Privacy Policy
Outpost Services Pte. Ltd. respects your privacy and is committed to handling personal data responsibly. This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal data when you visit www.outpost.com.sg, contact us, engage or receive our services, apply for a role, work with us, supply goods or services to us, or otherwise interact with Outpost.
Outpost is a Singapore-based business process outsourcing and virtual staffing company. Depending on the activity, we may handle personal data for our own business purposes or process it on a client’s instructions. This distinction is explained below because different responsibilities apply to each role.
In this policy, personal data means information about an identifiable individual, whether the information is accurate or not, including information that can identify the individual when combined with other information to which an organisation has or is likely to have access.
1 Scope of this policy
This policy applies to personal data handled by Outpost in connection with our website, sales and marketing, client relationships, staffing and outsourcing services, recruitment, workforce administration, vendors and other business activities. It applies to website visitors, prospective and current clients, client representatives, job applicants, employees, contractors, candidates in our talent pool, suppliers and other individuals who interact with us.
This policy should be read together with any collection notice, employment or contractor notice, client agreement, data processing terms, consent form or other notice provided for a specific activity. If Outpost processes personal data solely on a client’s behalf, the client’s privacy notice and our agreement with that client will generally govern that processing, to the extent permitted by law.
2 Our roles when handling personal data
Outpost as an organisation
Outpost acts as an organisation under Singapore’s Personal Data Protection Act 2012 when we decide why and how personal data is handled for our own purposes. Examples include managing enquiries and client accounts, recruiting and managing personnel, administering payroll and invoices, operating our website, conducting our own marketing and meeting legal or regulatory obligations.
Outpost as a data intermediary
When our virtual assistants, contact centre agents or other personnel handle personal data solely to provide services on a client’s instructions, Outpost may act as a data intermediary. The client normally decides the purposes and permitted uses of that data. This can include customer, tenant, guest, patient, employee or other end-user data contained in the client’s systems, communications and records.
We process that data only for the agreed services and in accordance with the client’s instructions, applicable contracts and law. Individuals seeking access to, correction of or information about client-controlled data should normally contact the relevant client. If we receive such a request, we may refer it to the client and assist the client as required. If Outpost uses data for an independent purpose outside the client’s instructions, we will be responsible for that separate use as an organisation.
3 Personal data we may collect
The personal data we collect depends on your relationship with Outpost and the service involved. It may include the following categories.
Identity and contact information, such as your name, telephone number, email address, postal address, nationality, company, job title and business contact details.
Enquiry and relationship information, such as the service you are interested in, business requirements, correspondence, meeting notes, proposals, contracts, instructions, preferences, feedback and complaint records.
Service and operational records, such as assigned personnel, work instructions, schedules, tickets, cases, call and message logs, recordings where applicable, quality reviews, reports and escalation records.
Billing and administrative information, such as invoice details, payment status, bank or payment instructions, tax and accounting records, and authorised signatory information.
Recruitment and workforce information, such as a curriculum vitae, employment and education history, qualifications, interview notes, assessment results, references, background screening information, identity and work eligibility documents, compensation information, bank details, attendance, leave, training, performance and disciplinary records.
Work-system and monitoring information for personnel, where applicable and notified, such as time records, login and access logs, application usage, device and security events, work-related screenshots, and recordings or quality reviews of service interactions.
Website and technical information, such as internet protocol address, device and browser type, operating system, approximate location, referring website, pages viewed, actions taken, timestamps, cookie identifiers and diagnostic or security logs.
Client service data that we process on a client’s behalf. Depending on the engagement, this may include contact details, bookings, enquiries, complaints, call or message contents, transaction and account information, accommodation or tenancy records, insurance and claims information, and health or clinical information.
Some assignments involve information that may cause greater harm if misused, including government identification numbers, financial information, background check results and health information. We seek to limit access to what is needed for the relevant role and apply safeguards appropriate to the risk and the agreed service setup.
Please do not send confidential records, patient information, government identification documents or other sensitive personal data through our general website form unless we have asked for it and provided an appropriate channel.
4 How we collect personal data
We may collect personal data in the following ways.
Directly from you when you submit a website form, call, email or message us, attend a meeting, request a quote, sign an agreement, apply for a role, complete an assessment or provide documents.
From a client, authorised user or other person who engages us or provides data so that we can perform an agreed service.
From recruitment platforms, referees, former employers, educational institutions, screening providers and publicly available professional sources, where appropriate and permitted.
From a client’s customers, patients, tenants, guests, employees, suppliers or other individuals when our personnel communicate with them as part of the client’s service.
Automatically from our website, systems and communications tools through cookies, analytics, server logs, security records and similar technologies.
From public records, business directories, professional networks, events, referrals and lawful marketing sources.
If you provide personal data about another person, you should have authority to do so and should inform that person of the relevant purposes and this policy where required.
