channels;
• When you take part in surveys, household assessments, research studies or profiling questionnaires;
• From sensors or wearable devices provided to you as part of a programme, which record readings and related device information for as long as they remain in use;
• Indirectly from community partners, grassroots organisations, project collaborators, government agencies or client organisations, where you have been referred to us or enrolled through an authorised channel; and
• Automatically when you use our Site or mobile application, including through cookies and similar technologies.

Where you provide personal data about another individual, such as a next-of-kin, emergency contact, caregiver, household member or authorised representative, you should ensure that you have informed that individual and obtained any consent required for us to collect, use and disclose their personal data for the purposes described in this Privacy Policy.

Where required under the PDPA or other applicable laws, we will obtain your consent before collecting, using or disclosing your personal data. We will also seek your consent before collecting additional personal data, or before using your personal data for purposes we have not notified to you, unless the collection, use or disclosure is permitted or required by law.

You may choose not to provide certain personal data. Depending on the circumstances, this may prevent us from providing certain services, processing your request, registering you for an event or programme, or otherwise carrying out the relevant activity.

4.Purposes for Collection, Use and Disclosure

We may collect, use and disclose your personal data for any or all of the following purposes:

1. Services, Programmes, and Event Management
   1. Processing registrations, applications, bookings and requests for our consultancy services, workshops, training programmes and community events;
   2. Providing, managing, and administering our products, services, and digital features;
   3. Coordinating logistics, health, safety, and operational details with venue owners, venue operators, and event organizers;
   4. Managing your account, administrative records and ongoing relationship with us;
   5. Enabling you to use interactive features of our services, where you choose to do so; and
   6. Carrying out our contractual obligations under any agreement between you and SL2.
2. Sensor and wearable programmes
   1. Monitoring indoor conditions and issuing alerts to you before heat stress escalates;
   2. Generating personalised guidance on staying cool, including passive cooling and daily habit recommendations;
   3. Coordinating volunteers or community partners to provide assistance to you, where you have agreed to receive such support;
   4. Contacting your emergency contact, next-of-kin or caregiver where readings or other circumstances suggest a risk to your safety or wellbeing; and
   5. Installing, maintaining, replacing and recovering devices provided to you. Further detail is set out in the DPN for the relevant programme.
3. Communication and Stakeholder Engagement
   1. Responding to, handling, and processing your enquiries, requests, applications, feedback, or complaints;
   2. Sending administrative, operational, or service updates; and
   3. Managing emergency contact and next-of-kin information provided in connection with programme participation.
4. Evaluation, Surveys, and Service Improvement
   1. Designing and conducting surveys, questionnaires and research studies for participant profiling, statistical analysis and impact assessment;
   2. Researching, designing, developing, and launching new products, services, workshops, seminars, webinars, and community initiatives; and
   3. Preparing aggregated or anonymised reports and evaluations for funders, partners and public dissemination.
5. Direct Marketing

   Where permitted by applicable law and subject to your consent to receive such communications, SL2 may use your personal data to:

   1. Market and promote services, programmes, products, events, workshops, publications, and other offerings provided by SL2 and our affiliates or related entities;
   2. Invite you to seminars, webinars, conferences, workshops, community programmes, events and other activities organised or supported by SL2 or our affiliates or related entities;
   3. Provide you with newsletters, alerts, educational materials and updates that you have consented to receive; and
   4. Communicate with you about opportunities to participate in SL2's or our affiliates' programmes, research, surveys, events, and other initiatives.

   We may conduct direct marketing through email, SMS, WhatsApp, direct mail, or other communication channels permitted by applicable law.

   You may choose not to receive promotional or marketing materials at any time by following the unsubscribe instructions in our communications or by notifying us (see the "Contacting Us" section below). Upon receipt of your request, we will cease sending marketing communications, at no charge to you.

6. Legal, Audit, and Regulatory Compliance
   1. Managing internal operations, including accounting, auditing, reporting, and record-keeping;
   2. Complying with applicable laws, regulations, codes of practice, or guidelines issued by regulatory or governmental authorities in or outside Singapore;
   3. Establishing, exercising or defending legal rights and claims, including recovering overdue amounts and obtaining professional advice; and
   4. Meeting reporting, audit and verification obligations owed to funders, grant administrators and government agencies.
7. Other Purposes
   1. Any other purpose reasonably necessary for, or directly related to, the purposes stated above, or for which your consent has been obtained.

