Privacy Policy: With Kinna Pte Ltd

Who we are

With Kinna Pte Ltd is a Singapore human resources consultancy and MOM Licensed Employment Agency (UEN 202536024H). In this policy, "we", "us" and "With Kinna" mean With Kinna Pte Ltd.

This policy explains what personal data we collect, why we collect it, who we share it with, and what you can ask us to do about it. It is written to meet our obligations under Singapore's Personal Data Protection Act 2012 (the PDPA).

We have tried to write it in plain language. If any part of it is unclear, please ask us.

Two different things we do with personal data

This distinction matters, because it changes who you should approach with a request.

Data we hold as an organisation. When you enquire about our services, apply for a role through us, or work with us as a client contact, we decide what to do with your personal data and we are responsible for it under the PDPA. Everything in this policy applies.

Data we handle on behalf of a client. Much of our work involves employee records belonging to the companies who engage us: payroll information, employment contracts, performance records, disciplinary files. We handle that data under instruction, on our clients' behalf, under a written agreement. For that data, the employing company remains the organisation responsible for it, and we act as a data intermediary. Our obligations are to keep it secure and not to retain it longer than needed.

If you are an employee of one of our client companies and want to see, correct, or ask about your own records, please approach your employer directly. We are not able to act on those requests ourselves, because the data is not ours to release.

What we collect, and when

When you visit our website. Very little. withkinna.com has no contact form, no sign-up, no advertising trackers and no analytics tracking you across sites. Our host, Cloudflare, processes technical information such as IP addresses and browser type to serve the site and protect it from attack. We do not use this to build a profile of you.

When you contact us. If you email us or message us on WhatsApp, we receive whatever you choose to send: typically your name, contact details, the name of your company, and the situation you are asking about. Because people often describe a real workplace problem when they first write to us, that message may contain personal data about other people. We treat it with the same care as the rest.

When you use a tool on our site. Where we offer a tool that asks for an email address, we tell you at that point exactly what the address will be used for, and we ask separately before sending you anything beyond what you requested. Figures you enter into a calculator are used to produce your result and are not stored against your identity.

If you are a candidate. As a licensed employment agency, we collect what is needed to represent you for a role: your CV and work history, education, salary expectations, references, and, where a role or work pass application requires it, identification and immigration details. We collect this from you directly, or from a job board or referrer where you have made your details available for that purpose.

Where you give us the name of a referee, we will normally approach them, and what they tell us about your work becomes part of your record with us. To do that we also hold the referee's own name and contact details. We keep our own notes on the candidates we meet and represent, including interview and placement feedback, whether that feedback is positive or not.

If you are a client contact. Name, role, business contact details, and the record of our work together.

We do not knowingly collect personal data from anyone under 18 through our website, and we do not seek sensitive personal data unless a specific engagement genuinely requires it.

Why we collect it

We use personal data to respond to enquiries and provide the services we have been asked for; to represent candidates for roles and support work pass applications; to deliver HR, recruitment and advisory work under our client engagements; to meet legal, regulatory and licensing obligations, including those attaching to our Employment Agency Licence; to keep our own business records; and, only where you have separately agreed, to send you occasional writing on HR and employment matters in Singapore.

We also use what we hold to understand patterns in pay, hiring and employment practice in Singapore, and to inform the guides, salary benchmarks and tools we publish. Anything published that way describes groups rather than people. It will not name you, identify your employer, or carry a figure that can be traced back to you.

We do not sell personal data. We have never done so and have no plans to.

Consent, and how to withdraw it

We rely on your consent to collect and use your personal data, except where the PDPA permits or requires us to act without it, for example where we must retain records to comply with the law.

Where you have agreed to receive marketing from us, that agreement is separate from any service you have asked for, and you can withdraw it at any time without affecting anything else. Write to us at the address in the Contact us section below, or use the unsubscribe link in any message we send.

Withdrawing consent may mean we can no longer provide a particular service. We cannot, for instance, represent a candidate whose details we may no longer hold. We will tell you if that is the case rather than simply stopping.