5 How we use personal data
We may collect, use and disclose personal data for purposes that are reasonable and relevant to our relationship with you, including to:
respond to enquiries, arrange discovery calls, prepare quotations and proposals, and communicate about our services;
evaluate, establish, manage and end client, supplier, employment and contractor relationships;
recruit, assess and shortlist candidates, verify qualifications and references, conduct appropriate background checks, match candidates with client requirements and manage an agreed talent pool;
onboard, schedule, train, support and manage personnel, including timekeeping, leave, payroll, performance, service quality, security, business continuity and replacement planning;
provide executive assistant, personal assistant, customer service, contact centre, healthcare support, telemarketing, data entry, administrative and other outsourced services in accordance with client instructions;
record and review work-related calls, messages, meetings or system activity where notified and reasonably necessary for service delivery, training, quality assurance, security, incident investigation or dispute resolution;
administer contracts, invoices, payments, accounts, audits, insurance and corporate records;
operate, secure, analyse and improve our website, systems, services, procedures, staffing and client experience;
send service updates and, where permitted, information about Outpost services that may be relevant to you;
prevent and investigate fraud, misuse, security incidents, misconduct, legal claims and breaches of contract or policy; and
comply with applicable laws, court orders, regulatory requirements and requests from public authorities, and protect the rights, safety and property of Outpost, our clients, personnel and others.
We may also create aggregated or de-identified information for reporting, service improvement and business analysis where the information no longer identifies an individual. We will seek additional consent or provide further notice if we wish to use personal data for a materially different purpose and no legal exception applies.
6 Consent and other permitted processing
We collect, use and disclose personal data with your consent, where consent may reasonably be deemed from the circumstances, or where the collection, use or disclosure is otherwise permitted or required by the PDPA or another applicable law. When you voluntarily provide personal data for a stated purpose, we may use it for that purpose and for purposes that are reasonably related to it.
You may withdraw consent for our continued collection, use or disclosure of personal data by giving reasonable notice through the contact details in section 17. We will explain any likely consequences and will stop the affected processing within a reasonable period unless continued processing is permitted or required by law. Withdrawal does not affect processing that occurred lawfully before it took effect. Depending on the data and purpose, withdrawal may prevent us from providing a service, considering an application or continuing a relationship.
7 Client service data
The type and volume of personal data handled during an outsourcing engagement depends on the client’s systems, channels, industry and instructions. We seek to restrict personnel access to the systems and information required for their assigned duties. We do not use client service data for Outpost’s independent marketing or sell it to third parties.
Clients are responsible for deciding what personal data is collected for their services, giving required notices, establishing a lawful basis for the processing, setting appropriate access permissions and giving Outpost lawful instructions. This is especially important for healthcare, financial services, accommodation, claims handling and other work involving sensitive or regulated information. Outpost remains responsible for the obligations that apply to us as a data intermediary and for any independent processing we undertake as an organisation.
If we have reason to believe that a data breach has occurred in relation to personal data processed for a client, we will notify that client without undue delay and provide reasonable cooperation for containment, assessment and required notifications.
8 Disclosure of personal data
We may disclose personal data, on a need-to-know basis, to the following recipients where relevant to the purposes in this policy.
Outpost employees, assigned personnel, contractors and authorised representatives in Singapore, the Philippines and other locations from which an agreed service is delivered.
Current or prospective clients when considering or managing a candidate placement or service team, after giving the candidate appropriate notice and obtaining consent where required.
Service providers that support hosting, cloud storage, communications, telephony, customer relationship management, recruitment, background screening, payroll, timekeeping, accounting, payment processing, security, analytics, document management and other business operations.
A client’s authorised systems, vendors and representatives where this is required to perform the client’s instructions.
Professional advisers, auditors, insurers, banks and other parties who assist us with legal, financial, risk and corporate matters.
Courts, regulators, law enforcement and other public authorities where disclosure is required or permitted by law.
A prospective purchaser, investor or successor in connection with a proposed or completed restructuring, investment, merger, sale or transfer of all or part of our business, subject to appropriate confidentiality and data protection measures.
We do not sell or rent personal data. A service provider may process personal data only for authorised purposes and remains subject to its contractual and legal responsibilities.
9 Overseas access and transfers
Outpost provides services through a distributed workforce, including personnel based in the Philippines, and uses service providers that may store or process information in other countries. Personal data may therefore be transferred to, stored in or accessed from locations outside Singapore when this is necessary for the relevant service or business purpose.
Where the PDPA’s transfer limitation requirements apply, we take appropriate steps to ensure that overseas recipients provide a standard of protection comparable to the PDPA. Depending on the arrangement, these steps may include data protection clauses, transfer agreements, due diligence, confidentiality obligations, limits on purpose and access, security requirements and other legally recognised safeguards. When we act as a data intermediary, overseas access and transfers are also subject to the client’s instructions and our agreement with the client.
10 Security and workforce controls
We use reasonable administrative, technical and physical measures appropriate to the nature and sensitivity of the personal data, the risks involved and the service arrangement. Measures may include confidentiality obligations, data protection and security training, appropriate screening, role-based access, unique user accounts, password management, multi-factor authentication, anti-malware protection, encryption, system and activity logging, managed devices or Outpost-issued devices for higher-risk arrangements, secure deletion and incident response procedures.