The purposes listed above may continue to apply for a reasonable period after your relationship or contract with us has ended or changed, including any period needed to enable us to enforce our rights under a contract or comply with our legal obligations. If you withdraw your consent, we will stop collecting, using or disclosing your personal data for the relevant purposes from the date your withdrawal takes effect, unless continued processing is required or permitted under applicable law.

Where a programme involves sensors, wearable devices or volunteer support, personal data may also be disclosed to volunteers, community partners and your nominated emergency contact, next-of-kin or caregiver, as described in the DPN for that programme.

5.Our Basis for Collecting, Using and Disclosing Personal Data

Before collecting, using or disclosing your personal data, SL2 will notify you of the purposes for doing so and obtain your consent where required, unless the PDPA or other applicable law permits or requires us to collect, use or disclose your personal data without consent.

You may be deemed to have consented in circumstances permitted under the PDPA, including where you voluntarily provide personal data for an obvious purpose.

We may also rely on applicable exceptions under the PDPA to collect, use or disclose personal data without consent where permitted by law.

Where SL2 relies on the legitimate interests exception under the PDPA, we will assess the likely adverse effects on the individual and determine that the legitimate interests outweigh any adverse effect, in accordance with applicable requirements.

Examples of purposes for which we may rely on the legitimate interests exception, where applicable, include:

• fraud detection and prevention;
• detection and prevention of misuse of our services, programmes or resources; and
• network and system security analysis to prevent fraud and data security incidents.

6.Disclosure of Personal Data

We may disclose your personal data where necessary for the purposes described in this Privacy Policy, including to:

• service providers, contractors and Data Intermediaries who provide IT, website hosting, cloud storage, software, communications, administrative, event, research or other services on our behalf;
• venue owners, venue operators and event organisers and other parties involved in organising or delivering an SL2 event, programme or activity, where necessary;
• programme, project or research partners involved in delivering, administering or evaluating an SL2 programme or project;
• professional advisers, auditors, insurers and other professional service providers;
• grant funders, sponsors or other funding bodies where reporting or contractual requirements apply;
• government agencies, statutory boards, regulators or public authorities where required or authorised by law, or where necessary for applicable programme, reporting or compliance purposes;
• courts, law enforcement agencies or other parties where disclosure is required or permitted by law; and
• other parties where you have provided consent or where disclosure is otherwise permitted or authorised under applicable law.

Where third-party vendors, contractors or Data Intermediaries process personal data on our behalf, SL2 will take reasonable steps to ensure that appropriate contractual, organisational and technical measures are in place to protect the personal data and limit its processing to the purposes for which it has been provided.

Where a programme-specific DPN identifies particular recipients or categories of recipients, that DPN will provide further information applicable to the programme.

We will not sell, rent, or trade your personal data to any third party.

Sharing data about other people: If you give us personal data about a third party, such as your next-of-kin, caregiver, or another household member, you confirm that you have informed that individual and obtained their consent for us to collect, use, and disclose their personal data for the purposes described in this Privacy Policy.

7.Photography, Audio and Videography

Our programmes, events, workshops, training sessions, community activities, project activities and other activities may involve photography, audio recording and videography by SL2, or by third parties engaged by, authorised by, or working with SL2, including our partners and funders. These may be used for:

• news and media reporting;
• publicity, marketing and outreach;
• funder, grant and stakeholder reporting;
• event documentation and record-keeping; and
• organisational communications.

Such photographs, audio recordings and videos may be published or used by SL2, or by such third parties, in print materials, on our website, on social media and other online platforms, in presentations and reports, and through other communication channels.

Where photographs, audio recordings or videos identify an individual, we will obtain consent where required by applicable law or where otherwise appropriate. Where a participant is a minor, or is unable to give consent on their own behalf, we will seek consent from a parent, legal guardian or other person lawfully authorised to act for them.

If you do not wish to be photographed or recorded, please inform us before or during the relevant activity where reasonably practicable, or contact us using the details provided in this Privacy Policy. We will take reasonable steps to accommodate your request, and choosing not to be photographed or recorded will not affect your participation in the activity.