Who we share it with

We share personal data only where there is a reason to, and only as much as the reason requires:

• Clients and prospective employers, where you are a candidate and have agreed to be put forward for a role. What we send is your CV and the assessment relevant to that role, not everything we hold.
• Referees you have named, whom we may approach to discuss your work.
• Colleagues within With Kinna who are working on the role or engagement in question.
• Our delivery partners, where an engagement calls for expertise we coordinate rather than provide in-house: partner lawyers on employment law matters, corporate secretarial partners, and learning and development providers. They receive only what the specific piece of work requires.
• Service providers who run our systems, including our website host and our business email and file storage providers, who process data on our instructions.
• Government bodies and regulators, where the law requires it, including the Ministry of Manpower in connection with work passes and our licence obligations.

We require the organisations we work with to protect personal data to a standard comparable to our own.

If you would rather not give us some of what we ask for, say so. We will tell you honestly what it affects. For a candidate, withholding work history or references may mean we cannot put you forward for a particular role, because the client will ask us for exactly that.

Personal data that leaves Singapore

Some of the systems we rely on, including website hosting, business email and file storage, are operated by providers whose infrastructure sits outside Singapore. Those providers are our website host and content platform (Cloudflare and Sanity) and our business email and file storage (Microsoft 365). Where personal data is transferred out of Singapore, we take steps to satisfy ourselves that it will be protected to a standard comparable to the PDPA, as the Act requires.

How long we keep it

We keep personal data only as long as there is a business or legal reason to, and then we dispose of it securely. Where the law sets a minimum, we keep to it. Where it does not, we have set a period we can defend:

• Enquiries that do not lead to work with us: 12 months.
• Candidate records: 24 months from our last contact with you, unless you ask us to keep you on file for longer.
• Work pass documentation: at least 3 years from the date of the application, and from any renewal, as our Employment Agency Licence requires.
• Client engagement records: 5 years, which matches the period tax law requires us to keep business records for.
• Employee records we hold for a client: returned or deleted at the end of the engagement, on that client's instruction.
• Our marketing list: until you withdraw consent, after which we remove you within ten business days.

How we protect it

We restrict access to personal data to the people who need it for their work. Our systems are access-controlled and our devices are encrypted. Client employee data is handled under written agreement and kept separate from our own business records.

No system is perfect, and we will not claim otherwise. If a data breach occurs that is likely to result in significant harm, or that meets the threshold for notification under the PDPA, we will notify the Personal Data Protection Commission and the individuals affected, as the Act requires.

Your rights

You may ask us for a copy of the personal data we hold about you, and for information about how it has been used or disclosed in the past year. You may ask us to correct anything that is wrong or out of date. You may withdraw consent for uses you have previously agreed to.

Write to our Data Protection Officer using the details below. We will respond to your request as soon as reasonably possible, and within 30 calendar days. If we require additional time or are legally restricted from granting access, we will notify you in writing with the reasons.

If you are an employee of a client company asking about your own employment records, please see Two different things we do with personal data above: that request goes to your employer.

Cookies

Our website does not use advertising or analytics cookies, and we do not track you across other websites. Our host may set strictly necessary cookies to keep the site secure and working. You can block cookies in your browser settings; the site will continue to work.

Marketing messages

We send marketing only to people who have asked to receive it. Every message includes a way to stop receiving them. You can also write to [email protected] with "Unsubscribe" in the subject line, and we will remove you within ten business days.

We do not send marketing by text or WhatsApp to Singapore telephone numbers except where the Do Not Call provisions of the PDPA permit it.

Changes to this policy

We will update this policy when our practices change. The effective date at the top tells you which version you are reading. If a change materially affects how we use personal data you have already given us, we will bring it to your attention rather than relying on you to notice.

Contact us

Our Data Protection Officer is responsible for how we handle personal data and is the right person for any question, request or complaint about it.

Data Protection Officer
With Kinna Pte Ltd
7 Mandai Link, #04-22, Mandai Connection, Singapore 728653
[email protected]

If you are not satisfied with how we have handled a matter, you may raise it with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.