The controls used for a particular engagement may vary according to the client’s systems, risk assessment and agreed service tier. Clients should grant only the access needed for assigned duties and promptly remove or change access when roles change. We review access and work activity where reasonably necessary for security, quality and compliance.
No method of electronic transmission or storage is completely secure. Although we take reasonable precautions, we cannot guarantee that unauthorised access or loss will never occur. Please contact us promptly if you suspect that personal data connected with Outpost has been compromised.
11 Retention of personal data
We retain personal data only for as long as it is reasonably needed for the purpose for which it was collected, a related business or legal purpose, or as required by law. The period depends on the nature and sensitivity of the data, our relationship with the individual, contractual requirements, dispute and limitation periods, accounting and employment obligations, security needs and the instructions of a client for whom we act as a data intermediary.
Client service data is retained, returned, deleted or de-identified according to the client agreement, lawful instructions and applicable requirements.
Candidate information is retained for the recruitment process and, where notified and permitted, for a reasonable talent-pool period so that the candidate may be considered for suitable roles.
Business, workforce, contract and financial records are retained for the periods needed to administer the relationship and meet legal, accounting, audit, insurance and dispute-resolution requirements.
Recordings, messages, activity records and security logs are retained according to operational, quality, security and client requirements, taking account of the sensitivity of the content.
When retention is no longer justified, we take reasonable steps to delete the data, securely dispose of the relevant record, or remove the means by which it can be associated with an individual.
12 Website cookies and analytics
Our website uses cookies and similar technologies that support website operation, security, performance measurement and analytics. Some cookies are set by third parties. Our website currently uses Google Analytics, which may collect information such as your browser and device type, approximate location, referring page, pages viewed, interactions, timestamps and an analytics identifier. We do not ask Google Analytics to identify website visitors by name.
You can control or delete cookies through your browser settings. You may also use Google’s Analytics opt-out tool and review Google’s Privacy Policy for more information. Blocking some cookies may affect website functionality. We will seek consent for non-essential cookies where required by applicable law.
13 Marketing and telephone messages
We may use contact details to send information about Outpost services, follow up on an enquiry or relationship, or conduct business-to-business outreach where permitted. You may ask us to stop marketing messages at any time by using an unsubscribe option, replying with an opt-out instruction where available, or contacting us through section 17. Service, security and contractual messages are not marketing and may continue where necessary.
For marketing calls, text messages, WhatsApp messages or faxes sent to Singapore telephone numbers, we will comply with the applicable Do Not Call provisions, including checking the relevant register unless valid consent or another exception applies, identifying the sender and providing contact information. Where we conduct a campaign for a client, the parties’ responsibilities should be set out in the service agreement, and each party remains responsible for the obligations that apply to it.
14 Access correction and privacy requests
You may request access to personal data that Outpost holds about you and information about how it was used or disclosed during the period required by law. You may also request correction of an error or omission. We may need to verify your identity and clarify the scope of your request before responding.
The PDPA provides exceptions to access and correction, and we may refuse or limit a request where an exception applies. Where permitted, we may charge a reasonable fee for an access request and will give an estimate before proceeding. We will respond as soon as reasonably practicable and make required corrections and notifications to relevant recipients.
You may also ask us to withdraw consent, stop direct marketing, consider deletion or restriction, or review a privacy concern. These requests are subject to applicable law and any continuing legal or business need to retain or process the data. If your request concerns data controlled by one of our clients, please contact that client directly; we may forward or refer a request received by Outpost.
To help us act on a request, please provide your full name and contact details, describe your relationship with Outpost, identify the data or activity concerned, and state what you would like us to do. Do not send a copy of an identity document unless we specifically request it through an appropriate channel.
15 Data breaches
We assess suspected data breaches and take reasonable steps to contain and address them. Where a breach is notifiable, we will notify the Personal Data Protection Commission and affected individuals as required by law. For client service data, we will notify the relevant client without undue delay when we have reason to believe that a breach has occurred and will support the client’s assessment and response.
16 Third party sites and children
Third party sites and services
Our website and communications may link to third-party sites or services, including WhatsApp, social media, recruitment platforms and client systems. Those parties handle personal data under their own terms and privacy notices. Outpost is not responsible for a third party’s independent privacy practices.
Children
Our website and general business services are directed to businesses and working professionals, not to children acting independently. We do not knowingly invite children to submit personal data through our general website forms. Some client engagements, including healthcare services, may involve data about minors; in those cases, we process the data on the client’s instructions and subject to the applicable safeguards.
17 Changes and contact details
Changes to this policy
We may update this policy to reflect changes in our services, practices, systems or legal obligations. The current version will be published on our website with its effective date. Where appropriate, we will give additional notice of a material change.
Data Protection Officer
Questions, requests, consent withdrawals and complaints about Outpost’s handling of personal data may be sent to:
Please use the subject line Privacy Request when emailing us. We will review complaints and seek to resolve them fairly and as soon as reasonably practicable. You may also contact the Personal Data Protection Commission if you are not satisfied with our response.
Outpost Services Pte. Ltd. Attention Data Protection Officer 1 Paya Lebar Link, #04-01, Singapore 408533 hello@outpost.com.sg | +65 6810 8857