You may withdraw your consent to the use of your photograph, recording or quotation at any time by notifying us using the contact details in this Privacy Policy. Where photographs or recordings have already been published or shared with a partner or third party, we may not be able to remove or recall them, although we will not use them in new materials from the date your withdrawal takes effect.

8.Cross-Border Transfer

We may transfer personal data outside Singapore where necessary for operational, administrative or technological purposes. For example, personal data may be accessed or processed overseas by technology, cloud service, software or research partners engaged by SL2. Where personal data is transferred outside Singapore, SL2 will take reasonable steps to ensure that the recipient provides a standard of protection comparable to that required under the PDPA. Such measures may include appropriate contractual obligations, access controls, security measures and other safeguards appropriate to the circumstances.

9.Cookies

Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies to recognise your device, monitor website performance, and understand how visitors interact with our website.

Through these technologies, we may automatically collect information such as your Internet Protocol (IP) address, browser information, device information, pages visited, and the date and time of your visit. This information is used for statistical analysis, website improvement, and enhancing user experience.

We do not use cookies for marketing, targeted advertising, or behavioural tracking purposes.

You can also disable cookies by changing your website browser settings to reject cookies. Please note that disabling cookies may affect certain website functionalities or limit our ability to collect website usage information for performance improvement purposes.

For more details on the cookies we use and how to manage your preferences, please read our Cookie Policy (to insert a link).

10.Protection of Personal Data

We have implemented appropriate administrative, technical, and physical measures to protect your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks. These measures are implemented in accordance with PDPC guidelines and include:

• Access controls: access to personal data is restricted to authorised personnel on a need-to-know basis, and disclosure is limited to what is necessary for the recipient's role;
• Data minimisation: we collect and retain only the personal data necessary for the relevant purpose;
• Anonymisation and aggregation: where appropriate, personal data may be anonymised or aggregated for analysis, reporting, or evaluation purposes, such that individuals cannot be readily identified;
• Encryption: we use encryption in transit and at rest where appropriate to the sensitivity of the data and the systems involved.

You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While security cannot be guaranteed, SL2 strives to protect the security of your information and we constantly review and enhance our information security measures.

11.Accuracy Of Personal Data

We generally rely on personal data provided by you (or your authorised representative). In order to ensure that your personal data is current, complete and accurate, please update us if there are changes to your personal data by informing our Data Protection Officer in writing or via email at the contact details provided below.

12.Retention of Personal Data

We will retain personal data only for as long as reasonably necessary to fulfil:

• the purposes for which the data was collected;
• legal or regulatory requirements;
• operational and business purposes;
• dispute resolution and audit requirements; or
• investigations, legal proceedings or regulatory requirements.

When personal data is no longer required, we will take reasonable steps to securely destroy, anonymise or dispose of the data.

13.Your Rights

You (or your authorised representative) may, at any time, request access to personal data about you that is in our possession or under our control; or correct any personal data about you that is inaccurate, incomplete, misleading or not up to date. You may also withdraw your consent, as described in the section headed "Withdrawal of Consent" below.

We may require reasonable verification of identity before processing such requests.

Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.

You may submit your request in writing or via email to our Data Protection Officer at the contact details provided below.

We will respond to your request as soon as reasonably possible. In general, our response will be within ten (10) business days. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the PDPA).

14.Withdrawal of Consent

The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time it is being withdrawn by you in writing. You may withdraw consent and request us to stop collecting, using and/or disclosing your personal data for any or all of the purposes listed above by submitting your request in writing or via email to our Data Protection Officer at the contact details provided below.

Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. In general, we shall seek to process your request within ten (10) business days of receiving it.

Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in a position to continue providing our goods or services to you and we shall, in such circumstances, notify you before completing the processing of your request.

15.Contacting Us

You may contact us if you have any enquiries or feedback on our personal data protection policies and procedures, or if you wish to make any request, in the following manner:

Email Address: dpo@sustainablelivinglab.org

Address: 240 Macpherson Road, Pines Industrial Building, #03-02, Singapore 348574

16.Updates to this Policy

We may update this Privacy Policy from time to time to reflect changes in:

• operational practices;
• technological developments;
• legal and regulatory requirements; and
• PDPC guidance.

Where changes are material, we will notify you by reasonable means, which may include posting a notice on the Site. The date of the most recent update is shown below.