Privacy Notice

1. What personal data we collect

When you join and use TradePass, we collect:

• Your name
• Your email address
• Your phone number
• Your profile information — for example your "about" text, your role/job type, and any profile photo you add
• Your membership details — your membership status and your outlet/venue association
• Verification evidence you provide to confirm your F&B employment
• Basic account and usage information needed to run your account securely

We practise data minimisation — we only collect what we need to run the platform.

2. Why we collect it (our purposes)

We collect, use, and disclose your personal data only for these purposes:

• Operating the members-only directory — creating and running your membership account and profile;
• Showing and verifying industry deals and events — so members can find and use them;
• Enabling redemption — displaying your Member ID and photo so venue staff can confirm you are the account holder and apply a deal;
• Venue and outlet association — linking you to the outlet or venue you work at;
• Membership verification — confirming you are eligible as an industry member;
• Sponsor visibility — displaying sponsor logos and banner ads within the platform (we do not share your personal data with sponsors for this);
• Communicating with you — service and account messages about your membership;
• Security, safety, and legal compliance — protecting the platform and meeting our legal obligations.

We will not use your personal data for a new, unrelated purpose without notifying you and obtaining your consent, as required by the PDPA's Purpose Limitation and Notification obligations.

3. How we rely on your consent

Your personal data is collected on the basis of your consent, given in one of two ways:

1. If you applied yourself (self-application): you gave consent by ticking the consent box and submitting your application. We record the date and time of that consent.
2. If you were added by a venue manager or administrator (manager-added staff): a manager or administrator may provide your details to enrol you as staff of their outlet. In that case, you confirm your consent to this Privacy Notice at your first login, before your membership becomes active. If you do not consent, you should not proceed and can ask us to remove your details.

You may withdraw your consent at any time by contacting us (see Section 9). Withdrawing consent may mean we can no longer provide you with membership.

4. Who we share it with

• We do not sell your personal data.
• We do not share your personal data with external organisations or an external CRM. TradePass is self-contained; your data lives in our own secured database.
• Within the platform, limited profile information may be visible to other members and to the administrators and managers of the outlet/venue you are associated with, as part of running the members-only directory.
• At redemption, venue staff see your Member ID and profile photo to confirm your identity in person. Venues are instructed not to record any personal information — at most a note of your Member ID only.
• We may disclose personal data where required by law or to protect the platform's or members' safety and rights.

5. Where your data is stored and how we protect it

• Your data is stored in our managed database (Supabase), hosted in the Southeast Asia (Singapore) region, and is encrypted at rest.
• We do not routinely transfer your personal data outside Singapore. Where any processing occurs abroad, it is protected to a standard comparable to Singapore's PDPA, in line with the PDPA's Transfer Limitation obligation.
• Access is restricted (members-only, role-based) and administrator actions are logged.
• We apply reasonable technical and organisational security measures to protect your data against unauthorised access, use, or disclosure, in line with the PDPA's Protection Obligation.

6. How long we keep it

We keep your personal data for as long as your membership is active and for as long as we need it for the purposes above or to meet legal obligations. When it is no longer needed, we delete or anonymise it, in line with the PDPA's Retention Limitation obligation. Certain audit records (for example, that an admin action occurred) may be retained after your account is deleted, without your identifying details.

7. Your rights: access and correction

Under the PDPA you have the right to:

• Access the personal data we hold about you and information about how it has been used;
• Correct any personal data that is inaccurate or out of date.

You can update much of your profile directly in the app, and you can request an export of your own data (right of access) or request deletion of your account from within the platform or by contacting us (see Section 9). We will respond within a reasonable time as required by the PDPA.

8. Accuracy

Please keep your profile accurate and up to date so we can keep your personal data correct.

9. Contact us / Data Protection Officer

For any question about this Notice, to withdraw consent, or to exercise your access, correction, or deletion rights, contact our Data Protection Officer:

privacy@theurbanfindr.com
UrbanFindr Pte. Ltd., 301 Boon Keng Road, MB15, Singapore 339779

10. Changes to this Notice

We may update this Privacy Notice from time to time. The "Effective date" at the top shows when it was last updated. Where changes are material, we will take reasonable steps to notify members.